Edit tour

Linux Analysis Report
gmips.elf

Overview

General Information

Sample name:	gmips.elf
Analysis ID:	1554847
MD5:	aa60fb433b3a225dd4b0a2f3e3c5ca7a
SHA1:	d15ce729ad3fe77de57ec2b3133a082f2b191d6a
SHA256:	7307a71d6ce43e8a7509342e0d44c6588ce1537c23168175687dd7edb92456fb
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554847
Start date and time:	2024-11-13 01:19:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gmips.elf
Detection:	MAL
Classification:	mal56.linELF@0/1@0/0

Runtime Messages

Command:	/tmp/gmips.elf
PID:	5511
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Onboard the boat
Standard Error:

Process Tree

system is lnxubuntu20

gmips.elf (PID: 5511, Parent: 5430, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/gmips.elf

gmips.elf New Fork (PID: 5513, Parent: 5511)

gmips.elf New Fork (PID: 5517, Parent: 5513)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gmips.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: gmips.elf	ReversingLabs: Detection: 28%
Source: gmips.elf	Virustotal: Detection: 36%			Perma Link

Source: gmips.elf

String: (wgettftpcurlftpget/proc/proc/%s/cmdliner/.

Source: global traffic

TCP traffic: 192.168.2.14:40026 -> 154.213.187.125:51321

Source: /tmp/gmips.elf (PID: 5511)

Socket: 127.0.0.1:51101

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.linELF@0/1@0/0

Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/gmips.elf (PID: 5517)	File opened: /proc/262/cmdline	Jump to behavior

Source: /tmp/gmips.elf (PID: 5511)

Queries kernel information via 'uname':

Jump to behavior

Source: gmips.elf, 5511.1.00007fffbeba9000.00007fffbebca000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/gmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gmips.elf
Source: gmips.elf, 5511.1.0000558fb28c9000.0000558fb2950000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: gmips.elf, 5511.1.0000558fb28c9000.0000558fb2950000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: gmips.elf, 5511.1.00007fffbeba9000.00007fffbebca000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gmips.elf	29%	ReversingLabs	Linux.Trojan.Mirai
gmips.elf	37%	Virustotal		Browse
gmips.elf	100%	Avira	EXP/ELF.Agent.J.8

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
154.213.187.125	unknown	Seychelles		22769	DDOSING-BGP-NETWORKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	c0r0n4x.ppc.elf	Get hash	malicious	Unknown	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse
	main_mips.elf	Get hash	malicious	Mirai	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	yakuza.m68k.elf	Get hash	malicious	Unknown	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_x86_64.elf	Get hash	malicious	Mirai	Browse
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
154.213.187.125	gx86.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	c0r0n4x.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	c0r0n4x.ppc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	c0r0n4x.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	c0r0n4x.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
DDOSING-BGP-NETWORKUS	gx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	mpsl.b.elf	Get hash	malicious	Mirai	Browse	154.213.187.68
	arm.b.elf	Get hash	malicious	Unknown	Browse	154.213.187.68
	mirai.m68k.elf	Get hash	malicious	Unknown	Browse	154.213.189.2
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	154.213.189.2
	mirai.sh4.elf	Get hash	malicious	Unknown	Browse	154.213.189.2
	mirai.spc.elf	Get hash	malicious	Unknown	Browse	154.213.189.2
	mirai.arm5.elf	Get hash	malicious	Unknown	Browse	154.213.189.2
	mirai.mips.elf	Get hash	malicious	Unknown	Browse	154.213.189.2
	mirai.arm.elf	Get hash	malicious	Unknown	Browse	154.213.189.2

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.F4gFHn (deleted)

Download File

Process:	/tmp/gmips.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.5068905956085192
Encrypted:	false
SSDEEP:	3:TgLzA3n:TgPG
MD5:	FAA7C9488FD32EE6F0BD4343EDE7BC75
SHA1:	BE18ABD66239F1CD4AEA6CA53FB6B43603B75BF4
SHA-256:	0FA6D38B80C505C3E0782F236D5EF3B0D005B99E2568A4D70B95E5F945BC43E8
SHA-512:	63AB0121570259D389A5B8A9405E800A2A79A412926C421EFF7101EC86A8A5B8DC8649CF7BE64316147CB52A159C7D60D6796AA61DAA1E4CD7F55666FE808DC7
Malicious:	false
Reputation:	low
Preview:	/tmp/gmips.elf.

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.3289584374926875
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gmips.elf
File size:	72'612 bytes
MD5:	aa60fb433b3a225dd4b0a2f3e3c5ca7a
SHA1:	d15ce729ad3fe77de57ec2b3133a082f2b191d6a
SHA256:	7307a71d6ce43e8a7509342e0d44c6588ce1537c23168175687dd7edb92456fb
SHA512:	0e0cebbf5bb4997b0c7d412818f93458fd4abbc48c308dd4234a89ac14afdac61d0aa7c56be6be263afedecee33c57b827c6e6150953cbc5cba48d64835fda93
SSDEEP:	768:bAa9c/Jn01sllXpaD/sOkAqp/qpp1pQKsAJC/E2chroN4t/NJE/yib+ne9yFobIF:dUi4lpMkAqp/qpp1pQKsA8/Epj9eMFwi
TLSH:	AB63A71E6E218FEDF769C23547B34A21A39C33C527E1D685E2ACD6012E7034D645FBA8
File Content Preview:	.ELF.....................@.`...4...t.....4. ...(.............@...@...........................E...E........k`........dt.Q............................<...'..<...!'.......................<...'......!... ....'9... ......................<...'......!........'9.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	72052
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0xf340	0x0	0x6	AX	16
.fini	PROGBITS	0x40f460	0xf460	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x40f4c0	0xf4c0	0x12f0	0x0	0x2	A	16
.ctors	PROGBITS	0x451000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x451008	0x11008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x451014	0x11014	0x1c	0x0	0x3	WA	4
.data	PROGBITS	0x451030	0x11030	0x3b0	0x0	0x3	WA	16
.got	PROGBITS	0x4513e0	0x113e0	0x530	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x451910	0x11910	0x3c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x451950	0x11910	0x6210	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xb1c	0x11910	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x11910	0x64	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x107b0	0x107b0	5.4822	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x11000	0x451000	0x451000	0x910	0x6b60	3.5233	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 01:20:16.222637892 CET	40026	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:16.227684975 CET	51321	40026	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:16.227747917 CET	40026	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:16.263335943 CET	40026	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:16.268212080 CET	51321	40026	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:16.268260956 CET	40026	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:16.273088932 CET	51321	40026	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:17.244848967 CET	51321	40026	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:17.245230913 CET	40026	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:17.245230913 CET	40026	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:17.250027895 CET	51321	40026	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:18.246294975 CET	40028	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:18.251358986 CET	51321	40028	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:18.251456976 CET	40028	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:18.252033949 CET	40028	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:18.256819963 CET	51321	40028	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:18.256865978 CET	40028	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:18.261805058 CET	51321	40028	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:19.253467083 CET	51321	40028	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:19.253618956 CET	40028	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:19.258423090 CET	51321	40028	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:20.254434109 CET	40030	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:20.259428024 CET	51321	40030	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:20.259483099 CET	40030	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:20.259975910 CET	40030	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:20.264771938 CET	51321	40030	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:20.264847994 CET	40030	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:20.269824028 CET	51321	40030	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:21.247618914 CET	51321	40030	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:21.247843981 CET	40030	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:21.252620935 CET	51321	40030	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:22.248760939 CET	40032	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:22.256252050 CET	51321	40032	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:22.256308079 CET	40032	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:22.256856918 CET	40032	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:22.261653900 CET	51321	40032	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:22.261710882 CET	40032	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:22.266446114 CET	51321	40032	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:23.240111113 CET	51321	40032	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:23.240200043 CET	40032	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:23.245091915 CET	51321	40032	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:24.241156101 CET	40034	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:24.246000051 CET	51321	40034	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:24.246079922 CET	40034	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:24.246696949 CET	40034	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:24.251627922 CET	51321	40034	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:24.251672029 CET	40034	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:24.256532907 CET	51321	40034	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:25.247426987 CET	51321	40034	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:25.247569084 CET	40034	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:25.252377987 CET	51321	40034	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:26.248682976 CET	40036	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:26.257822990 CET	51321	40036	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:26.257880926 CET	40036	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:26.258439064 CET	40036	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:26.266202927 CET	51321	40036	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:26.266244888 CET	40036	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:26.273252964 CET	51321	40036	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:27.256659031 CET	51321	40036	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:27.256736994 CET	40036	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:27.261522055 CET	51321	40036	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:28.032548904 CET	46540	443	192.168.2.14	185.125.190.26
Nov 13, 2024 01:20:28.257672071 CET	40038	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:28.262564898 CET	51321	40038	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:28.262634993 CET	40038	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:28.263156891 CET	40038	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:28.267968893 CET	51321	40038	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:28.268013954 CET	40038	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:28.272782087 CET	51321	40038	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:29.285804987 CET	51321	40038	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:29.285904884 CET	40038	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:29.290836096 CET	51321	40038	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:30.286839962 CET	40040	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:30.292027950 CET	51321	40040	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:30.292083979 CET	40040	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:30.292579889 CET	40040	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:30.297422886 CET	51321	40040	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:30.297466040 CET	40040	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:30.302516937 CET	51321	40040	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:31.275294065 CET	51321	40040	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:31.275410891 CET	40040	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:31.281444073 CET	51321	40040	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:32.276268005 CET	40042	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:32.281239986 CET	51321	40042	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:32.281313896 CET	40042	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:32.281835079 CET	40042	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:32.286609888 CET	51321	40042	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:32.286653996 CET	40042	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:32.291464090 CET	51321	40042	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:33.284513950 CET	51321	40042	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:33.284615993 CET	40042	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:33.289463997 CET	51321	40042	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:34.285574913 CET	40044	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:34.290591955 CET	51321	40044	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:34.290642977 CET	40044	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:34.291212082 CET	40044	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:34.296159029 CET	51321	40044	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:34.296207905 CET	40044	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:34.300995111 CET	51321	40044	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:35.291457891 CET	51321	40044	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:35.291548967 CET	40044	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:35.296834946 CET	51321	40044	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:36.292454958 CET	40046	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:36.297401905 CET	51321	40046	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:36.297477961 CET	40046	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:36.298007011 CET	40046	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:36.302762985 CET	51321	40046	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:36.302809954 CET	40046	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:36.307600021 CET	51321	40046	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:37.305181980 CET	51321	40046	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:37.305268049 CET	40046	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:37.310199976 CET	51321	40046	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:38.306121111 CET	40048	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:38.311218977 CET	51321	40048	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:38.311286926 CET	40048	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:38.311842918 CET	40048	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:38.316654921 CET	51321	40048	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:38.316699028 CET	40048	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:38.321513891 CET	51321	40048	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:39.311116934 CET	51321	40048	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:39.311204910 CET	40048	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:39.315992117 CET	51321	40048	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:40.312117100 CET	40050	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:40.317004919 CET	51321	40050	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:40.317054987 CET	40050	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:40.317549944 CET	40050	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:40.322344065 CET	51321	40050	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:40.322387934 CET	40050	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:40.327202082 CET	51321	40050	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:41.311933994 CET	51321	40050	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:41.312129021 CET	40050	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:41.317101002 CET	51321	40050	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:42.312962055 CET	40052	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:42.317889929 CET	51321	40052	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:42.317977905 CET	40052	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:42.318487883 CET	40052	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:42.323282003 CET	51321	40052	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:42.323333979 CET	40052	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:42.328090906 CET	51321	40052	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:43.341784000 CET	51321	40052	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:43.341900110 CET	40052	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:43.346728086 CET	51321	40052	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:44.342734098 CET	40054	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:44.347675085 CET	51321	40054	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:44.347737074 CET	40054	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:44.348270893 CET	40054	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:44.353055000 CET	51321	40054	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:44.353095055 CET	40054	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:44.357831955 CET	51321	40054	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:45.334391117 CET	51321	40054	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:45.334516048 CET	40054	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:45.348819017 CET	51321	40054	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:46.335688114 CET	40056	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:46.340698004 CET	51321	40056	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:46.340780020 CET	40056	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:46.341273069 CET	40056	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:46.346064091 CET	51321	40056	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:46.346146107 CET	40056	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:46.350991964 CET	51321	40056	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:47.353775024 CET	51321	40056	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:47.353849888 CET	40056	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:47.358699083 CET	51321	40056	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:48.354604959 CET	40058	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:48.359517097 CET	51321	40058	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:48.359576941 CET	40058	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:49.375771046 CET	40058	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:49.380816936 CET	51321	40058	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:49.380867004 CET	40058	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:49.381433964 CET	40058	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:49.386440992 CET	51321	40058	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:49.386477947 CET	40058	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:49.391465902 CET	51321	40058	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:50.398755074 CET	51321	40058	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:50.398931980 CET	40058	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:50.403925896 CET	51321	40058	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:51.400001049 CET	40060	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:51.404963017 CET	51321	40060	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:51.405024052 CET	40060	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:51.405688047 CET	40060	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:51.410464048 CET	51321	40060	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:51.410509109 CET	40060	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:51.415427923 CET	51321	40060	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:52.398621082 CET	51321	40060	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:52.398720980 CET	40060	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:52.403492928 CET	51321	40060	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:53.399624109 CET	40062	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:53.404531002 CET	51321	40062	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:53.404603004 CET	40062	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:53.405472040 CET	40062	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:53.410192966 CET	51321	40062	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:53.410271883 CET	40062	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:53.415224075 CET	51321	40062	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:54.390019894 CET	51321	40062	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:54.390147924 CET	40062	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:54.395797014 CET	51321	40062	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:55.391321898 CET	40064	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:55.396289110 CET	51321	40064	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:55.396395922 CET	40064	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:55.396939039 CET	40064	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:55.401820898 CET	51321	40064	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:55.401868105 CET	40064	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:55.406718969 CET	51321	40064	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:56.409778118 CET	51321	40064	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:56.409918070 CET	40064	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:56.414930105 CET	51321	40064	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:57.411262035 CET	40066	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:57.416408062 CET	51321	40066	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:57.416487932 CET	40066	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:57.417323112 CET	40066	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:57.422111988 CET	51321	40066	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:57.422174931 CET	40066	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:57.427041054 CET	51321	40066	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:58.398505926 CET	51321	40066	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:58.398686886 CET	40066	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:58.403692961 CET	51321	40066	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:59.399825096 CET	40068	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:59.405781031 CET	51321	40068	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:59.405908108 CET	40068	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:59.406845093 CET	40068	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:59.412581921 CET	51321	40068	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:59.412678003 CET	40068	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:20:59.418896914 CET	51321	40068	154.213.187.125	192.168.2.14
Nov 13, 2024 01:20:59.519473076 CET	46540	443	192.168.2.14	185.125.190.26
Nov 13, 2024 01:21:00.416400909 CET	51321	40068	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:00.416529894 CET	40068	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:00.421540022 CET	51321	40068	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:01.417675972 CET	40070	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:01.422827005 CET	51321	40070	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:01.422930002 CET	40070	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:01.423521996 CET	40070	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:01.428399086 CET	51321	40070	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:01.428493023 CET	40070	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:01.433604956 CET	51321	40070	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:02.441667080 CET	51321	40070	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:02.441777945 CET	40070	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:02.446646929 CET	51321	40070	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:03.443108082 CET	40072	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:03.448231936 CET	51321	40072	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:03.448343039 CET	40072	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:03.448996067 CET	40072	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:03.453819036 CET	51321	40072	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:03.453881979 CET	40072	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:03.458782911 CET	51321	40072	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:04.444224119 CET	51321	40072	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:04.444493055 CET	40072	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:04.449413061 CET	51321	40072	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:05.445604086 CET	40074	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:05.450611115 CET	51321	40074	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:05.450668097 CET	40074	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:05.451200008 CET	40074	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:05.456561089 CET	51321	40074	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:05.456613064 CET	40074	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:05.461513996 CET	51321	40074	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:06.444294930 CET	51321	40074	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:06.444628000 CET	40074	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:06.450586081 CET	51321	40074	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:07.446012020 CET	40076	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:07.450951099 CET	51321	40076	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:07.451046944 CET	40076	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:07.451669931 CET	40076	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:07.456408978 CET	51321	40076	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:07.456479073 CET	40076	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:07.461246014 CET	51321	40076	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:08.443737984 CET	51321	40076	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:08.443830013 CET	40076	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:08.448642969 CET	51321	40076	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:09.444885969 CET	40078	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:09.449830055 CET	51321	40078	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:09.449891090 CET	40078	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:09.450463057 CET	40078	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:09.455280066 CET	51321	40078	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:09.455338001 CET	40078	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:09.460067987 CET	51321	40078	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:10.466516018 CET	51321	40078	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:10.466592073 CET	40078	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:10.471468925 CET	51321	40078	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:11.467732906 CET	40080	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:11.472574949 CET	51321	40080	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:11.472623110 CET	40080	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:11.473361969 CET	40080	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:11.478177071 CET	51321	40080	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:11.478236914 CET	40080	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:11.483181000 CET	51321	40080	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:12.477705956 CET	51321	40080	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:12.477786064 CET	40080	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:12.482572079 CET	51321	40080	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:13.478985071 CET	40082	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:13.484217882 CET	51321	40082	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:13.484272957 CET	40082	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:13.485255003 CET	40082	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:13.490020990 CET	51321	40082	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:13.490070105 CET	40082	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:13.494890928 CET	51321	40082	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:14.489532948 CET	51321	40082	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:14.489619017 CET	40082	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:14.494424105 CET	51321	40082	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:15.490618944 CET	40084	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:15.495557070 CET	51321	40084	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:15.495609045 CET	40084	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:15.496282101 CET	40084	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:15.501121998 CET	51321	40084	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:15.501163006 CET	40084	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:15.506258965 CET	51321	40084	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:16.480604887 CET	51321	40084	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:16.480693102 CET	40084	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:16.485529900 CET	51321	40084	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:17.481719017 CET	40086	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:17.489474058 CET	51321	40086	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:17.489542961 CET	40086	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:17.490089893 CET	40086	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:17.496191978 CET	51321	40086	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:17.496246099 CET	40086	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:17.501928091 CET	51321	40086	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:18.489236116 CET	51321	40086	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:18.489341974 CET	40086	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:18.494245052 CET	51321	40086	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:19.490334988 CET	40088	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:19.495628119 CET	51321	40088	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:19.495681047 CET	40088	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:19.496229887 CET	40088	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:19.501013994 CET	51321	40088	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:19.501065016 CET	40088	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:19.505892992 CET	51321	40088	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:20.505354881 CET	51321	40088	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:20.505465031 CET	40088	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:20.510396004 CET	51321	40088	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:21.506542921 CET	40090	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:21.512969017 CET	51321	40090	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:21.513099909 CET	40090	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:21.513583899 CET	40090	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:21.518671989 CET	51321	40090	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:21.518718958 CET	40090	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:21.524022102 CET	51321	40090	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:22.518668890 CET	51321	40090	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:22.518774986 CET	40090	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:22.524730921 CET	51321	40090	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:23.519747019 CET	40092	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:23.524739981 CET	51321	40092	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:23.524820089 CET	40092	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:23.525459051 CET	40092	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:23.530265093 CET	51321	40092	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:23.530354977 CET	40092	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:23.535202980 CET	51321	40092	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:24.509696007 CET	51321	40092	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:24.509828091 CET	40092	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:24.514714956 CET	51321	40092	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:25.510850906 CET	40094	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:25.515852928 CET	51321	40094	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:25.515913010 CET	40094	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:25.516370058 CET	40094	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:25.521311045 CET	51321	40094	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:25.521351099 CET	40094	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:25.526227951 CET	51321	40094	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:26.518520117 CET	51321	40094	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:26.518709898 CET	40094	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:26.523549080 CET	51321	40094	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:27.519740105 CET	40096	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:27.526042938 CET	51321	40096	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:27.526205063 CET	40096	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:27.526926041 CET	40096	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:27.532450914 CET	51321	40096	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:27.532526016 CET	40096	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:27.537364006 CET	51321	40096	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:28.526109934 CET	51321	40096	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:28.526268005 CET	40096	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:28.531749010 CET	51321	40096	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:29.527852058 CET	40098	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:29.532826900 CET	51321	40098	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:29.532922983 CET	40098	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:29.533809900 CET	40098	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:29.538652897 CET	51321	40098	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:29.538729906 CET	40098	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:29.543787003 CET	51321	40098	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:30.512584925 CET	51321	40098	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:30.512876987 CET	40098	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:30.517884970 CET	51321	40098	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:31.514044046 CET	40100	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:31.519377947 CET	51321	40100	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:31.519463062 CET	40100	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:31.519921064 CET	40100	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:31.524672985 CET	51321	40100	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:31.524729967 CET	40100	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:31.529743910 CET	51321	40100	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:32.511866093 CET	51321	40100	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:32.512047052 CET	40100	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:32.516880989 CET	51321	40100	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:33.513494015 CET	40102	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:33.636276007 CET	51321	40102	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:33.636380911 CET	40102	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:33.637375116 CET	40102	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:33.642307043 CET	51321	40102	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:33.642368078 CET	40102	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:33.649034023 CET	51321	40102	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:34.639719963 CET	51321	40102	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:34.639987946 CET	40102	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:34.644809961 CET	51321	40102	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:35.641033888 CET	40104	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:35.646100044 CET	51321	40104	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:35.646173000 CET	40104	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:35.646925926 CET	40104	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:35.652192116 CET	51321	40104	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:35.652240038 CET	40104	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:35.657692909 CET	51321	40104	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:36.634382010 CET	51321	40104	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:36.634484053 CET	40104	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:36.639384031 CET	51321	40104	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:37.635516882 CET	40106	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:37.640587091 CET	51321	40106	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:37.640646935 CET	40106	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:37.641892910 CET	40106	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:37.646795988 CET	51321	40106	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:37.646843910 CET	40106	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:37.651617050 CET	51321	40106	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:38.614249945 CET	51321	40106	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:38.614371061 CET	40106	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:38.619182110 CET	51321	40106	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:39.615628958 CET	40108	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:39.620646000 CET	51321	40108	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:39.620717049 CET	40108	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:39.621223927 CET	40108	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:39.625961065 CET	51321	40108	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:39.626008987 CET	40108	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:39.630822897 CET	51321	40108	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:40.614185095 CET	51321	40108	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:40.614317894 CET	40108	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:40.619138002 CET	51321	40108	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:41.615580082 CET	40110	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:41.620492935 CET	51321	40110	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:41.620573997 CET	40110	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:41.621484995 CET	40110	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:41.626229048 CET	51321	40110	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:41.626322985 CET	40110	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:41.631119967 CET	51321	40110	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:42.611474037 CET	51321	40110	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:42.611586094 CET	40110	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:42.616415977 CET	51321	40110	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:43.612474918 CET	40112	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:43.617304087 CET	51321	40112	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:43.617357969 CET	40112	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:43.617863894 CET	40112	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:43.622652054 CET	51321	40112	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:43.622698069 CET	40112	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:43.627526045 CET	51321	40112	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:44.650394917 CET	51321	40112	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:44.650540113 CET	40112	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:44.655436993 CET	51321	40112	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:45.652265072 CET	40114	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:45.657248974 CET	51321	40114	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:45.657366037 CET	40114	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:45.658266068 CET	40114	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:45.663007975 CET	51321	40114	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:45.663065910 CET	40114	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:45.667932034 CET	51321	40114	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:46.666695118 CET	51321	40114	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:46.666857004 CET	40114	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:46.672355890 CET	51321	40114	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:47.668564081 CET	40116	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:47.673583984 CET	51321	40116	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:47.673664093 CET	40116	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:47.674561977 CET	40116	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:47.679418087 CET	51321	40116	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:47.679480076 CET	40116	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:47.684307098 CET	51321	40116	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:48.653995991 CET	51321	40116	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:48.654195070 CET	40116	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:48.659025908 CET	51321	40116	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:49.655847073 CET	40118	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:49.660723925 CET	51321	40118	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:49.660825014 CET	40118	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:49.661721945 CET	40118	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:49.666469097 CET	51321	40118	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:49.666559935 CET	40118	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:49.671431065 CET	51321	40118	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:50.642380953 CET	51321	40118	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:50.642472982 CET	40118	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:50.648214102 CET	51321	40118	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:51.643887043 CET	40120	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:51.648794889 CET	51321	40120	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:51.648852110 CET	40120	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:51.649444103 CET	40120	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:51.654284954 CET	51321	40120	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:51.654360056 CET	40120	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:51.659190893 CET	51321	40120	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:52.666973114 CET	51321	40120	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:52.667073965 CET	40120	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:52.671886921 CET	51321	40120	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:53.668483019 CET	40122	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:53.673388004 CET	51321	40122	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:53.673511982 CET	40122	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:53.674066067 CET	40122	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:53.678805113 CET	51321	40122	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:53.678894997 CET	40122	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:53.683710098 CET	51321	40122	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:54.678873062 CET	51321	40122	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:54.678994894 CET	40122	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:54.683815002 CET	51321	40122	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:55.680146933 CET	40124	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:55.685118914 CET	51321	40124	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:55.685187101 CET	40124	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:55.686058044 CET	40124	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:55.690886974 CET	51321	40124	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:55.690932989 CET	40124	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:55.695830107 CET	51321	40124	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:56.682202101 CET	51321	40124	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:56.682337046 CET	40124	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:56.687165022 CET	51321	40124	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:57.683955908 CET	40126	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:57.688966990 CET	51321	40126	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:57.689080954 CET	40126	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:57.689975023 CET	40126	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:57.694820881 CET	51321	40126	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:57.694899082 CET	40126	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:57.699743986 CET	51321	40126	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:58.669989109 CET	51321	40126	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:58.670161009 CET	40126	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:58.675030947 CET	51321	40126	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:59.671216965 CET	40128	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:59.676552057 CET	51321	40128	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:59.676645994 CET	40128	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:59.677179098 CET	40128	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:59.681962967 CET	51321	40128	154.213.187.125	192.168.2.14
Nov 13, 2024 01:21:59.682024002 CET	40128	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:21:59.686850071 CET	51321	40128	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:00.658303022 CET	51321	40128	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:00.658417940 CET	40128	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:00.663288116 CET	51321	40128	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:01.659219980 CET	40130	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:01.664197922 CET	51321	40130	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:01.664253950 CET	40130	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:01.664865971 CET	40130	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:01.669650078 CET	51321	40130	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:01.669694901 CET	40130	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:01.674494028 CET	51321	40130	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:02.659748077 CET	51321	40130	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:02.659874916 CET	40130	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:02.664678097 CET	51321	40130	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:03.661097050 CET	40132	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:03.666152954 CET	51321	40132	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:03.666265011 CET	40132	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:03.667476892 CET	40132	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:03.672239065 CET	51321	40132	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:03.672305107 CET	40132	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:03.677074909 CET	51321	40132	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:04.680641890 CET	51321	40132	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:04.680984020 CET	40132	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:04.685838938 CET	51321	40132	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:05.683142900 CET	40134	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:05.688112974 CET	51321	40134	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:05.688211918 CET	40134	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:05.689321041 CET	40134	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:05.694145918 CET	51321	40134	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:05.694281101 CET	40134	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:05.699062109 CET	51321	40134	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:06.697628021 CET	51321	40134	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:06.697830915 CET	40134	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:06.702672958 CET	51321	40134	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:07.699913025 CET	40136	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:07.704801083 CET	51321	40136	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:07.704890013 CET	40136	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:07.705966949 CET	40136	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:07.710731030 CET	51321	40136	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:07.710791111 CET	40136	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:07.715662956 CET	51321	40136	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:08.684776068 CET	51321	40136	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:08.684999943 CET	40136	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:08.685071945 CET	40136	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:08.690268993 CET	51321	40136	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:09.687273026 CET	40138	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:09.692152977 CET	51321	40138	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:09.692245007 CET	40138	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:09.693373919 CET	40138	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:09.698141098 CET	51321	40138	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:09.698205948 CET	40138	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:09.702992916 CET	51321	40138	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:10.679372072 CET	51321	40138	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:10.679541111 CET	40138	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:10.684505939 CET	51321	40138	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:11.681543112 CET	40140	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:11.686424017 CET	51321	40140	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:11.686503887 CET	40140	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:11.687592030 CET	40140	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:11.692374945 CET	51321	40140	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:11.692441940 CET	40140	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:11.697381973 CET	51321	40140	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:12.675893068 CET	51321	40140	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:12.676032066 CET	40140	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:12.681240082 CET	51321	40140	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:13.677664042 CET	40142	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:13.682632923 CET	51321	40142	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:13.682723045 CET	40142	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:13.683551073 CET	40142	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:13.688344002 CET	51321	40142	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:13.688409090 CET	40142	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:13.693383932 CET	51321	40142	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:14.692998886 CET	51321	40142	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:14.693151951 CET	40142	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:14.698602915 CET	51321	40142	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:15.694977045 CET	40144	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:15.700048923 CET	51321	40144	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:15.700144053 CET	40144	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:15.700968027 CET	40144	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:15.705774069 CET	51321	40144	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:15.705837965 CET	40144	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:15.710717916 CET	51321	40144	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:16.710192919 CET	51321	40144	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:16.710494041 CET	40144	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:16.715293884 CET	51321	40144	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:17.712409973 CET	40146	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:17.717432976 CET	51321	40146	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:17.717523098 CET	40146	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:17.718554974 CET	40146	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:17.723404884 CET	51321	40146	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:17.723469973 CET	40146	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:17.728240967 CET	51321	40146	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:18.703459978 CET	51321	40146	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:18.703665018 CET	40146	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:18.708434105 CET	51321	40146	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:19.705699921 CET	40148	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:19.710787058 CET	51321	40148	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:19.710870981 CET	40148	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:19.711811066 CET	40148	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:19.716578960 CET	51321	40148	154.213.187.125	192.168.2.14
Nov 13, 2024 01:22:19.716644049 CET	40148	51321	192.168.2.14	154.213.187.125
Nov 13, 2024 01:22:19.721478939 CET	51321	40148	154.213.187.125	192.168.2.14

System Behavior

Analysis Process: gmips.elf PID: 5511, Parent PID: 5430

General

Start time (UTC):	00:20:15
Start date (UTC):	13/11/2024
Path:	/tmp/gmips.elf
Arguments:	/tmp/gmips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: gmips.elf PID: 5513, Parent PID: 5511

General

Start time (UTC):	00:20:15
Start date (UTC):	13/11/2024
Path:	/tmp/gmips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: gmips.elf PID: 5517, Parent PID: 5513

General

Start time (UTC):	00:20:15
Start date (UTC):	13/11/2024
Path:	/tmp/gmips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gmips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.F4gFHn (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: gmips.elf PID: 5511, Parent PID: 5430

General

Chronological Activities

Analysis Process: gmips.elf PID: 5513, Parent PID: 5511

General

Chronological Activities

Analysis Process: gmips.elf PID: 5517, Parent PID: 5513

General

Chronological Activities

Linux Analysis Report
gmips.elf