Edit tour

Linux Analysis Report
Fantazy.spc.elf

Overview

General Information

Sample name:	Fantazy.spc.elf
Analysis ID:	1571870
MD5:	906d984aeca0b7257a613c6ac04226b2
SHA1:	30375fe282b15ee8240d90e4adcc97f3706f1671
SHA256:	9fa8d568e4a1cf4d2825aea5a23344cdc745c2c170617a8afca3862468ef050f
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571870
Start date and time:	2024-12-09 19:34:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.spc.elf
Detection:	MAL
Classification:	mal64.spre.troj.linELF@0/3@0/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
VT rate limit hit for: Fantazy.spc.elf

Runtime Messages

Command:	/tmp/Fantazy.spc.elf
PID:	6217
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.spc.elf (PID: 6217, Parent: 6134, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/Fantazy.spc.elf

Fantazy.spc.elf New Fork (PID: 6219, Parent: 6217)

Fantazy.spc.elf New Fork (PID: 6221, Parent: 6217)

Fantazy.spc.elf New Fork (PID: 6223, Parent: 6221)

Fantazy.spc.elf New Fork (PID: 6225, Parent: 6221)

Fantazy.spc.elf New Fork (PID: 6226, Parent: 6221)

systemd New Fork (PID: 6232, Parent: 1)

journalctl (PID: 6232, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6247, Parent: 1)

dbus-daemon (PID: 6247, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6263, Parent: 1320)

Default (PID: 6263, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6266, Parent: 1320)

Default (PID: 6266, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6267, Parent: 1)

rsyslogd (PID: 6267, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6268, Parent: 1320)

Default (PID: 6268, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6269, Parent: 1860)

pulseaudio (PID: 6269, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6270, Parent: 1)

systemd-journald (PID: 6270, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

gvfsd-fuse New Fork (PID: 6271, Parent: 2038)

fusermount (PID: 6271, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6281, Parent: 1)

dbus-daemon (PID: 6281, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6282, Parent: 1)

systemd-journald (PID: 6282, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6283, Parent: 1)

dbus-daemon (PID: 6283, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6284, Parent: 1)

rsyslogd (PID: 6284, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6286, Parent: 1)

systemd-journald (PID: 6286, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6287, Parent: 1)

dbus-daemon (PID: 6287, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6288, Parent: 1)

systemd-journald (PID: 6288, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6289, Parent: 1)

dbus-daemon (PID: 6289, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6290, Parent: 1)

systemd-journald (PID: 6290, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6291, Parent: 1)

rsyslogd (PID: 6291, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6294, Parent: 1)

rsyslogd (PID: 6294, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6296, Parent: 1)

rsyslogd (PID: 6296, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Fantazy.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Fantazy.spc.elf

ReversingLabs: Detection: 65%

Source: global traffic	TCP traffic: 192.168.2.23:37024 -> 154.213.187.84:63645
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 20.66.105.87:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 78.205.28.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 182.118.50.175:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 19.116.252.121:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 58.234.119.137:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 145.103.127.174:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 8.45.106.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 196.214.47.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 173.113.41.17:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 92.46.93.45:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 69.184.158.120:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 70.4.61.117:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 27.18.143.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 124.178.47.103:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 59.235.0.86:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 13.231.125.151:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 9.255.100.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 154.138.91.144:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 48.90.201.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 87.151.42.65:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 66.70.82.3:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 12.80.201.35:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 109.228.166.130:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 68.48.25.249:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 212.221.224.89:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 46.242.223.207:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 184.42.70.11:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 206.209.191.238:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 212.249.223.61:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 203.141.64.57:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 102.149.212.7:2323
Source: global traffic	TCP traffic: 192.168.2.23:64541 -> 124.216.211.60:2323

Source: /usr/sbin/rsyslogd (PID: 6267)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.spc.elf (PID: 6217)

Socket: 127.0.0.1:59025

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.66.105.87
Source: unknown	TCP traffic detected without corresponding DNS query: 73.222.183.87
Source: unknown	TCP traffic detected without corresponding DNS query: 19.103.46.195
Source: unknown	TCP traffic detected without corresponding DNS query: 204.25.78.80
Source: unknown	TCP traffic detected without corresponding DNS query: 39.22.212.18
Source: unknown	TCP traffic detected without corresponding DNS query: 95.16.242.228
Source: unknown	TCP traffic detected without corresponding DNS query: 68.83.231.152
Source: unknown	TCP traffic detected without corresponding DNS query: 180.21.18.105
Source: unknown	TCP traffic detected without corresponding DNS query: 154.198.11.19
Source: unknown	TCP traffic detected without corresponding DNS query: 89.61.7.111
Source: unknown	TCP traffic detected without corresponding DNS query: 65.180.154.76
Source: unknown	TCP traffic detected without corresponding DNS query: 78.205.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 4.23.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 98.83.119.159
Source: unknown	TCP traffic detected without corresponding DNS query: 153.175.126.119
Source: unknown	TCP traffic detected without corresponding DNS query: 139.247.200.110
Source: unknown	TCP traffic detected without corresponding DNS query: 187.228.170.58
Source: unknown	TCP traffic detected without corresponding DNS query: 195.202.245.104
Source: unknown	TCP traffic detected without corresponding DNS query: 182.118.50.175
Source: unknown	TCP traffic detected without corresponding DNS query: 196.129.49.215
Source: unknown	TCP traffic detected without corresponding DNS query: 38.131.240.66
Source: unknown	TCP traffic detected without corresponding DNS query: 43.101.172.106
Source: unknown	TCP traffic detected without corresponding DNS query: 94.56.137.30
Source: unknown	TCP traffic detected without corresponding DNS query: 154.128.174.2
Source: unknown	TCP traffic detected without corresponding DNS query: 116.195.188.93
Source: unknown	TCP traffic detected without corresponding DNS query: 83.146.154.36
Source: unknown	TCP traffic detected without corresponding DNS query: 200.78.173.188
Source: unknown	TCP traffic detected without corresponding DNS query: 19.116.252.121
Source: unknown	TCP traffic detected without corresponding DNS query: 39.177.103.207
Source: unknown	TCP traffic detected without corresponding DNS query: 87.192.53.232
Source: unknown	TCP traffic detected without corresponding DNS query: 99.138.133.3
Source: unknown	TCP traffic detected without corresponding DNS query: 125.96.58.126
Source: unknown	TCP traffic detected without corresponding DNS query: 65.39.141.218
Source: unknown	TCP traffic detected without corresponding DNS query: 95.126.50.38
Source: unknown	TCP traffic detected without corresponding DNS query: 200.107.35.173
Source: unknown	TCP traffic detected without corresponding DNS query: 175.217.66.7
Source: unknown	TCP traffic detected without corresponding DNS query: 58.234.119.137
Source: unknown	TCP traffic detected without corresponding DNS query: 118.185.49.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.0.36.35
Source: unknown	TCP traffic detected without corresponding DNS query: 71.215.251.98
Source: unknown	TCP traffic detected without corresponding DNS query: 92.234.254.130
Source: unknown	TCP traffic detected without corresponding DNS query: 222.164.50.205
Source: unknown	TCP traffic detected without corresponding DNS query: 111.221.195.38
Source: unknown	TCP traffic detected without corresponding DNS query: 191.143.226.109
Source: unknown	TCP traffic detected without corresponding DNS query: 169.33.158.164
Source: unknown	TCP traffic detected without corresponding DNS query: 38.128.146.158
Source: unknown	TCP traffic detected without corresponding DNS query: 145.103.127.174
Source: unknown	TCP traffic detected without corresponding DNS query: 145.54.188.209
Source: unknown	TCP traffic detected without corresponding DNS query: 153.15.215.57

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 4499, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6194, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6267, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6270, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6287, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6288, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6292, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6296, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6297, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 4499, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6194, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6267, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6270, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6287, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6288, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6292, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6296, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6297, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior

Source: classification engine

Classification label: mal64.spre.troj.linELF@0/3@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6247)	File: /proc/6247/mounts			Jump to behavior
Source: /bin/fusermount (PID: 6271)	File: /proc/6271/mounts			Jump to behavior

Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6230/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6231/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2033/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6195/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6194/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1612/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/4444/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/4445/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6226/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/517/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/759/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6247/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2285/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2281/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/761/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/884/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1983/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2038/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1860/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/4471/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/3021/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2294/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/772/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/774/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/896/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1872/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2048/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2289/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/4466/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/4469/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2208/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2180/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6262/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6267/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6269/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1494/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1886/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/420/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1489/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/788/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/667/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/4479/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6158/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6270/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/670/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6271/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2746/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1532/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/797/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/677/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/799/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/2749/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6285/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6284/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6287/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6286/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6047/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6289/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6167/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6288/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6281/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6283/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/6282/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/1389/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/720/maps	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6225)	File opened: /proc/721/maps	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6267)

Log file created: /var/log/kern.log

Jump to dropped file

Source: /tmp/Fantazy.spc.elf (PID: 6217)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6267)	Queries kernel information via 'uname':			Jump to behavior

Source: Fantazy.spc.elf, 6217.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6219.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6221.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6223.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6226.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: Fantazy.spc.elf, 6217.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6219.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6221.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6223.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp, Fantazy.spc.elf, 6226.1.0000558a84c8f000.0000558a84cf4000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: syslog.29.dr	Binary or memory string: Dec 9 12:35:24 galassia kernel: [ 407.934394] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: Fantazy.spc.elf, 6217.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6219.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6221.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6223.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6226.1.00007fff45dff000.00007fff45e20000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/Fantazy.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.spc.elf
Source: syslog.29.dr	Binary or memory string: Dec 9 12:35:24 galassia kernel: [ 407.934373] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.spc.elf, 6217.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6219.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6221.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6223.1.00007fff45dff000.00007fff45e20000.rw-.sdmp, Fantazy.spc.elf, 6226.1.00007fff45dff000.00007fff45e20000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.spc.elf	66%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.spc.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
4.23.131.254	unknown	United States	3356	LEVEL3US	false
48.44.222.65	unknown	United States	2686	ATGS-MMD-ASUS	false
43.101.172.106	unknown	Japan	4249	LILLY-ASUS	false
217.38.129.91	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
222.164.50.205	unknown	Singapore	55430	STARHUB-NGNBNStarhubLtdSG	false
196.214.47.138	unknown	South Africa	3741	ISZA	false
167.41.153.75	unknown	Canada	2665	CDAGOVNCA	false
91.131.88.234	unknown	Austria	1257	TELE2EU	false
177.210.145.211	unknown	Brazil	7738	TelemarNorteLesteSABR	false
156.66.220.49	unknown	United States	29975	VODACOM-ZA	false
154.198.11.19	unknown	Seychelles	21859	ZNETUS	false
106.116.174.115	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
203.146.104.8	unknown	Thailand	134682	KGIS-AS-APKGISecuritiesThailandPublicCompanyLimited	false
1.111.252.60	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
157.127.50.26	unknown	United States	1906	NORTHROP-GRUMMANUS	false
152.139.160.19	unknown	Chile	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
40.149.195.162	unknown	United States	4249	LILLY-ASUS	false
32.126.81.136	unknown	United States	7018	ATT-INTERNET4US	false
165.157.24.38	unknown	United States	54996	SCRIPPSHEALTHUS	false
187.44.30.154	unknown	Brazil	28202	RedeBrasileiradeComunicacaoLtdaBR	false
42.222.102.107	unknown	China	4249	LILLY-ASUS	false
223.85.223.103	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
167.100.205.72	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
58.152.165.116	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
162.169.62.173	unknown	United States	21928	T-MOBILE-AS21928US	false
192.173.64.2	unknown	United States	2906	AS-SSIUS	false
109.6.175.3	unknown	France	15557	LDCOMNETFR	false
87.151.42.65	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
64.64.48.194	unknown	United States	2386	INS-ASUS	false
212.249.223.61	unknown	Switzerland	702	UUNETUS	false
210.4.145.225	unknown	Thailand	4618	INET-TH-ASInternetThailandCompanyLimitedTH	false
124.178.47.103	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
192.18.135.200	unknown	United States	43894	ORCL-LON-OPC1GB	false
169.241.104.28	unknown	United States	22164	CCSDUS	false
139.20.129.201	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
161.169.6.193	unknown	United States	10695	WAL-MARTUS	false
124.55.188.231	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
104.161.199.178	unknown	United States	14340	SALESFORCEUS	false
65.54.143.128	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
116.195.188.93	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
173.113.41.17	unknown	United States	10507	SPCSUS	false
208.132.206.147	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
8.6.88.106	unknown	United States	11734	CONNECTRIA-ASN-1US	false
13.39.200.167	unknown	United States	7018	ATT-INTERNET4US	false
101.140.120.10	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
122.32.108.133	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
200.107.35.173	unknown	Ecuador	28006	CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC	false
165.228.136.104	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
124.216.211.60	unknown	Korea Republic of	45361	JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR	false
19.200.206.165	unknown	United States	3	MIT-GATEWAYSUS	false
181.228.58.61	unknown	Argentina	10481	TelecomArgentinaSAAR	false
79.101.136.94	unknown	Serbia	8400	TELEKOM-ASRS	false
223.231.243.150	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
189.148.172.1	unknown	Mexico	8151	UninetSAdeCVMX	false
5.36.128.118	unknown	Oman	28885	OMANTEL-NAP-ASOmanTelNAPOM	false
61.9.17.7	unknown	Philippines	17970	SKYBB-AS-APSKYBroadbandSKYCableCorporationPH	false
58.239.83.46	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
4.103.247.153	unknown	United States	3356	LEVEL3US	false
157.56.30.89	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
102.201.206.134	unknown	unknown	36926	CKL1-ASNKE	false
14.235.164.136	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
169.29.136.255	unknown	United States	37611	AfrihostZA	false
71.215.251.98	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
104.34.56.74	unknown	United States	20001	TWC-20001-PACWESTUS	false
102.157.66.84	unknown	Tunisia	37705	TOPNETTN	false
191.184.180.48	unknown	Brazil	28573	CLAROSABR	false
88.139.68.137	unknown	France	8228	CEGETEL-ASFR	false
209.95.167.25	unknown	United States	204472	ROYALEASNDE	false
73.222.183.87	unknown	United States	7922	COMCAST-7922US	false
141.130.155.122	unknown	Germany	41700	FESTO-ASDE	false
161.181.234.192	unknown	United States	46564	NORDST-ASUS	false
91.108.154.177	unknown	Iran (ISLAMIC Republic Of)	58256	REFATECIR	false
166.35.180.220	unknown	United States	3372	MCI-ASNUS	false
89.130.132.186	unknown	Spain	12479	UNI2-ASES	false
136.39.107.158	unknown	United States	16591	GOOGLE-FIBERUS	false
13.0.36.35	unknown	United States	7018	ATT-INTERNET4US	false
105.105.221.110	unknown	Algeria	36947	ALGTEL-ASDZ	false
183.181.45.176	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
86.254.140.248	unknown	France	3215	FranceTelecom-OrangeFR	false
102.101.32.241	unknown	Morocco	36925	ASMediMA	false
150.183.89.196	unknown	Korea Republic of	1237	KREONET-AS-KRKISTIKR	false
141.77.30.38	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
168.141.78.184	unknown	United States	53585	NYSIFUS	false
186.70.227.219	unknown	Ecuador	14522	SatnetEC	false
148.250.57.156	unknown	Mexico	6503	AxtelSABdeCVMX	false
13.231.125.151	unknown	United States	16509	AMAZON-02US	false
87.192.53.232	unknown	Ireland	25441	IBIS-ASImagineGroupLtdIE	false
84.69.114.231	unknown	United Kingdom	5378	VodafoneGB	false
4.150.186.37	unknown	United States	3356	LEVEL3US	false
149.89.166.1	unknown	United States	12271	TWC-12271-NYCUS	false
102.149.212.7	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
75.234.142.252	unknown	United States	22394	CELLCOUS	false
178.180.37.114	unknown	Poland	12912	TMPL	false
145.103.127.174	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
115.103.41.212	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
185.125.159.57	unknown	Lebanon	9051	Beirut-LebanonLB	false
75.87.159.199	unknown	United States	11427	TWC-11427-TEXASUS	false
35.188.132.223	unknown	United States	15169	GOOGLEUS	false
204.102.107.225	unknown	United States	2152	CSUNET-NWUS	false
219.41.207.201	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	32.88.158.245
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	57.38.201.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	https://www.aarp.org/money/scams-fraud/info-2024/title-theft-real-estate-fraud.html	Get hash	malicious	HTMLPhisher	Browse	34.149.43.113
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
LEVEL3US	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	9.28.102.83
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	4.185.159.165
	sh4.elf	Get hash	malicious	Unknown	Browse	6.128.197.184
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	4.120.202.211
	jew.arm.elf	Get hash	malicious	Unknown	Browse	4.186.254.56
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	4.121.109.37
	EgnyteDesktopApp_3.19.0_148.msi	Get hash	malicious	Unknown	Browse	4.155.164.36
	Private.txt.scr.exe	Get hash	malicious	Unknown	Browse	63.37.243.8
	MDiqmMXRKA.exe	Get hash	malicious	Unknown	Browse	195.122.177.135
	MDiqmMXRKA.exe	Get hash	malicious	Unknown	Browse	195.122.177.135
LILLY-ASUS	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	43.217.161.144
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	43.213.216.80
	sh4.elf	Get hash	malicious	Unknown	Browse	40.157.239.131
	jew.arm.elf	Get hash	malicious	Unknown	Browse	43.215.45.209
	https://jdjdhjh.uscourtdocuments.com/A3RjQ	Get hash	malicious	HTMLPhisher	Browse	43.152.64.207
	Private.txt.scr.exe	Get hash	malicious	Unknown	Browse	40.218.10.39
	Owari.sh4.elf	Get hash	malicious	Unknown	Browse	43.41.137.199
	Owari.arm.elf	Get hash	malicious	Unknown	Browse	43.54.201.119
	Owari.m68k.elf	Get hash	malicious	Unknown	Browse	40.0.146.15
	Owari.mpsl.elf	Get hash	malicious	Unknown	Browse	43.213.204.82
BT-UK-ASBTnetUKRegionalnetworkGB	sh4.elf	Get hash	malicious	Unknown	Browse	31.55.224.127
	Owari.arm.elf	Get hash	malicious	Unknown	Browse	86.163.204.24
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	213.121.90.103
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	81.156.71.249
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	81.128.71.32
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	86.176.97.116
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	86.155.66.62
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	86.171.205.187
	i686.elf	Get hash	malicious	Unknown	Browse	109.157.20.55
	mips.elf	Get hash	malicious	Unknown	Browse	81.133.45.15

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.pRGNKV (deleted)

Download File

Process:	/tmp/Fantazy.spc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	312
Entropy (8bit):	3.573018369713392
Encrypted:	false
SSDEEP:	6:M0caFF6EEcsl10Y/VUS/FYcaFF6EEcsq0/VBVWPj/VfKoO/VNfiY/VH:MRanIluS/FFanIR/l
MD5:	F384217A371CD303AF5CF97DD1892871
SHA1:	477B567DF90A1C2A0023543A1CF8F6A75536FA12
SHA-256:	AECBDF5C6E3E875AEFC017AFEA3EBF3C8FA7A4988C175057B442B22C7A80FE5B
SHA-512:	22DFC98AC175F681FBA89DACCFB91DF2D7BC175B711566B1D09D21F6BEC4A4E6BF0B2CFFC5034613BE6FD4A2881BA7FBF01A8F8D3A99606C41F08A1B5662712C
Malicious:	false
Reputation:	low
Preview:	10000-24000 r-xp 00000000 fd:00 531563 /tmp/Fantazy.spc.elf.33000-34000 rw-p 00013000 fd:00 531563 /tmp/Fantazy.spc.elf.34000-35000 rw-p 00000000 00:00 0 .35000-37000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	5512
Entropy (8bit):	5.023659859672982
Encrypted:	false
SSDEEP:	48:wtEr8dgBNMnNhFWCLlElcSvE9sNduSSTKTD8CyTWBor8NEWCo8exzSJ/zy0i3rDr:GF5KsWOr8MYaYbHGQ8krRUGoeFsE
MD5:	D8BC7A062FE53F9A401A877F89CAD925
SHA1:	A252DA2717B2728E7880FAB92748F16E651459A1
SHA-256:	9266127507A31BF6B05F776C20485C7C1F6277D0D9EAAE3E792CEBBA3309F432
SHA-512:	7557E6DCC4697560B61CEE13CE1CC0514C9423E851AD3B08CFB367A932A29E31554F66F800693ECE7C961276393FFEF6FEF48BAEF8F6496102399F4E285CC882
Malicious:	false
Reputation:	low
Preview:	Dec 9 12:35:23 galassia kernel: [ 406.409457] blocking signal 9: 6225 -> 797.Dec 9 12:35:23 galassia kernel: [ 406.468948] blocking signal 9: 6225 -> 936.Dec 9 12:35:23 galassia kernel: [ 406.492078] blocking signal 9: 6225 -> 1320.Dec 9 12:35:23 galassia kernel: [ 406.507041] blocking signal 9: 6225 -> 1334.Dec 9 12:35:23 galassia kernel: [ 406.529520] blocking signal 9: 6225 -> 1335.Dec 9 12:35:23 galassia kernel: [ 406.711081] blocking signal 9: 6225 -> 1601.Dec 9 12:35:23 galassia kernel: [ 406.769246] blocking signal 9: 6225 -> 1860.Dec 9 12:35:23 galassia kernel: [ 406.839091] blocking signal 9: 6225 -> 1872.Dec 9 12:35:23 galassia kernel: [ 406.900910] blocking signal 9: 6225 -> 1983.Dec 9 12:35:23 galassia kernel: [ 406.996138] blocking signal 9: 6225 -> 2048.Dec 9 12:35:23 galassia kernel: [ 407.580868] New task spawned: old: (tgid 6267, tid 6267), new (tgid: 6267, tid: 6277).Dec 9 12:35:23 galassia kernel: [ 407.584264] New task spawned: old: (tgid 626

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	7963
Entropy (8bit):	5.100064032173181
Encrypted:	false
SSDEEP:	96:TYzkRnF71sWOr8MYaYbHGQ8krRUGoeFs1v:akGr8Mu8kr3sF
MD5:	ECA7F08375CC00497ADE5D480D54D00F
SHA1:	C2FF0E32183B286D21514D8D4401E0A35B389E94
SHA-256:	6D2425F8D4AF63EE4FDCDADFC7065FD0AAB95871B650DD84C7FBDADF23A2FADF
SHA-512:	89BF1DFE7C4227A6E7C2AF98C51E7C9D638453A6F8AB8CE1E3068BC7C84D643B7CAD1598830E5C542F4D741757FF6B37448997DE44423112B1F478622A598737
Malicious:	false
Reputation:	low
Preview:	Dec 9 12:35:23 galassia kernel: [ 406.384487] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 9 12:35:23 galassia kernel: [ 406.384557] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 9 12:35:23 galassia kernel: [ 406.409457] blocking signal 9: 6225 -> 797.Dec 9 12:35:23 galassia kernel: [ 406.413130] systemd[1]: session-c2.scope: Succeeded..Dec 9 12:35:23 galassia kernel: [ 406.468948] blocking signal 9: 6225 -> 936.Dec 9 12:35:23 galassia kernel: [ 406.492078] blocking signal 9: 6225 -> 1320.Dec 9 12:35:23 galassia kernel: [ 406.507041] blocking signal 9: 6225 -> 1334.Dec 9 12:35:23 galassia kernel: [ 406.529520] blocking signal 9: 6225 -> 1335.Dec 9 12:35:23 galassia kernel: [ 406.552160] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Dec 9 12:35:23 galassia kernel: [ 406.552174] systemd[1]: Stopped System Logging Service..Dec 9 12:35:23 galassia kernel: [ 406.553190] systemd[1]: Start

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.129746389422974
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.spc.elf
File size:	79'640 bytes
MD5:	906d984aeca0b7257a613c6ac04226b2
SHA1:	30375fe282b15ee8240d90e4adcc97f3706f1671
SHA256:	9fa8d568e4a1cf4d2825aea5a23344cdc745c2c170617a8afca3862468ef050f
SHA512:	2417f0a1e9879f9d73e509345140672f2817880adca59440969ac4ac85ae7ad58fbef69f136741413ff45d7714c38e777b7c24842cd551c176a171fcbf55b28f
SSDEEP:	1536:h1y6qxSKpqPOp0PyWhghmzctw6miyTAVFzvRwE:i6qImaLvcibUvRwE
TLSH:	0D732814ED7D2E2BC0E8A13E12F7C716F2E5360E14B0862D7D390F8EFB54690A5466B6
File Content Preview:	.ELF...........................4..5......4. ...(......................3...3...............3...3...3....4............dt.Q................................@..(....@.G.................#.....aH..`.....!.....#,..@.....".........`......$#,..#,..@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	79240
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x11e78	0x0	0x6	AX	4
.fini	PROGBITS	0x21f28	0x11f28	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x21f40	0x11f40	0x13d0	0x0	0x2	A	8
.ctors	PROGBITS	0x33314	0x13314	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x3331c	0x1331c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x33328	0x13328	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x33548	0x13548	0x558	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x13548	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x13310	0x13310	6.1494	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x13314	0x33314	0x33314	0x234	0x78c	2.9269	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 19:35:23.108921051 CET	37024	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:23.121753931 CET	64541	2323	192.168.2.23	20.66.105.87
Dec 9, 2024 19:35:23.121867895 CET	64541	23	192.168.2.23	73.222.183.87
Dec 9, 2024 19:35:23.121875048 CET	64541	23	192.168.2.23	19.103.46.195
Dec 9, 2024 19:35:23.121954918 CET	64541	23	192.168.2.23	204.25.78.80
Dec 9, 2024 19:35:23.121961117 CET	64541	23	192.168.2.23	39.22.212.18
Dec 9, 2024 19:35:23.121961117 CET	64541	23	192.168.2.23	95.16.242.228
Dec 9, 2024 19:35:23.121962070 CET	64541	23	192.168.2.23	68.83.231.152
Dec 9, 2024 19:35:23.121962070 CET	64541	23	192.168.2.23	180.21.18.105
Dec 9, 2024 19:35:23.121969938 CET	64541	23	192.168.2.23	154.198.11.19
Dec 9, 2024 19:35:23.121973038 CET	64541	23	192.168.2.23	89.61.7.111
Dec 9, 2024 19:35:23.122054100 CET	64541	23	192.168.2.23	65.180.154.76
Dec 9, 2024 19:35:23.122055054 CET	64541	2323	192.168.2.23	78.205.28.15
Dec 9, 2024 19:35:23.122055054 CET	64541	23	192.168.2.23	4.23.131.254
Dec 9, 2024 19:35:23.122057915 CET	64541	23	192.168.2.23	177.210.145.211
Dec 9, 2024 19:35:23.122057915 CET	64541	23	192.168.2.23	98.83.119.159
Dec 9, 2024 19:35:23.122080088 CET	64541	23	192.168.2.23	153.175.126.119
Dec 9, 2024 19:35:23.122092009 CET	64541	23	192.168.2.23	139.247.200.110
Dec 9, 2024 19:35:23.122112989 CET	64541	23	192.168.2.23	187.228.170.58
Dec 9, 2024 19:35:23.122123003 CET	64541	23	192.168.2.23	20.38.10.173
Dec 9, 2024 19:35:23.122128010 CET	64541	23	192.168.2.23	195.202.245.104
Dec 9, 2024 19:35:23.122129917 CET	64541	2323	192.168.2.23	182.118.50.175
Dec 9, 2024 19:35:23.122201920 CET	64541	23	192.168.2.23	196.129.49.215
Dec 9, 2024 19:35:23.122214079 CET	64541	23	192.168.2.23	38.131.240.66
Dec 9, 2024 19:35:23.122227907 CET	64541	23	192.168.2.23	43.101.172.106
Dec 9, 2024 19:35:23.122227907 CET	64541	23	192.168.2.23	94.56.137.30
Dec 9, 2024 19:35:23.122227907 CET	64541	23	192.168.2.23	210.4.145.225
Dec 9, 2024 19:35:23.122240067 CET	64541	23	192.168.2.23	154.128.174.2
Dec 9, 2024 19:35:23.122241020 CET	64541	23	192.168.2.23	116.195.188.93
Dec 9, 2024 19:35:23.122263908 CET	64541	23	192.168.2.23	83.146.154.36
Dec 9, 2024 19:35:23.122266054 CET	64541	23	192.168.2.23	200.78.173.188
Dec 9, 2024 19:35:23.122268915 CET	64541	2323	192.168.2.23	19.116.252.121
Dec 9, 2024 19:35:23.122348070 CET	64541	23	192.168.2.23	39.177.103.207
Dec 9, 2024 19:35:23.122348070 CET	64541	23	192.168.2.23	87.192.53.232
Dec 9, 2024 19:35:23.122353077 CET	64541	23	192.168.2.23	99.138.133.3
Dec 9, 2024 19:35:23.122366905 CET	64541	23	192.168.2.23	125.96.58.126
Dec 9, 2024 19:35:23.122390985 CET	64541	23	192.168.2.23	65.39.141.218
Dec 9, 2024 19:35:23.122417927 CET	64541	23	192.168.2.23	95.126.50.38
Dec 9, 2024 19:35:23.122432947 CET	64541	23	192.168.2.23	200.107.35.173
Dec 9, 2024 19:35:23.122432947 CET	64541	23	192.168.2.23	175.217.66.7
Dec 9, 2024 19:35:23.122494936 CET	64541	2323	192.168.2.23	58.234.119.137
Dec 9, 2024 19:35:23.122499943 CET	64541	23	192.168.2.23	118.185.49.200
Dec 9, 2024 19:35:23.122500896 CET	64541	23	192.168.2.23	13.0.36.35
Dec 9, 2024 19:35:23.122500896 CET	64541	23	192.168.2.23	71.215.251.98
Dec 9, 2024 19:35:23.122503042 CET	64541	23	192.168.2.23	92.234.254.130
Dec 9, 2024 19:35:23.122559071 CET	64541	23	192.168.2.23	222.164.50.205
Dec 9, 2024 19:35:23.122560024 CET	64541	23	192.168.2.23	111.221.195.38
Dec 9, 2024 19:35:23.122559071 CET	64541	23	192.168.2.23	191.143.226.109
Dec 9, 2024 19:35:23.122560024 CET	64541	23	192.168.2.23	169.33.158.164
Dec 9, 2024 19:35:23.122559071 CET	64541	23	192.168.2.23	38.128.146.158
Dec 9, 2024 19:35:23.122560024 CET	64541	2323	192.168.2.23	145.103.127.174
Dec 9, 2024 19:35:23.122565985 CET	64541	23	192.168.2.23	145.54.188.209
Dec 9, 2024 19:35:23.122569084 CET	64541	23	192.168.2.23	153.15.215.57
Dec 9, 2024 19:35:23.122569084 CET	64541	23	192.168.2.23	85.113.140.119
Dec 9, 2024 19:35:23.122591972 CET	64541	23	192.168.2.23	24.245.117.151
Dec 9, 2024 19:35:23.122623920 CET	64541	23	192.168.2.23	76.230.6.101
Dec 9, 2024 19:35:23.122656107 CET	64541	23	192.168.2.23	213.245.123.203
Dec 9, 2024 19:35:23.122690916 CET	64541	23	192.168.2.23	155.138.129.141
Dec 9, 2024 19:35:23.122704983 CET	64541	23	192.168.2.23	75.87.159.199
Dec 9, 2024 19:35:23.122704983 CET	64541	23	192.168.2.23	166.136.15.226
Dec 9, 2024 19:35:23.122710943 CET	64541	23	192.168.2.23	14.63.167.70
Dec 9, 2024 19:35:23.122728109 CET	64541	2323	192.168.2.23	8.45.106.157
Dec 9, 2024 19:35:23.122792006 CET	64541	23	192.168.2.23	161.181.234.192
Dec 9, 2024 19:35:23.122800112 CET	64541	23	192.168.2.23	158.55.252.60
Dec 9, 2024 19:35:23.122836113 CET	64541	23	192.168.2.23	88.139.68.137
Dec 9, 2024 19:35:23.122838974 CET	64541	23	192.168.2.23	76.164.181.184
Dec 9, 2024 19:35:23.122843027 CET	64541	23	192.168.2.23	174.41.37.186
Dec 9, 2024 19:35:23.122884035 CET	64541	23	192.168.2.23	157.127.50.26
Dec 9, 2024 19:35:23.122894049 CET	64541	23	192.168.2.23	41.223.71.222
Dec 9, 2024 19:35:23.122939110 CET	64541	23	192.168.2.23	113.189.77.155
Dec 9, 2024 19:35:23.122939110 CET	64541	23	192.168.2.23	101.200.104.156
Dec 9, 2024 19:35:23.122941017 CET	64541	2323	192.168.2.23	196.214.47.138
Dec 9, 2024 19:35:23.122941971 CET	64541	23	192.168.2.23	221.84.17.238
Dec 9, 2024 19:35:23.122942924 CET	64541	23	192.168.2.23	97.224.100.55
Dec 9, 2024 19:35:23.122951031 CET	64541	23	192.168.2.23	65.54.143.128
Dec 9, 2024 19:35:23.122956991 CET	64541	23	192.168.2.23	202.223.35.117
Dec 9, 2024 19:35:23.122958899 CET	64541	23	192.168.2.23	204.140.119.56
Dec 9, 2024 19:35:23.122960091 CET	64541	23	192.168.2.23	187.44.30.154
Dec 9, 2024 19:35:23.122966051 CET	64541	23	192.168.2.23	166.35.180.220
Dec 9, 2024 19:35:23.122997999 CET	64541	2323	192.168.2.23	173.113.41.17
Dec 9, 2024 19:35:23.122999907 CET	64541	23	192.168.2.23	142.50.195.12
Dec 9, 2024 19:35:23.122999907 CET	64541	23	192.168.2.23	95.182.178.88
Dec 9, 2024 19:35:23.123002052 CET	64541	23	192.168.2.23	139.20.129.201
Dec 9, 2024 19:35:23.123053074 CET	64541	23	192.168.2.23	156.87.71.110
Dec 9, 2024 19:35:23.123085976 CET	64541	23	192.168.2.23	57.20.85.144
Dec 9, 2024 19:35:23.123087883 CET	64541	23	192.168.2.23	165.157.24.38
Dec 9, 2024 19:35:23.123092890 CET	64541	23	192.168.2.23	203.146.104.8
Dec 9, 2024 19:35:23.123105049 CET	64541	23	192.168.2.23	167.100.205.72
Dec 9, 2024 19:35:23.123106956 CET	64541	23	192.168.2.23	222.31.215.219
Dec 9, 2024 19:35:23.123120070 CET	64541	23	192.168.2.23	27.29.166.129
Dec 9, 2024 19:35:23.123162031 CET	64541	23	192.168.2.23	66.132.104.179
Dec 9, 2024 19:35:23.123204947 CET	64541	2323	192.168.2.23	92.46.93.45
Dec 9, 2024 19:35:23.123208046 CET	64541	23	192.168.2.23	41.111.208.94
Dec 9, 2024 19:35:23.123245001 CET	64541	23	192.168.2.23	152.139.160.19
Dec 9, 2024 19:35:23.123279095 CET	64541	23	192.168.2.23	163.75.199.57
Dec 9, 2024 19:35:23.123343945 CET	64541	23	192.168.2.23	81.188.107.154
Dec 9, 2024 19:35:23.123375893 CET	64541	23	192.168.2.23	40.149.195.162
Dec 9, 2024 19:35:23.123379946 CET	64541	23	192.168.2.23	195.71.193.63
Dec 9, 2024 19:35:23.123379946 CET	64541	2323	192.168.2.23	69.184.158.120
Dec 9, 2024 19:35:23.123380899 CET	64541	23	192.168.2.23	35.53.223.36
Dec 9, 2024 19:35:23.123389006 CET	64541	23	192.168.2.23	223.231.243.150
Dec 9, 2024 19:35:23.123389959 CET	64541	23	192.168.2.23	4.103.247.153
Dec 9, 2024 19:35:23.123389959 CET	64541	23	192.168.2.23	38.21.53.141
Dec 9, 2024 19:35:23.123408079 CET	64541	23	192.168.2.23	40.25.242.182
Dec 9, 2024 19:35:23.123416901 CET	64541	23	192.168.2.23	19.94.198.185
Dec 9, 2024 19:35:23.123467922 CET	64541	23	192.168.2.23	117.25.27.190
Dec 9, 2024 19:35:23.123467922 CET	64541	23	192.168.2.23	113.38.8.8
Dec 9, 2024 19:35:23.123487949 CET	64541	23	192.168.2.23	157.56.30.89
Dec 9, 2024 19:35:23.123492002 CET	64541	23	192.168.2.23	18.30.40.140
Dec 9, 2024 19:35:23.123493910 CET	64541	23	192.168.2.23	151.116.68.72
Dec 9, 2024 19:35:23.123498917 CET	64541	2323	192.168.2.23	70.4.61.117
Dec 9, 2024 19:35:23.123506069 CET	64541	23	192.168.2.23	102.157.66.84
Dec 9, 2024 19:35:23.123517036 CET	64541	23	192.168.2.23	181.228.58.61
Dec 9, 2024 19:35:23.123526096 CET	64541	23	192.168.2.23	48.200.178.3
Dec 9, 2024 19:35:23.123528957 CET	64541	23	192.168.2.23	118.1.166.207
Dec 9, 2024 19:35:23.123529911 CET	64541	23	192.168.2.23	102.101.32.241
Dec 9, 2024 19:35:23.123557091 CET	64541	23	192.168.2.23	197.66.199.229
Dec 9, 2024 19:35:23.123557091 CET	64541	23	192.168.2.23	46.3.80.103
Dec 9, 2024 19:35:23.123634100 CET	64541	23	192.168.2.23	35.188.132.223
Dec 9, 2024 19:35:23.123636961 CET	64541	23	192.168.2.23	183.238.213.228
Dec 9, 2024 19:35:23.123636961 CET	64541	23	192.168.2.23	86.254.140.248
Dec 9, 2024 19:35:23.123636961 CET	64541	23	192.168.2.23	57.159.246.47
Dec 9, 2024 19:35:23.123640060 CET	64541	2323	192.168.2.23	27.18.143.255
Dec 9, 2024 19:35:23.123670101 CET	64541	23	192.168.2.23	176.237.10.59
Dec 9, 2024 19:35:23.123718977 CET	64541	23	192.168.2.23	9.253.15.22
Dec 9, 2024 19:35:23.123734951 CET	64541	23	192.168.2.23	185.125.159.57
Dec 9, 2024 19:35:23.123735905 CET	64541	23	192.168.2.23	113.226.185.136
Dec 9, 2024 19:35:23.123743057 CET	64541	23	192.168.2.23	191.247.68.111
Dec 9, 2024 19:35:23.123780012 CET	64541	23	192.168.2.23	58.152.165.116
Dec 9, 2024 19:35:23.123796940 CET	64541	23	192.168.2.23	80.254.196.48
Dec 9, 2024 19:35:23.123797894 CET	64541	23	192.168.2.23	77.120.51.25
Dec 9, 2024 19:35:23.123843908 CET	64541	23	192.168.2.23	210.83.26.103
Dec 9, 2024 19:35:23.123847008 CET	64541	2323	192.168.2.23	124.178.47.103
Dec 9, 2024 19:35:23.123847008 CET	64541	23	192.168.2.23	141.130.155.122
Dec 9, 2024 19:35:23.123902082 CET	64541	23	192.168.2.23	104.161.199.178
Dec 9, 2024 19:35:23.123913050 CET	64541	23	192.168.2.23	206.49.64.159
Dec 9, 2024 19:35:23.123964071 CET	64541	23	192.168.2.23	161.169.6.193
Dec 9, 2024 19:35:23.123965025 CET	64541	2323	192.168.2.23	59.235.0.86
Dec 9, 2024 19:35:23.123965979 CET	64541	23	192.168.2.23	141.77.30.38
Dec 9, 2024 19:35:23.123967886 CET	64541	23	192.168.2.23	213.77.88.45
Dec 9, 2024 19:35:23.123967886 CET	64541	23	192.168.2.23	212.156.187.114
Dec 9, 2024 19:35:23.123967886 CET	64541	23	192.168.2.23	13.39.200.167
Dec 9, 2024 19:35:23.123967886 CET	64541	23	192.168.2.23	65.1.186.244
Dec 9, 2024 19:35:23.123967886 CET	64541	23	192.168.2.23	24.17.167.77
Dec 9, 2024 19:35:23.123972893 CET	64541	23	192.168.2.23	186.70.227.219
Dec 9, 2024 19:35:23.124057055 CET	64541	23	192.168.2.23	159.126.220.148
Dec 9, 2024 19:35:23.124063969 CET	64541	23	192.168.2.23	63.7.210.86
Dec 9, 2024 19:35:23.124111891 CET	64541	23	192.168.2.23	192.173.64.2
Dec 9, 2024 19:35:23.124123096 CET	64541	23	192.168.2.23	186.199.221.180
Dec 9, 2024 19:35:23.124214888 CET	64541	23	192.168.2.23	91.108.154.177
Dec 9, 2024 19:35:23.124214888 CET	64541	23	192.168.2.23	101.140.120.10
Dec 9, 2024 19:35:23.124217987 CET	64541	23	192.168.2.23	207.103.199.11
Dec 9, 2024 19:35:23.124218941 CET	64541	2323	192.168.2.23	13.231.125.151
Dec 9, 2024 19:35:23.124218941 CET	64541	23	192.168.2.23	181.229.167.58
Dec 9, 2024 19:35:23.124223948 CET	64541	23	192.168.2.23	195.1.7.98
Dec 9, 2024 19:35:23.124260902 CET	64541	23	192.168.2.23	178.180.37.114
Dec 9, 2024 19:35:23.124269962 CET	64541	23	192.168.2.23	75.102.140.9
Dec 9, 2024 19:35:23.124277115 CET	64541	23	192.168.2.23	169.29.136.255
Dec 9, 2024 19:35:23.124285936 CET	64541	23	192.168.2.23	141.99.230.8
Dec 9, 2024 19:35:23.124290943 CET	64541	23	192.168.2.23	117.212.100.100
Dec 9, 2024 19:35:23.124325037 CET	64541	23	192.168.2.23	197.137.66.10
Dec 9, 2024 19:35:23.228312016 CET	63645	37024	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:23.228383064 CET	37024	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:23.243304014 CET	2323	64541	20.66.105.87	192.168.2.23
Dec 9, 2024 19:35:23.243376970 CET	23	64541	19.103.46.195	192.168.2.23
Dec 9, 2024 19:35:23.243377924 CET	64541	2323	192.168.2.23	20.66.105.87
Dec 9, 2024 19:35:23.243390083 CET	23	64541	73.222.183.87	192.168.2.23
Dec 9, 2024 19:35:23.243428946 CET	64541	23	192.168.2.23	73.222.183.87
Dec 9, 2024 19:35:23.243428946 CET	64541	23	192.168.2.23	19.103.46.195
Dec 9, 2024 19:35:23.243472099 CET	23	64541	68.83.231.152	192.168.2.23
Dec 9, 2024 19:35:23.243529081 CET	23	64541	39.22.212.18	192.168.2.23
Dec 9, 2024 19:35:23.243537903 CET	23	64541	154.198.11.19	192.168.2.23
Dec 9, 2024 19:35:23.243560076 CET	64541	23	192.168.2.23	68.83.231.152
Dec 9, 2024 19:35:23.243561983 CET	64541	23	192.168.2.23	39.22.212.18
Dec 9, 2024 19:35:23.243572950 CET	64541	23	192.168.2.23	154.198.11.19
Dec 9, 2024 19:35:23.243572950 CET	23	64541	204.25.78.80	192.168.2.23
Dec 9, 2024 19:35:23.243616104 CET	64541	23	192.168.2.23	204.25.78.80
Dec 9, 2024 19:35:23.243643999 CET	23	64541	95.16.242.228	192.168.2.23
Dec 9, 2024 19:35:23.243653059 CET	23	64541	180.21.18.105	192.168.2.23
Dec 9, 2024 19:35:23.243717909 CET	23	64541	89.61.7.111	192.168.2.23
Dec 9, 2024 19:35:23.243738890 CET	64541	23	192.168.2.23	95.16.242.228
Dec 9, 2024 19:35:23.243750095 CET	64541	23	192.168.2.23	89.61.7.111
Dec 9, 2024 19:35:23.243767023 CET	64541	23	192.168.2.23	180.21.18.105
Dec 9, 2024 19:35:23.243777990 CET	23	64541	65.180.154.76	192.168.2.23
Dec 9, 2024 19:35:23.243804932 CET	64541	23	192.168.2.23	65.180.154.76
Dec 9, 2024 19:35:23.243834019 CET	2323	64541	78.205.28.15	192.168.2.23
Dec 9, 2024 19:35:23.243885040 CET	64541	2323	192.168.2.23	78.205.28.15
Dec 9, 2024 19:35:23.243956089 CET	23	64541	177.210.145.211	192.168.2.23
Dec 9, 2024 19:35:23.243966103 CET	23	64541	4.23.131.254	192.168.2.23
Dec 9, 2024 19:35:23.243987083 CET	64541	23	192.168.2.23	177.210.145.211
Dec 9, 2024 19:35:23.243994951 CET	64541	23	192.168.2.23	4.23.131.254
Dec 9, 2024 19:35:23.244005919 CET	23	64541	98.83.119.159	192.168.2.23
Dec 9, 2024 19:35:23.244071960 CET	64541	23	192.168.2.23	98.83.119.159
Dec 9, 2024 19:35:23.244077921 CET	23	64541	153.175.126.119	192.168.2.23
Dec 9, 2024 19:35:23.244086981 CET	23	64541	139.247.200.110	192.168.2.23
Dec 9, 2024 19:35:23.244096041 CET	23	64541	187.228.170.58	192.168.2.23
Dec 9, 2024 19:35:23.244103909 CET	64541	23	192.168.2.23	153.175.126.119
Dec 9, 2024 19:35:23.244116068 CET	64541	23	192.168.2.23	139.247.200.110
Dec 9, 2024 19:35:23.244123936 CET	64541	23	192.168.2.23	187.228.170.58
Dec 9, 2024 19:35:23.244127989 CET	23	64541	20.38.10.173	192.168.2.23
Dec 9, 2024 19:35:23.244137049 CET	23	64541	195.202.245.104	192.168.2.23
Dec 9, 2024 19:35:23.244162083 CET	64541	23	192.168.2.23	20.38.10.173
Dec 9, 2024 19:35:23.244194984 CET	64541	23	192.168.2.23	195.202.245.104
Dec 9, 2024 19:35:23.245105982 CET	2323	64541	182.118.50.175	192.168.2.23
Dec 9, 2024 19:35:23.245161057 CET	64541	2323	192.168.2.23	182.118.50.175
Dec 9, 2024 19:35:23.245162010 CET	23	64541	196.129.49.215	192.168.2.23
Dec 9, 2024 19:35:23.245208025 CET	64541	23	192.168.2.23	196.129.49.215
Dec 9, 2024 19:35:23.245312929 CET	23	64541	38.131.240.66	192.168.2.23
Dec 9, 2024 19:35:23.245332956 CET	23	64541	43.101.172.106	192.168.2.23
Dec 9, 2024 19:35:23.245357037 CET	64541	23	192.168.2.23	38.131.240.66
Dec 9, 2024 19:35:23.245366096 CET	64541	23	192.168.2.23	43.101.172.106
Dec 9, 2024 19:35:23.245389938 CET	23	64541	94.56.137.30	192.168.2.23
Dec 9, 2024 19:35:23.245398998 CET	23	64541	210.4.145.225	192.168.2.23
Dec 9, 2024 19:35:23.245408058 CET	23	64541	154.128.174.2	192.168.2.23
Dec 9, 2024 19:35:23.245455027 CET	23	64541	116.195.188.93	192.168.2.23
Dec 9, 2024 19:35:23.245465040 CET	23	64541	83.146.154.36	192.168.2.23
Dec 9, 2024 19:35:23.245466948 CET	64541	23	192.168.2.23	94.56.137.30
Dec 9, 2024 19:35:23.245466948 CET	64541	23	192.168.2.23	210.4.145.225
Dec 9, 2024 19:35:23.245476007 CET	64541	23	192.168.2.23	154.128.174.2
Dec 9, 2024 19:35:23.245498896 CET	23	64541	200.78.173.188	192.168.2.23
Dec 9, 2024 19:35:23.245500088 CET	64541	23	192.168.2.23	116.195.188.93
Dec 9, 2024 19:35:23.245500088 CET	64541	23	192.168.2.23	83.146.154.36
Dec 9, 2024 19:35:23.245532036 CET	64541	23	192.168.2.23	200.78.173.188
Dec 9, 2024 19:35:23.245537996 CET	2323	64541	19.116.252.121	192.168.2.23
Dec 9, 2024 19:35:23.245564938 CET	23	64541	39.177.103.207	192.168.2.23
Dec 9, 2024 19:35:23.245575905 CET	64541	2323	192.168.2.23	19.116.252.121
Dec 9, 2024 19:35:23.245632887 CET	23	64541	99.138.133.3	192.168.2.23
Dec 9, 2024 19:35:23.245637894 CET	64541	23	192.168.2.23	39.177.103.207
Dec 9, 2024 19:35:23.245650053 CET	23	64541	87.192.53.232	192.168.2.23
Dec 9, 2024 19:35:23.245661974 CET	64541	23	192.168.2.23	99.138.133.3
Dec 9, 2024 19:35:23.245676041 CET	64541	23	192.168.2.23	87.192.53.232
Dec 9, 2024 19:35:23.245702028 CET	23	64541	125.96.58.126	192.168.2.23
Dec 9, 2024 19:35:23.245711088 CET	23	64541	65.39.141.218	192.168.2.23
Dec 9, 2024 19:35:23.245737076 CET	64541	23	192.168.2.23	125.96.58.126
Dec 9, 2024 19:35:23.245738983 CET	64541	23	192.168.2.23	65.39.141.218
Dec 9, 2024 19:35:23.245862961 CET	23	64541	95.126.50.38	192.168.2.23
Dec 9, 2024 19:35:23.245872974 CET	23	64541	200.107.35.173	192.168.2.23
Dec 9, 2024 19:35:23.245882034 CET	23	64541	175.217.66.7	192.168.2.23
Dec 9, 2024 19:35:23.245891094 CET	2323	64541	58.234.119.137	192.168.2.23
Dec 9, 2024 19:35:23.245898962 CET	23	64541	118.185.49.200	192.168.2.23
Dec 9, 2024 19:35:23.245903969 CET	64541	23	192.168.2.23	95.126.50.38
Dec 9, 2024 19:35:23.245903969 CET	64541	23	192.168.2.23	200.107.35.173
Dec 9, 2024 19:35:23.245913029 CET	23	64541	13.0.36.35	192.168.2.23
Dec 9, 2024 19:35:23.245917082 CET	64541	2323	192.168.2.23	58.234.119.137
Dec 9, 2024 19:35:23.245920897 CET	64541	23	192.168.2.23	175.217.66.7
Dec 9, 2024 19:35:23.245922089 CET	23	64541	71.215.251.98	192.168.2.23
Dec 9, 2024 19:35:23.245940924 CET	64541	23	192.168.2.23	118.185.49.200
Dec 9, 2024 19:35:23.245942116 CET	64541	23	192.168.2.23	13.0.36.35
Dec 9, 2024 19:35:23.246015072 CET	64541	23	192.168.2.23	71.215.251.98
Dec 9, 2024 19:35:23.246036053 CET	23	64541	92.234.254.130	192.168.2.23
Dec 9, 2024 19:35:23.246045113 CET	23	64541	145.54.188.209	192.168.2.23
Dec 9, 2024 19:35:23.246052980 CET	23	64541	111.221.195.38	192.168.2.23
Dec 9, 2024 19:35:23.246067047 CET	23	64541	222.164.50.205	192.168.2.23
Dec 9, 2024 19:35:23.246069908 CET	64541	23	192.168.2.23	92.234.254.130
Dec 9, 2024 19:35:23.246074915 CET	23	64541	169.33.158.164	192.168.2.23
Dec 9, 2024 19:35:23.246079922 CET	64541	23	192.168.2.23	145.54.188.209
Dec 9, 2024 19:35:23.246082067 CET	64541	23	192.168.2.23	111.221.195.38
Dec 9, 2024 19:35:23.246100903 CET	64541	23	192.168.2.23	222.164.50.205
Dec 9, 2024 19:35:23.246102095 CET	64541	23	192.168.2.23	169.33.158.164
Dec 9, 2024 19:35:23.247109890 CET	23	64541	191.143.226.109	192.168.2.23
Dec 9, 2024 19:35:23.247147083 CET	64541	23	192.168.2.23	191.143.226.109
Dec 9, 2024 19:35:23.247160912 CET	23	64541	38.128.146.158	192.168.2.23
Dec 9, 2024 19:35:23.247170925 CET	2323	64541	145.103.127.174	192.168.2.23
Dec 9, 2024 19:35:23.247179031 CET	23	64541	153.15.215.57	192.168.2.23
Dec 9, 2024 19:35:23.247189999 CET	64541	2323	192.168.2.23	145.103.127.174
Dec 9, 2024 19:35:23.247191906 CET	23	64541	85.113.140.119	192.168.2.23
Dec 9, 2024 19:35:23.247193098 CET	64541	23	192.168.2.23	38.128.146.158
Dec 9, 2024 19:35:23.247210979 CET	64541	23	192.168.2.23	153.15.215.57
Dec 9, 2024 19:35:23.247271061 CET	23	64541	24.245.117.151	192.168.2.23
Dec 9, 2024 19:35:23.247272015 CET	64541	23	192.168.2.23	85.113.140.119
Dec 9, 2024 19:35:23.247279882 CET	23	64541	76.230.6.101	192.168.2.23
Dec 9, 2024 19:35:23.247288942 CET	23	64541	213.245.123.203	192.168.2.23
Dec 9, 2024 19:35:23.247298002 CET	23	64541	155.138.129.141	192.168.2.23
Dec 9, 2024 19:35:23.247308016 CET	64541	23	192.168.2.23	76.230.6.101
Dec 9, 2024 19:35:23.247308016 CET	64541	23	192.168.2.23	24.245.117.151
Dec 9, 2024 19:35:23.247308969 CET	64541	23	192.168.2.23	213.245.123.203
Dec 9, 2024 19:35:23.247318029 CET	23	64541	75.87.159.199	192.168.2.23
Dec 9, 2024 19:35:23.247325897 CET	23	64541	166.136.15.226	192.168.2.23
Dec 9, 2024 19:35:23.247325897 CET	64541	23	192.168.2.23	155.138.129.141
Dec 9, 2024 19:35:23.247330904 CET	23	64541	14.63.167.70	192.168.2.23
Dec 9, 2024 19:35:23.247335911 CET	2323	64541	8.45.106.157	192.168.2.23
Dec 9, 2024 19:35:23.247338057 CET	23	64541	161.181.234.192	192.168.2.23
Dec 9, 2024 19:35:23.247347116 CET	64541	23	192.168.2.23	166.136.15.226
Dec 9, 2024 19:35:23.247347116 CET	64541	23	192.168.2.23	75.87.159.199
Dec 9, 2024 19:35:23.247356892 CET	64541	23	192.168.2.23	14.63.167.70
Dec 9, 2024 19:35:23.247361898 CET	64541	2323	192.168.2.23	8.45.106.157
Dec 9, 2024 19:35:23.247369051 CET	64541	23	192.168.2.23	161.181.234.192
Dec 9, 2024 19:35:23.247411966 CET	23	64541	158.55.252.60	192.168.2.23
Dec 9, 2024 19:35:23.247421980 CET	23	64541	88.139.68.137	192.168.2.23
Dec 9, 2024 19:35:23.247431040 CET	23	64541	76.164.181.184	192.168.2.23
Dec 9, 2024 19:35:23.247435093 CET	23	64541	174.41.37.186	192.168.2.23
Dec 9, 2024 19:35:23.247438908 CET	23	64541	157.127.50.26	192.168.2.23
Dec 9, 2024 19:35:23.247442961 CET	23	64541	41.223.71.222	192.168.2.23
Dec 9, 2024 19:35:23.247447014 CET	2323	64541	196.214.47.138	192.168.2.23
Dec 9, 2024 19:35:23.247450113 CET	23	64541	221.84.17.238	192.168.2.23
Dec 9, 2024 19:35:23.247453928 CET	23	64541	113.189.77.155	192.168.2.23
Dec 9, 2024 19:35:23.247461081 CET	23	64541	97.224.100.55	192.168.2.23
Dec 9, 2024 19:35:23.247479916 CET	64541	23	192.168.2.23	158.55.252.60
Dec 9, 2024 19:35:23.247509956 CET	64541	23	192.168.2.23	76.164.181.184
Dec 9, 2024 19:35:23.247509956 CET	64541	2323	192.168.2.23	196.214.47.138
Dec 9, 2024 19:35:23.247510910 CET	64541	23	192.168.2.23	88.139.68.137
Dec 9, 2024 19:35:23.247514963 CET	64541	23	192.168.2.23	221.84.17.238
Dec 9, 2024 19:35:23.247520924 CET	64541	23	192.168.2.23	157.127.50.26
Dec 9, 2024 19:35:23.247524023 CET	64541	23	192.168.2.23	41.223.71.222
Dec 9, 2024 19:35:23.247524023 CET	64541	23	192.168.2.23	113.189.77.155
Dec 9, 2024 19:35:23.247524977 CET	64541	23	192.168.2.23	174.41.37.186
Dec 9, 2024 19:35:23.247526884 CET	64541	23	192.168.2.23	97.224.100.55
Dec 9, 2024 19:35:23.247643948 CET	23	64541	101.200.104.156	192.168.2.23
Dec 9, 2024 19:35:23.247652054 CET	23	64541	65.54.143.128	192.168.2.23
Dec 9, 2024 19:35:23.247662067 CET	23	64541	204.140.119.56	192.168.2.23
Dec 9, 2024 19:35:23.247670889 CET	23	64541	202.223.35.117	192.168.2.23
Dec 9, 2024 19:35:23.247674942 CET	64541	23	192.168.2.23	101.200.104.156
Dec 9, 2024 19:35:23.247678041 CET	64541	23	192.168.2.23	65.54.143.128
Dec 9, 2024 19:35:23.247701883 CET	64541	23	192.168.2.23	204.140.119.56
Dec 9, 2024 19:35:23.247704983 CET	64541	23	192.168.2.23	202.223.35.117
Dec 9, 2024 19:35:23.248145103 CET	23	64541	187.44.30.154	192.168.2.23
Dec 9, 2024 19:35:23.248189926 CET	64541	23	192.168.2.23	187.44.30.154
Dec 9, 2024 19:35:23.248210907 CET	23	64541	166.35.180.220	192.168.2.23
Dec 9, 2024 19:35:23.248219967 CET	2323	64541	173.113.41.17	192.168.2.23
Dec 9, 2024 19:35:23.248228073 CET	23	64541	142.50.195.12	192.168.2.23
Dec 9, 2024 19:35:23.248245001 CET	64541	2323	192.168.2.23	173.113.41.17
Dec 9, 2024 19:35:23.248246908 CET	64541	23	192.168.2.23	166.35.180.220
Dec 9, 2024 19:35:23.248264074 CET	64541	23	192.168.2.23	142.50.195.12
Dec 9, 2024 19:35:23.248332977 CET	23	64541	95.182.178.88	192.168.2.23
Dec 9, 2024 19:35:23.248341084 CET	23	64541	139.20.129.201	192.168.2.23
Dec 9, 2024 19:35:23.248349905 CET	23	64541	156.87.71.110	192.168.2.23
Dec 9, 2024 19:35:23.248358011 CET	23	64541	57.20.85.144	192.168.2.23
Dec 9, 2024 19:35:23.248361111 CET	64541	23	192.168.2.23	139.20.129.201
Dec 9, 2024 19:35:23.248366117 CET	23	64541	165.157.24.38	192.168.2.23
Dec 9, 2024 19:35:23.248369932 CET	64541	23	192.168.2.23	95.182.178.88
Dec 9, 2024 19:35:23.248373985 CET	23	64541	203.146.104.8	192.168.2.23
Dec 9, 2024 19:35:23.248383045 CET	64541	23	192.168.2.23	156.87.71.110
Dec 9, 2024 19:35:23.248383999 CET	23	64541	222.31.215.219	192.168.2.23
Dec 9, 2024 19:35:23.248389959 CET	64541	23	192.168.2.23	57.20.85.144
Dec 9, 2024 19:35:23.248394012 CET	23	64541	167.100.205.72	192.168.2.23
Dec 9, 2024 19:35:23.248398066 CET	64541	23	192.168.2.23	165.157.24.38
Dec 9, 2024 19:35:23.248403072 CET	23	64541	27.29.166.129	192.168.2.23
Dec 9, 2024 19:35:23.248403072 CET	64541	23	192.168.2.23	203.146.104.8
Dec 9, 2024 19:35:23.248411894 CET	23	64541	66.132.104.179	192.168.2.23
Dec 9, 2024 19:35:23.248420000 CET	2323	64541	92.46.93.45	192.168.2.23
Dec 9, 2024 19:35:23.248426914 CET	64541	23	192.168.2.23	27.29.166.129
Dec 9, 2024 19:35:23.248429060 CET	64541	23	192.168.2.23	167.100.205.72
Dec 9, 2024 19:35:23.248433113 CET	64541	23	192.168.2.23	222.31.215.219
Dec 9, 2024 19:35:23.248446941 CET	64541	23	192.168.2.23	66.132.104.179
Dec 9, 2024 19:35:23.248457909 CET	64541	2323	192.168.2.23	92.46.93.45
Dec 9, 2024 19:35:23.248532057 CET	23	64541	41.111.208.94	192.168.2.23
Dec 9, 2024 19:35:23.248533010 CET	23	64541	152.139.160.19	192.168.2.23
Dec 9, 2024 19:35:23.248538017 CET	23	64541	163.75.199.57	192.168.2.23
Dec 9, 2024 19:35:23.248545885 CET	23	64541	81.188.107.154	192.168.2.23
Dec 9, 2024 19:35:23.248549938 CET	23	64541	40.149.195.162	192.168.2.23
Dec 9, 2024 19:35:23.248558044 CET	23	64541	195.71.193.63	192.168.2.23
Dec 9, 2024 19:35:23.248558044 CET	64541	23	192.168.2.23	152.139.160.19
Dec 9, 2024 19:35:23.248565912 CET	2323	64541	69.184.158.120	192.168.2.23
Dec 9, 2024 19:35:23.248574018 CET	23	64541	35.53.223.36	192.168.2.23
Dec 9, 2024 19:35:23.248581886 CET	23	64541	4.103.247.153	192.168.2.23
Dec 9, 2024 19:35:23.248589993 CET	23	64541	38.21.53.141	192.168.2.23
Dec 9, 2024 19:35:23.248596907 CET	64541	23	192.168.2.23	40.149.195.162
Dec 9, 2024 19:35:23.248598099 CET	23	64541	223.231.243.150	192.168.2.23
Dec 9, 2024 19:35:23.248600960 CET	64541	23	192.168.2.23	195.71.193.63
Dec 9, 2024 19:35:23.248606920 CET	23	64541	40.25.242.182	192.168.2.23
Dec 9, 2024 19:35:23.248608112 CET	64541	23	192.168.2.23	41.111.208.94
Dec 9, 2024 19:35:23.248608112 CET	64541	23	192.168.2.23	81.188.107.154
Dec 9, 2024 19:35:23.248610973 CET	64541	23	192.168.2.23	163.75.199.57
Dec 9, 2024 19:35:23.248611927 CET	64541	23	192.168.2.23	35.53.223.36
Dec 9, 2024 19:35:23.248619080 CET	23	64541	19.94.198.185	192.168.2.23
Dec 9, 2024 19:35:23.248645067 CET	64541	2323	192.168.2.23	69.184.158.120
Dec 9, 2024 19:35:23.248651028 CET	64541	23	192.168.2.23	38.21.53.141
Dec 9, 2024 19:35:23.248661995 CET	64541	23	192.168.2.23	40.25.242.182
Dec 9, 2024 19:35:23.248661995 CET	64541	23	192.168.2.23	223.231.243.150
Dec 9, 2024 19:35:23.248662949 CET	64541	23	192.168.2.23	4.103.247.153
Dec 9, 2024 19:35:23.248667955 CET	64541	23	192.168.2.23	19.94.198.185
Dec 9, 2024 19:35:23.249361038 CET	23	64541	117.25.27.190	192.168.2.23
Dec 9, 2024 19:35:23.249370098 CET	23	64541	113.38.8.8	192.168.2.23
Dec 9, 2024 19:35:23.249377966 CET	23	64541	157.56.30.89	192.168.2.23
Dec 9, 2024 19:35:23.249399900 CET	23	64541	18.30.40.140	192.168.2.23
Dec 9, 2024 19:35:23.249403000 CET	64541	23	192.168.2.23	113.38.8.8
Dec 9, 2024 19:35:23.249404907 CET	64541	23	192.168.2.23	157.56.30.89
Dec 9, 2024 19:35:23.249403000 CET	64541	23	192.168.2.23	117.25.27.190
Dec 9, 2024 19:35:23.249409914 CET	23	64541	151.116.68.72	192.168.2.23
Dec 9, 2024 19:35:23.249429941 CET	2323	64541	70.4.61.117	192.168.2.23
Dec 9, 2024 19:35:23.249439955 CET	64541	23	192.168.2.23	151.116.68.72
Dec 9, 2024 19:35:23.249440908 CET	64541	23	192.168.2.23	18.30.40.140
Dec 9, 2024 19:35:23.249481916 CET	23	64541	102.157.66.84	192.168.2.23
Dec 9, 2024 19:35:23.249488115 CET	23	64541	181.228.58.61	192.168.2.23
Dec 9, 2024 19:35:23.249489069 CET	64541	2323	192.168.2.23	70.4.61.117
Dec 9, 2024 19:35:23.249540091 CET	64541	23	192.168.2.23	102.157.66.84
Dec 9, 2024 19:35:23.249552965 CET	64541	23	192.168.2.23	181.228.58.61
Dec 9, 2024 19:35:23.249576092 CET	23	64541	48.200.178.3	192.168.2.23
Dec 9, 2024 19:35:23.249605894 CET	64541	23	192.168.2.23	48.200.178.3
Dec 9, 2024 19:35:23.249622107 CET	23	64541	118.1.166.207	192.168.2.23
Dec 9, 2024 19:35:23.249631882 CET	23	64541	102.101.32.241	192.168.2.23
Dec 9, 2024 19:35:23.249692917 CET	64541	23	192.168.2.23	102.101.32.241
Dec 9, 2024 19:35:23.249695063 CET	64541	23	192.168.2.23	118.1.166.207
Dec 9, 2024 19:35:23.249845982 CET	23	64541	197.66.199.229	192.168.2.23
Dec 9, 2024 19:35:23.249860048 CET	23	64541	46.3.80.103	192.168.2.23
Dec 9, 2024 19:35:23.249867916 CET	23	64541	35.188.132.223	192.168.2.23
Dec 9, 2024 19:35:23.249876022 CET	2323	64541	27.18.143.255	192.168.2.23
Dec 9, 2024 19:35:23.249882936 CET	64541	23	192.168.2.23	197.66.199.229
Dec 9, 2024 19:35:23.249885082 CET	23	64541	183.238.213.228	192.168.2.23
Dec 9, 2024 19:35:23.249886990 CET	64541	23	192.168.2.23	46.3.80.103
Dec 9, 2024 19:35:23.249893904 CET	23	64541	86.254.140.248	192.168.2.23
Dec 9, 2024 19:35:23.249901056 CET	23	64541	57.159.246.47	192.168.2.23
Dec 9, 2024 19:35:23.249906063 CET	23	64541	176.237.10.59	192.168.2.23
Dec 9, 2024 19:35:23.249912977 CET	64541	23	192.168.2.23	183.238.213.228
Dec 9, 2024 19:35:23.249913931 CET	64541	23	192.168.2.23	35.188.132.223
Dec 9, 2024 19:35:23.249917030 CET	64541	2323	192.168.2.23	27.18.143.255
Dec 9, 2024 19:35:23.249922991 CET	23	64541	9.253.15.22	192.168.2.23
Dec 9, 2024 19:35:23.249931097 CET	23	64541	185.125.159.57	192.168.2.23
Dec 9, 2024 19:35:23.249938965 CET	23	64541	113.226.185.136	192.168.2.23
Dec 9, 2024 19:35:23.249947071 CET	23	64541	191.247.68.111	192.168.2.23
Dec 9, 2024 19:35:23.249947071 CET	64541	23	192.168.2.23	86.254.140.248
Dec 9, 2024 19:35:23.249947071 CET	64541	23	192.168.2.23	57.159.246.47
Dec 9, 2024 19:35:23.249954939 CET	23	64541	58.152.165.116	192.168.2.23
Dec 9, 2024 19:35:23.249960899 CET	64541	23	192.168.2.23	176.237.10.59
Dec 9, 2024 19:35:23.249964952 CET	23	64541	80.254.196.48	192.168.2.23
Dec 9, 2024 19:35:23.249974012 CET	23	64541	77.120.51.25	192.168.2.23
Dec 9, 2024 19:35:23.249982119 CET	23	64541	210.83.26.103	192.168.2.23
Dec 9, 2024 19:35:23.249990940 CET	2323	64541	124.178.47.103	192.168.2.23
Dec 9, 2024 19:35:23.249994040 CET	64541	23	192.168.2.23	185.125.159.57
Dec 9, 2024 19:35:23.249998093 CET	64541	23	192.168.2.23	9.253.15.22
Dec 9, 2024 19:35:23.250005960 CET	64541	23	192.168.2.23	113.226.185.136
Dec 9, 2024 19:35:23.250009060 CET	64541	23	192.168.2.23	58.152.165.116
Dec 9, 2024 19:35:23.250009060 CET	64541	23	192.168.2.23	80.254.196.48
Dec 9, 2024 19:35:23.250009060 CET	64541	23	192.168.2.23	191.247.68.111
Dec 9, 2024 19:35:23.250010967 CET	64541	23	192.168.2.23	210.83.26.103
Dec 9, 2024 19:35:23.250016928 CET	64541	2323	192.168.2.23	124.178.47.103
Dec 9, 2024 19:35:23.250020027 CET	64541	23	192.168.2.23	77.120.51.25
Dec 9, 2024 19:35:23.250976086 CET	23	64541	141.130.155.122	192.168.2.23
Dec 9, 2024 19:35:23.250988960 CET	23	64541	104.161.199.178	192.168.2.23
Dec 9, 2024 19:35:23.251017094 CET	64541	23	192.168.2.23	141.130.155.122
Dec 9, 2024 19:35:23.251022100 CET	64541	23	192.168.2.23	104.161.199.178
Dec 9, 2024 19:35:23.251023054 CET	23	64541	206.49.64.159	192.168.2.23
Dec 9, 2024 19:35:23.251079082 CET	64541	23	192.168.2.23	206.49.64.159
Dec 9, 2024 19:35:23.251096010 CET	23	64541	161.169.6.193	192.168.2.23
Dec 9, 2024 19:35:23.251127005 CET	64541	23	192.168.2.23	161.169.6.193
Dec 9, 2024 19:35:23.251159906 CET	2323	64541	59.235.0.86	192.168.2.23
Dec 9, 2024 19:35:23.251195908 CET	64541	2323	192.168.2.23	59.235.0.86
Dec 9, 2024 19:35:23.251208067 CET	23	64541	141.77.30.38	192.168.2.23
Dec 9, 2024 19:35:23.251245975 CET	64541	23	192.168.2.23	141.77.30.38
Dec 9, 2024 19:35:23.251270056 CET	23	64541	213.77.88.45	192.168.2.23
Dec 9, 2024 19:35:23.251280069 CET	23	64541	13.39.200.167	192.168.2.23
Dec 9, 2024 19:35:23.251307964 CET	64541	23	192.168.2.23	213.77.88.45
Dec 9, 2024 19:35:23.251307964 CET	64541	23	192.168.2.23	13.39.200.167
Dec 9, 2024 19:35:23.251364946 CET	23	64541	186.70.227.219	192.168.2.23
Dec 9, 2024 19:35:23.251375914 CET	23	64541	212.156.187.114	192.168.2.23
Dec 9, 2024 19:35:23.251384020 CET	23	64541	65.1.186.244	192.168.2.23
Dec 9, 2024 19:35:23.251391888 CET	23	64541	24.17.167.77	192.168.2.23
Dec 9, 2024 19:35:23.251401901 CET	23	64541	159.126.220.148	192.168.2.23
Dec 9, 2024 19:35:23.251405954 CET	64541	23	192.168.2.23	212.156.187.114
Dec 9, 2024 19:35:23.251405954 CET	64541	23	192.168.2.23	65.1.186.244
Dec 9, 2024 19:35:23.251405954 CET	64541	23	192.168.2.23	186.70.227.219
Dec 9, 2024 19:35:23.251410961 CET	23	64541	63.7.210.86	192.168.2.23
Dec 9, 2024 19:35:23.251419067 CET	64541	23	192.168.2.23	24.17.167.77
Dec 9, 2024 19:35:23.251420975 CET	23	64541	192.173.64.2	192.168.2.23
Dec 9, 2024 19:35:23.251429081 CET	23	64541	186.199.221.180	192.168.2.23
Dec 9, 2024 19:35:23.251436949 CET	64541	23	192.168.2.23	159.126.220.148
Dec 9, 2024 19:35:23.251441002 CET	64541	23	192.168.2.23	192.173.64.2
Dec 9, 2024 19:35:23.251441956 CET	64541	23	192.168.2.23	63.7.210.86
Dec 9, 2024 19:35:23.251442909 CET	23	64541	91.108.154.177	192.168.2.23
Dec 9, 2024 19:35:23.251451969 CET	2323	64541	13.231.125.151	192.168.2.23
Dec 9, 2024 19:35:23.251460075 CET	64541	23	192.168.2.23	186.199.221.180
Dec 9, 2024 19:35:23.251462936 CET	23	64541	207.103.199.11	192.168.2.23
Dec 9, 2024 19:35:23.251471996 CET	23	64541	181.229.167.58	192.168.2.23
Dec 9, 2024 19:35:23.251476049 CET	64541	23	192.168.2.23	91.108.154.177
Dec 9, 2024 19:35:23.251477003 CET	64541	2323	192.168.2.23	13.231.125.151
Dec 9, 2024 19:35:23.251481056 CET	23	64541	195.1.7.98	192.168.2.23
Dec 9, 2024 19:35:23.251491070 CET	23	64541	101.140.120.10	192.168.2.23
Dec 9, 2024 19:35:23.251496077 CET	64541	23	192.168.2.23	207.103.199.11
Dec 9, 2024 19:35:23.251499891 CET	23	64541	178.180.37.114	192.168.2.23
Dec 9, 2024 19:35:23.251499891 CET	64541	23	192.168.2.23	181.229.167.58
Dec 9, 2024 19:35:23.251509905 CET	23	64541	75.102.140.9	192.168.2.23
Dec 9, 2024 19:35:23.251513958 CET	64541	23	192.168.2.23	195.1.7.98
Dec 9, 2024 19:35:23.251518011 CET	64541	23	192.168.2.23	101.140.120.10
Dec 9, 2024 19:35:23.251521111 CET	23	64541	169.29.136.255	192.168.2.23
Dec 9, 2024 19:35:23.251527071 CET	64541	23	192.168.2.23	178.180.37.114
Dec 9, 2024 19:35:23.251528978 CET	23	64541	141.99.230.8	192.168.2.23
Dec 9, 2024 19:35:23.251534939 CET	64541	23	192.168.2.23	75.102.140.9
Dec 9, 2024 19:35:23.251539946 CET	23	64541	117.212.100.100	192.168.2.23
Dec 9, 2024 19:35:23.251550913 CET	64541	23	192.168.2.23	169.29.136.255
Dec 9, 2024 19:35:23.251562119 CET	64541	23	192.168.2.23	141.99.230.8
Dec 9, 2024 19:35:23.251579046 CET	64541	23	192.168.2.23	117.212.100.100
Dec 9, 2024 19:35:23.251734972 CET	23	64541	197.137.66.10	192.168.2.23
Dec 9, 2024 19:35:23.251776934 CET	64541	23	192.168.2.23	197.137.66.10
Dec 9, 2024 19:35:23.252078056 CET	37024	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:23.377152920 CET	63645	37024	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:23.377198935 CET	37024	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:23.496573925 CET	63645	37024	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:24.125673056 CET	64541	2323	192.168.2.23	9.255.100.62
Dec 9, 2024 19:35:24.125686884 CET	64541	23	192.168.2.23	14.235.164.136
Dec 9, 2024 19:35:24.125686884 CET	64541	23	192.168.2.23	94.216.234.231
Dec 9, 2024 19:35:24.125689983 CET	64541	23	192.168.2.23	109.6.175.3
Dec 9, 2024 19:35:24.125725031 CET	64541	23	192.168.2.23	148.185.191.248
Dec 9, 2024 19:35:24.125727892 CET	64541	23	192.168.2.23	166.19.52.63
Dec 9, 2024 19:35:24.125725031 CET	64541	23	192.168.2.23	36.255.96.49
Dec 9, 2024 19:35:24.125732899 CET	64541	23	192.168.2.23	38.251.239.72
Dec 9, 2024 19:35:24.125736952 CET	64541	23	192.168.2.23	71.242.6.90
Dec 9, 2024 19:35:24.125761032 CET	64541	2323	192.168.2.23	154.138.91.144
Dec 9, 2024 19:35:24.125761986 CET	64541	23	192.168.2.23	205.160.231.127
Dec 9, 2024 19:35:24.125765085 CET	64541	23	192.168.2.23	163.100.18.148
Dec 9, 2024 19:35:24.125765085 CET	64541	23	192.168.2.23	113.0.69.51
Dec 9, 2024 19:35:24.125801086 CET	64541	23	192.168.2.23	32.70.152.74
Dec 9, 2024 19:35:24.125801086 CET	64541	23	192.168.2.23	4.150.186.37
Dec 9, 2024 19:35:24.125839949 CET	64541	23	192.168.2.23	83.43.50.104
Dec 9, 2024 19:35:24.125840902 CET	64541	23	192.168.2.23	67.193.187.68
Dec 9, 2024 19:35:24.125850916 CET	64541	23	192.168.2.23	151.21.53.118
Dec 9, 2024 19:35:24.125890017 CET	64541	23	192.168.2.23	39.0.94.245
Dec 9, 2024 19:35:24.125897884 CET	64541	2323	192.168.2.23	48.90.201.194
Dec 9, 2024 19:35:24.125900030 CET	64541	23	192.168.2.23	19.200.206.165
Dec 9, 2024 19:35:24.125905991 CET	64541	23	192.168.2.23	8.108.57.102
Dec 9, 2024 19:35:24.125906944 CET	64541	23	192.168.2.23	74.103.13.238
Dec 9, 2024 19:35:24.125906944 CET	64541	23	192.168.2.23	165.228.136.104
Dec 9, 2024 19:35:24.125906944 CET	64541	23	192.168.2.23	183.181.45.176
Dec 9, 2024 19:35:24.125921011 CET	64541	23	192.168.2.23	167.41.153.75
Dec 9, 2024 19:35:24.125921011 CET	64541	23	192.168.2.23	48.44.222.65
Dec 9, 2024 19:35:24.125922918 CET	64541	23	192.168.2.23	89.58.230.232
Dec 9, 2024 19:35:24.125927925 CET	64541	23	192.168.2.23	191.238.215.69
Dec 9, 2024 19:35:24.125936031 CET	64541	23	192.168.2.23	43.243.167.167
Dec 9, 2024 19:35:24.125936985 CET	64541	2323	192.168.2.23	87.151.42.65
Dec 9, 2024 19:35:24.125966072 CET	64541	23	192.168.2.23	108.247.214.137
Dec 9, 2024 19:35:24.125967026 CET	64541	23	192.168.2.23	90.207.20.197
Dec 9, 2024 19:35:24.125984907 CET	64541	23	192.168.2.23	123.65.190.25
Dec 9, 2024 19:35:24.125986099 CET	64541	23	192.168.2.23	217.232.185.178
Dec 9, 2024 19:35:24.125988007 CET	64541	23	192.168.2.23	77.43.254.174
Dec 9, 2024 19:35:24.125998974 CET	64541	23	192.168.2.23	191.184.180.48
Dec 9, 2024 19:35:24.126049042 CET	64541	23	192.168.2.23	147.61.56.128
Dec 9, 2024 19:35:24.126054049 CET	64541	23	192.168.2.23	149.232.0.239
Dec 9, 2024 19:35:24.126065969 CET	64541	23	192.168.2.23	61.215.168.42
Dec 9, 2024 19:35:24.126077890 CET	64541	2323	192.168.2.23	66.70.82.3
Dec 9, 2024 19:35:24.126080990 CET	64541	23	192.168.2.23	195.143.218.115
Dec 9, 2024 19:35:24.126084089 CET	64541	23	192.168.2.23	59.213.207.233
Dec 9, 2024 19:35:24.126092911 CET	64541	23	192.168.2.23	221.125.129.101
Dec 9, 2024 19:35:24.126095057 CET	64541	23	192.168.2.23	217.38.129.91
Dec 9, 2024 19:35:24.126156092 CET	64541	23	192.168.2.23	158.202.149.123
Dec 9, 2024 19:35:24.126157045 CET	64541	23	192.168.2.23	146.9.90.219
Dec 9, 2024 19:35:24.126161098 CET	64541	23	192.168.2.23	174.41.72.3
Dec 9, 2024 19:35:24.126198053 CET	64541	23	192.168.2.23	199.106.34.199
Dec 9, 2024 19:35:24.126211882 CET	64541	23	192.168.2.23	125.148.21.235
Dec 9, 2024 19:35:24.126216888 CET	64541	2323	192.168.2.23	12.80.201.35
Dec 9, 2024 19:35:24.126228094 CET	64541	23	192.168.2.23	192.18.135.200
Dec 9, 2024 19:35:24.126229048 CET	64541	23	192.168.2.23	210.158.49.29
Dec 9, 2024 19:35:24.126245975 CET	64541	23	192.168.2.23	82.58.10.215
Dec 9, 2024 19:35:24.126246929 CET	64541	23	192.168.2.23	190.20.214.212
Dec 9, 2024 19:35:24.126265049 CET	64541	23	192.168.2.23	73.242.227.156
Dec 9, 2024 19:35:24.126266956 CET	64541	23	192.168.2.23	104.111.230.236
Dec 9, 2024 19:35:24.126266956 CET	64541	23	192.168.2.23	48.92.7.134
Dec 9, 2024 19:35:24.126270056 CET	64541	23	192.168.2.23	53.154.15.18
Dec 9, 2024 19:35:24.126312971 CET	64541	23	192.168.2.23	107.83.215.249
Dec 9, 2024 19:35:24.126322985 CET	64541	23	192.168.2.23	42.222.102.107
Dec 9, 2024 19:35:24.126332045 CET	64541	2323	192.168.2.23	109.228.166.130
Dec 9, 2024 19:35:24.126332998 CET	64541	23	192.168.2.23	35.4.100.199
Dec 9, 2024 19:35:24.126333952 CET	64541	23	192.168.2.23	116.9.184.242
Dec 9, 2024 19:35:24.126332998 CET	64541	23	192.168.2.23	101.73.205.35
Dec 9, 2024 19:35:24.126343012 CET	64541	23	192.168.2.23	217.247.193.202
Dec 9, 2024 19:35:24.126363993 CET	64541	23	192.168.2.23	75.234.142.252
Dec 9, 2024 19:35:24.126420975 CET	64541	23	192.168.2.23	156.66.220.49
Dec 9, 2024 19:35:24.126422882 CET	64541	23	192.168.2.23	150.183.89.196
Dec 9, 2024 19:35:24.126461983 CET	64541	2323	192.168.2.23	68.48.25.249
Dec 9, 2024 19:35:24.126463890 CET	64541	23	192.168.2.23	32.126.81.136
Dec 9, 2024 19:35:24.126499891 CET	64541	23	192.168.2.23	208.132.206.147
Dec 9, 2024 19:35:24.126499891 CET	64541	23	192.168.2.23	101.229.46.220
Dec 9, 2024 19:35:24.126507044 CET	64541	23	192.168.2.23	189.148.172.1
Dec 9, 2024 19:35:24.126535892 CET	64541	23	192.168.2.23	104.34.56.74
Dec 9, 2024 19:35:24.126538038 CET	64541	23	192.168.2.23	173.250.112.16
Dec 9, 2024 19:35:24.126538038 CET	64541	23	192.168.2.23	201.15.133.0
Dec 9, 2024 19:35:24.126542091 CET	64541	23	192.168.2.23	84.69.114.231
Dec 9, 2024 19:35:24.126552105 CET	64541	23	192.168.2.23	66.94.226.209
Dec 9, 2024 19:35:24.126565933 CET	64541	23	192.168.2.23	121.0.197.225
Dec 9, 2024 19:35:24.126571894 CET	64541	2323	192.168.2.23	212.221.224.89
Dec 9, 2024 19:35:24.126596928 CET	64541	23	192.168.2.23	83.62.214.47
Dec 9, 2024 19:35:24.126596928 CET	64541	23	192.168.2.23	179.235.242.190
Dec 9, 2024 19:35:24.126597881 CET	64541	23	192.168.2.23	220.38.244.51
Dec 9, 2024 19:35:24.126620054 CET	64541	23	192.168.2.23	93.10.197.80
Dec 9, 2024 19:35:24.126625061 CET	64541	23	192.168.2.23	1.111.252.60
Dec 9, 2024 19:35:24.126657009 CET	64541	23	192.168.2.23	209.205.151.63
Dec 9, 2024 19:35:24.126657963 CET	64541	23	192.168.2.23	61.9.17.7
Dec 9, 2024 19:35:24.126657963 CET	64541	23	192.168.2.23	89.39.245.164
Dec 9, 2024 19:35:24.126669884 CET	64541	23	192.168.2.23	95.229.21.9
Dec 9, 2024 19:35:24.126673937 CET	64541	2323	192.168.2.23	46.242.223.207
Dec 9, 2024 19:35:24.126713037 CET	64541	23	192.168.2.23	184.65.63.242
Dec 9, 2024 19:35:24.126715899 CET	64541	23	192.168.2.23	37.246.114.253
Dec 9, 2024 19:35:24.126717091 CET	64541	23	192.168.2.23	204.102.107.225
Dec 9, 2024 19:35:24.126717091 CET	64541	23	192.168.2.23	175.225.19.234
Dec 9, 2024 19:35:24.126718044 CET	64541	23	192.168.2.23	8.6.88.106
Dec 9, 2024 19:35:24.126737118 CET	64541	23	192.168.2.23	148.250.57.156
Dec 9, 2024 19:35:24.126755953 CET	64541	23	192.168.2.23	23.146.18.192
Dec 9, 2024 19:35:24.126760006 CET	64541	23	192.168.2.23	89.130.132.186
Dec 9, 2024 19:35:24.126769066 CET	64541	23	192.168.2.23	194.148.216.246
Dec 9, 2024 19:35:24.126774073 CET	64541	23	192.168.2.23	149.89.166.1
Dec 9, 2024 19:35:24.126779079 CET	64541	2323	192.168.2.23	184.42.70.11
Dec 9, 2024 19:35:24.126816034 CET	64541	23	192.168.2.23	112.173.102.117
Dec 9, 2024 19:35:24.126816988 CET	64541	23	192.168.2.23	162.169.62.173
Dec 9, 2024 19:35:24.126816988 CET	64541	23	192.168.2.23	200.230.44.110
Dec 9, 2024 19:35:24.126817942 CET	64541	23	192.168.2.23	14.183.103.0
Dec 9, 2024 19:35:24.126843929 CET	64541	23	192.168.2.23	191.107.104.115
Dec 9, 2024 19:35:24.126856089 CET	64541	23	192.168.2.23	106.116.174.115
Dec 9, 2024 19:35:24.126883030 CET	64541	23	192.168.2.23	31.182.193.243
Dec 9, 2024 19:35:24.126889944 CET	64541	2323	192.168.2.23	206.209.191.238
Dec 9, 2024 19:35:24.126921892 CET	64541	23	192.168.2.23	223.85.223.103
Dec 9, 2024 19:35:24.126964092 CET	64541	23	192.168.2.23	156.248.98.135
Dec 9, 2024 19:35:24.126967907 CET	64541	23	192.168.2.23	198.102.88.107
Dec 9, 2024 19:35:24.126967907 CET	64541	23	192.168.2.23	124.55.188.231
Dec 9, 2024 19:35:24.127047062 CET	64541	23	192.168.2.23	157.94.33.20
Dec 9, 2024 19:35:24.127048969 CET	64541	23	192.168.2.23	101.144.76.199
Dec 9, 2024 19:35:24.127052069 CET	64541	23	192.168.2.23	64.64.48.194
Dec 9, 2024 19:35:24.127052069 CET	64541	23	192.168.2.23	150.185.103.195
Dec 9, 2024 19:35:24.127065897 CET	64541	23	192.168.2.23	212.253.194.120
Dec 9, 2024 19:35:24.127065897 CET	64541	2323	192.168.2.23	212.249.223.61
Dec 9, 2024 19:35:24.127068043 CET	64541	23	192.168.2.23	169.241.104.28
Dec 9, 2024 19:35:24.127067089 CET	64541	23	192.168.2.23	37.5.180.148
Dec 9, 2024 19:35:24.127090931 CET	64541	23	192.168.2.23	119.123.82.193
Dec 9, 2024 19:35:24.127094030 CET	64541	23	192.168.2.23	168.141.78.184
Dec 9, 2024 19:35:24.127100945 CET	64541	23	192.168.2.23	59.106.242.237
Dec 9, 2024 19:35:24.127101898 CET	64541	23	192.168.2.23	149.51.231.153
Dec 9, 2024 19:35:24.127116919 CET	64541	23	192.168.2.23	79.101.136.94
Dec 9, 2024 19:35:24.127141953 CET	64541	23	192.168.2.23	150.55.21.223
Dec 9, 2024 19:35:24.127166033 CET	64541	23	192.168.2.23	144.93.87.30
Dec 9, 2024 19:35:24.127182007 CET	64541	2323	192.168.2.23	203.141.64.57
Dec 9, 2024 19:35:24.127188921 CET	64541	23	192.168.2.23	37.57.147.44
Dec 9, 2024 19:35:24.127190113 CET	64541	23	192.168.2.23	5.36.128.118
Dec 9, 2024 19:35:24.127193928 CET	64541	23	192.168.2.23	146.210.13.107
Dec 9, 2024 19:35:24.127232075 CET	64541	23	192.168.2.23	203.83.73.128
Dec 9, 2024 19:35:24.127237082 CET	64541	23	192.168.2.23	178.30.107.47
Dec 9, 2024 19:35:24.127239943 CET	64541	23	192.168.2.23	159.248.247.154
Dec 9, 2024 19:35:24.127239943 CET	64541	23	192.168.2.23	219.41.207.201
Dec 9, 2024 19:35:24.127239943 CET	64541	23	192.168.2.23	170.181.227.161
Dec 9, 2024 19:35:24.127258062 CET	64541	23	192.168.2.23	58.239.83.46
Dec 9, 2024 19:35:24.127258062 CET	64541	2323	192.168.2.23	102.149.212.7
Dec 9, 2024 19:35:24.127258062 CET	64541	23	192.168.2.23	142.122.122.40
Dec 9, 2024 19:35:24.127291918 CET	64541	23	192.168.2.23	209.95.167.25
Dec 9, 2024 19:35:24.127291918 CET	64541	23	192.168.2.23	108.156.24.56
Dec 9, 2024 19:35:24.127291918 CET	64541	23	192.168.2.23	115.103.41.212
Dec 9, 2024 19:35:24.127293110 CET	64541	23	192.168.2.23	105.105.221.110
Dec 9, 2024 19:35:24.127295971 CET	64541	23	192.168.2.23	122.32.108.133
Dec 9, 2024 19:35:24.127305984 CET	64541	23	192.168.2.23	121.121.219.105
Dec 9, 2024 19:35:24.127305984 CET	64541	23	192.168.2.23	38.195.70.173
Dec 9, 2024 19:35:24.127317905 CET	64541	2323	192.168.2.23	124.216.211.60
Dec 9, 2024 19:35:24.127336979 CET	64541	23	192.168.2.23	91.131.88.234
Dec 9, 2024 19:35:24.127338886 CET	64541	23	192.168.2.23	5.30.187.121
Dec 9, 2024 19:35:24.127357006 CET	64541	23	192.168.2.23	136.238.12.155
Dec 9, 2024 19:35:24.127357006 CET	64541	23	192.168.2.23	102.201.206.134
Dec 9, 2024 19:35:24.127357960 CET	64541	23	192.168.2.23	136.39.107.158
Dec 9, 2024 19:35:24.127357960 CET	64541	23	192.168.2.23	220.227.228.104
Dec 9, 2024 19:35:24.127357960 CET	64541	23	192.168.2.23	5.198.166.191
Dec 9, 2024 19:35:24.127361059 CET	64541	23	192.168.2.23	148.230.166.94
Dec 9, 2024 19:35:24.127388000 CET	64541	23	192.168.2.23	122.218.157.206
Dec 9, 2024 19:35:24.127396107 CET	64541	23	192.168.2.23	182.196.63.37
Dec 9, 2024 19:35:24.127413034 CET	64541	23	192.168.2.23	79.196.161.2
Dec 9, 2024 19:35:24.246058941 CET	23	64541	94.216.234.231	192.168.2.23
Dec 9, 2024 19:35:24.246078968 CET	2323	64541	9.255.100.62	192.168.2.23
Dec 9, 2024 19:35:24.246092081 CET	23	64541	14.235.164.136	192.168.2.23
Dec 9, 2024 19:35:24.246145964 CET	64541	2323	192.168.2.23	9.255.100.62
Dec 9, 2024 19:35:24.246145964 CET	64541	23	192.168.2.23	94.216.234.231
Dec 9, 2024 19:35:24.246150017 CET	23	64541	109.6.175.3	192.168.2.23
Dec 9, 2024 19:35:24.246153116 CET	64541	23	192.168.2.23	14.235.164.136
Dec 9, 2024 19:35:24.246162891 CET	23	64541	166.19.52.63	192.168.2.23
Dec 9, 2024 19:35:24.246184111 CET	23	64541	38.251.239.72	192.168.2.23
Dec 9, 2024 19:35:24.246195078 CET	23	64541	148.185.191.248	192.168.2.23
Dec 9, 2024 19:35:24.246201038 CET	64541	23	192.168.2.23	109.6.175.3
Dec 9, 2024 19:35:24.246201038 CET	64541	23	192.168.2.23	166.19.52.63
Dec 9, 2024 19:35:24.246207952 CET	23	64541	36.255.96.49	192.168.2.23
Dec 9, 2024 19:35:24.246227026 CET	64541	23	192.168.2.23	148.185.191.248
Dec 9, 2024 19:35:24.246231079 CET	64541	23	192.168.2.23	38.251.239.72
Dec 9, 2024 19:35:24.246234894 CET	23	64541	71.242.6.90	192.168.2.23
Dec 9, 2024 19:35:24.246243954 CET	64541	23	192.168.2.23	36.255.96.49
Dec 9, 2024 19:35:24.246289015 CET	64541	23	192.168.2.23	71.242.6.90
Dec 9, 2024 19:35:24.246296883 CET	2323	64541	154.138.91.144	192.168.2.23
Dec 9, 2024 19:35:24.246308088 CET	23	64541	205.160.231.127	192.168.2.23
Dec 9, 2024 19:35:24.246326923 CET	64541	2323	192.168.2.23	154.138.91.144
Dec 9, 2024 19:35:24.246345043 CET	23	64541	163.100.18.148	192.168.2.23
Dec 9, 2024 19:35:24.246357918 CET	64541	23	192.168.2.23	205.160.231.127
Dec 9, 2024 19:35:24.246383905 CET	23	64541	113.0.69.51	192.168.2.23
Dec 9, 2024 19:35:24.246395111 CET	23	64541	32.70.152.74	192.168.2.23
Dec 9, 2024 19:35:24.246414900 CET	23	64541	4.150.186.37	192.168.2.23
Dec 9, 2024 19:35:24.246422052 CET	64541	23	192.168.2.23	163.100.18.148
Dec 9, 2024 19:35:24.246422052 CET	64541	23	192.168.2.23	113.0.69.51
Dec 9, 2024 19:35:24.246432066 CET	23	64541	83.43.50.104	192.168.2.23
Dec 9, 2024 19:35:24.246439934 CET	64541	23	192.168.2.23	32.70.152.74
Dec 9, 2024 19:35:24.246439934 CET	64541	23	192.168.2.23	4.150.186.37
Dec 9, 2024 19:35:24.246445894 CET	23	64541	67.193.187.68	192.168.2.23
Dec 9, 2024 19:35:24.246489048 CET	64541	23	192.168.2.23	83.43.50.104
Dec 9, 2024 19:35:24.246520996 CET	64541	23	192.168.2.23	67.193.187.68
Dec 9, 2024 19:35:24.246529102 CET	23	64541	151.21.53.118	192.168.2.23
Dec 9, 2024 19:35:24.246541023 CET	2323	64541	48.90.201.194	192.168.2.23
Dec 9, 2024 19:35:24.246550083 CET	23	64541	8.108.57.102	192.168.2.23
Dec 9, 2024 19:35:24.246561050 CET	23	64541	19.200.206.165	192.168.2.23
Dec 9, 2024 19:35:24.246570110 CET	64541	23	192.168.2.23	151.21.53.118
Dec 9, 2024 19:35:24.246571064 CET	64541	2323	192.168.2.23	48.90.201.194
Dec 9, 2024 19:35:24.246572018 CET	64541	23	192.168.2.23	8.108.57.102
Dec 9, 2024 19:35:24.246581078 CET	23	64541	74.103.13.238	192.168.2.23
Dec 9, 2024 19:35:24.246592045 CET	23	64541	165.228.136.104	192.168.2.23
Dec 9, 2024 19:35:24.246602058 CET	23	64541	39.0.94.245	192.168.2.23
Dec 9, 2024 19:35:24.246608019 CET	64541	23	192.168.2.23	19.200.206.165
Dec 9, 2024 19:35:24.246613979 CET	23	64541	183.181.45.176	192.168.2.23
Dec 9, 2024 19:35:24.246623039 CET	64541	23	192.168.2.23	74.103.13.238
Dec 9, 2024 19:35:24.246624947 CET	64541	23	192.168.2.23	165.228.136.104
Dec 9, 2024 19:35:24.246634007 CET	64541	23	192.168.2.23	39.0.94.245
Dec 9, 2024 19:35:24.246644974 CET	23	64541	167.41.153.75	192.168.2.23
Dec 9, 2024 19:35:24.246654987 CET	64541	23	192.168.2.23	183.181.45.176
Dec 9, 2024 19:35:24.246685028 CET	23	64541	89.58.230.232	192.168.2.23
Dec 9, 2024 19:35:24.246716976 CET	64541	23	192.168.2.23	167.41.153.75
Dec 9, 2024 19:35:24.246720076 CET	64541	23	192.168.2.23	89.58.230.232
Dec 9, 2024 19:35:24.246740103 CET	23	64541	48.44.222.65	192.168.2.23
Dec 9, 2024 19:35:24.246750116 CET	23	64541	191.238.215.69	192.168.2.23
Dec 9, 2024 19:35:24.246772051 CET	64541	23	192.168.2.23	48.44.222.65
Dec 9, 2024 19:35:24.246783972 CET	64541	23	192.168.2.23	191.238.215.69
Dec 9, 2024 19:35:24.247534990 CET	23	64541	43.243.167.167	192.168.2.23
Dec 9, 2024 19:35:24.247591019 CET	64541	23	192.168.2.23	43.243.167.167
Dec 9, 2024 19:35:24.247607946 CET	2323	64541	87.151.42.65	192.168.2.23
Dec 9, 2024 19:35:24.247632027 CET	23	64541	90.207.20.197	192.168.2.23
Dec 9, 2024 19:35:24.247656107 CET	64541	2323	192.168.2.23	87.151.42.65
Dec 9, 2024 19:35:24.247677088 CET	64541	23	192.168.2.23	90.207.20.197
Dec 9, 2024 19:35:24.247690916 CET	23	64541	108.247.214.137	192.168.2.23
Dec 9, 2024 19:35:24.247742891 CET	64541	23	192.168.2.23	108.247.214.137
Dec 9, 2024 19:35:24.247787952 CET	23	64541	123.65.190.25	192.168.2.23
Dec 9, 2024 19:35:24.247800112 CET	23	64541	77.43.254.174	192.168.2.23
Dec 9, 2024 19:35:24.247809887 CET	23	64541	217.232.185.178	192.168.2.23
Dec 9, 2024 19:35:24.247823954 CET	23	64541	191.184.180.48	192.168.2.23
Dec 9, 2024 19:35:24.247829914 CET	64541	23	192.168.2.23	77.43.254.174
Dec 9, 2024 19:35:24.247834921 CET	64541	23	192.168.2.23	123.65.190.25
Dec 9, 2024 19:35:24.247842073 CET	64541	23	192.168.2.23	217.232.185.178
Dec 9, 2024 19:35:24.247847080 CET	23	64541	147.61.56.128	192.168.2.23
Dec 9, 2024 19:35:24.247858047 CET	23	64541	149.232.0.239	192.168.2.23
Dec 9, 2024 19:35:24.247869015 CET	23	64541	61.215.168.42	192.168.2.23
Dec 9, 2024 19:35:24.247869968 CET	64541	23	192.168.2.23	191.184.180.48
Dec 9, 2024 19:35:24.247875929 CET	64541	23	192.168.2.23	147.61.56.128
Dec 9, 2024 19:35:24.247904062 CET	64541	23	192.168.2.23	61.215.168.42
Dec 9, 2024 19:35:24.247917891 CET	2323	64541	66.70.82.3	192.168.2.23
Dec 9, 2024 19:35:24.247929096 CET	64541	23	192.168.2.23	149.232.0.239
Dec 9, 2024 19:35:24.247929096 CET	23	64541	195.143.218.115	192.168.2.23
Dec 9, 2024 19:35:24.247951031 CET	64541	23	192.168.2.23	195.143.218.115
Dec 9, 2024 19:35:24.247960091 CET	64541	2323	192.168.2.23	66.70.82.3
Dec 9, 2024 19:35:24.247968912 CET	23	64541	59.213.207.233	192.168.2.23
Dec 9, 2024 19:35:24.247997046 CET	64541	23	192.168.2.23	59.213.207.233
Dec 9, 2024 19:35:24.248017073 CET	23	64541	221.125.129.101	192.168.2.23
Dec 9, 2024 19:35:24.248042107 CET	23	64541	217.38.129.91	192.168.2.23
Dec 9, 2024 19:35:24.248054028 CET	64541	23	192.168.2.23	221.125.129.101
Dec 9, 2024 19:35:24.248085022 CET	23	64541	158.202.149.123	192.168.2.23
Dec 9, 2024 19:35:24.248086929 CET	64541	23	192.168.2.23	217.38.129.91
Dec 9, 2024 19:35:24.248114109 CET	23	64541	146.9.90.219	192.168.2.23
Dec 9, 2024 19:35:24.248121977 CET	64541	23	192.168.2.23	158.202.149.123
Dec 9, 2024 19:35:24.248150110 CET	23	64541	174.41.72.3	192.168.2.23
Dec 9, 2024 19:35:24.248159885 CET	64541	23	192.168.2.23	146.9.90.219
Dec 9, 2024 19:35:24.248183012 CET	64541	23	192.168.2.23	174.41.72.3
Dec 9, 2024 19:35:24.248193979 CET	23	64541	199.106.34.199	192.168.2.23
Dec 9, 2024 19:35:24.248204947 CET	23	64541	125.148.21.235	192.168.2.23
Dec 9, 2024 19:35:24.248240948 CET	64541	23	192.168.2.23	199.106.34.199
Dec 9, 2024 19:35:24.248245001 CET	64541	23	192.168.2.23	125.148.21.235
Dec 9, 2024 19:35:24.248272896 CET	2323	64541	12.80.201.35	192.168.2.23
Dec 9, 2024 19:35:24.248286009 CET	23	64541	192.18.135.200	192.168.2.23
Dec 9, 2024 19:35:24.248295069 CET	23	64541	210.158.49.29	192.168.2.23
Dec 9, 2024 19:35:24.248305082 CET	23	64541	190.20.214.212	192.168.2.23
Dec 9, 2024 19:35:24.248311043 CET	64541	2323	192.168.2.23	12.80.201.35
Dec 9, 2024 19:35:24.248327017 CET	64541	23	192.168.2.23	210.158.49.29
Dec 9, 2024 19:35:24.248327971 CET	64541	23	192.168.2.23	192.18.135.200
Dec 9, 2024 19:35:24.248337030 CET	64541	23	192.168.2.23	190.20.214.212
Dec 9, 2024 19:35:24.248404026 CET	23	64541	82.58.10.215	192.168.2.23
Dec 9, 2024 19:35:24.248415947 CET	23	64541	73.242.227.156	192.168.2.23
Dec 9, 2024 19:35:24.248425007 CET	23	64541	104.111.230.236	192.168.2.23
Dec 9, 2024 19:35:24.248440981 CET	64541	23	192.168.2.23	82.58.10.215
Dec 9, 2024 19:35:24.248456001 CET	64541	23	192.168.2.23	73.242.227.156
Dec 9, 2024 19:35:24.248457909 CET	64541	23	192.168.2.23	104.111.230.236
Dec 9, 2024 19:35:24.249068022 CET	23	64541	53.154.15.18	192.168.2.23
Dec 9, 2024 19:35:24.249078035 CET	23	64541	48.92.7.134	192.168.2.23
Dec 9, 2024 19:35:24.249088049 CET	23	64541	107.83.215.249	192.168.2.23
Dec 9, 2024 19:35:24.249099016 CET	23	64541	42.222.102.107	192.168.2.23
Dec 9, 2024 19:35:24.249102116 CET	64541	23	192.168.2.23	53.154.15.18
Dec 9, 2024 19:35:24.249123096 CET	64541	23	192.168.2.23	107.83.215.249
Dec 9, 2024 19:35:24.249130964 CET	64541	23	192.168.2.23	42.222.102.107
Dec 9, 2024 19:35:24.249147892 CET	64541	23	192.168.2.23	48.92.7.134
Dec 9, 2024 19:35:24.249166012 CET	2323	64541	109.228.166.130	192.168.2.23
Dec 9, 2024 19:35:24.249185085 CET	23	64541	35.4.100.199	192.168.2.23
Dec 9, 2024 19:35:24.249207020 CET	23	64541	116.9.184.242	192.168.2.23
Dec 9, 2024 19:35:24.249212027 CET	64541	2323	192.168.2.23	109.228.166.130
Dec 9, 2024 19:35:24.249219894 CET	64541	23	192.168.2.23	35.4.100.199
Dec 9, 2024 19:35:24.249239922 CET	64541	23	192.168.2.23	116.9.184.242
Dec 9, 2024 19:35:24.249258995 CET	23	64541	101.73.205.35	192.168.2.23
Dec 9, 2024 19:35:24.249283075 CET	23	64541	217.247.193.202	192.168.2.23
Dec 9, 2024 19:35:24.249296904 CET	64541	23	192.168.2.23	101.73.205.35
Dec 9, 2024 19:35:24.249321938 CET	64541	23	192.168.2.23	217.247.193.202
Dec 9, 2024 19:35:24.249330044 CET	23	64541	75.234.142.252	192.168.2.23
Dec 9, 2024 19:35:24.249361992 CET	23	64541	150.183.89.196	192.168.2.23
Dec 9, 2024 19:35:24.249372005 CET	23	64541	156.66.220.49	192.168.2.23
Dec 9, 2024 19:35:24.249372959 CET	64541	23	192.168.2.23	75.234.142.252
Dec 9, 2024 19:35:24.249399900 CET	2323	64541	68.48.25.249	192.168.2.23
Dec 9, 2024 19:35:24.249416113 CET	23	64541	32.126.81.136	192.168.2.23
Dec 9, 2024 19:35:24.249427080 CET	23	64541	208.132.206.147	192.168.2.23
Dec 9, 2024 19:35:24.249435902 CET	64541	23	192.168.2.23	150.183.89.196
Dec 9, 2024 19:35:24.249435902 CET	64541	2323	192.168.2.23	68.48.25.249
Dec 9, 2024 19:35:24.249437094 CET	23	64541	101.229.46.220	192.168.2.23
Dec 9, 2024 19:35:24.249454021 CET	64541	23	192.168.2.23	156.66.220.49
Dec 9, 2024 19:35:24.249456882 CET	23	64541	189.148.172.1	192.168.2.23
Dec 9, 2024 19:35:24.249459028 CET	64541	23	192.168.2.23	208.132.206.147
Dec 9, 2024 19:35:24.249459028 CET	64541	23	192.168.2.23	32.126.81.136
Dec 9, 2024 19:35:24.249469042 CET	23	64541	104.34.56.74	192.168.2.23
Dec 9, 2024 19:35:24.249471903 CET	64541	23	192.168.2.23	101.229.46.220
Dec 9, 2024 19:35:24.249480963 CET	23	64541	173.250.112.16	192.168.2.23
Dec 9, 2024 19:35:24.249486923 CET	64541	23	192.168.2.23	189.148.172.1
Dec 9, 2024 19:35:24.249490976 CET	23	64541	84.69.114.231	192.168.2.23
Dec 9, 2024 19:35:24.249502897 CET	64541	23	192.168.2.23	104.34.56.74
Dec 9, 2024 19:35:24.249530077 CET	64541	23	192.168.2.23	84.69.114.231
Dec 9, 2024 19:35:24.249547958 CET	64541	23	192.168.2.23	173.250.112.16
Dec 9, 2024 19:35:24.249619007 CET	23	64541	201.15.133.0	192.168.2.23
Dec 9, 2024 19:35:24.249629974 CET	23	64541	66.94.226.209	192.168.2.23
Dec 9, 2024 19:35:24.249639988 CET	23	64541	121.0.197.225	192.168.2.23
Dec 9, 2024 19:35:24.249649048 CET	2323	64541	212.221.224.89	192.168.2.23
Dec 9, 2024 19:35:24.249651909 CET	64541	23	192.168.2.23	201.15.133.0
Dec 9, 2024 19:35:24.249659061 CET	23	64541	220.38.244.51	192.168.2.23
Dec 9, 2024 19:35:24.249661922 CET	64541	23	192.168.2.23	121.0.197.225
Dec 9, 2024 19:35:24.249669075 CET	23	64541	179.235.242.190	192.168.2.23
Dec 9, 2024 19:35:24.249670029 CET	64541	23	192.168.2.23	66.94.226.209
Dec 9, 2024 19:35:24.249685049 CET	23	64541	83.62.214.47	192.168.2.23
Dec 9, 2024 19:35:24.249686956 CET	64541	2323	192.168.2.23	212.221.224.89
Dec 9, 2024 19:35:24.249696016 CET	23	64541	93.10.197.80	192.168.2.23
Dec 9, 2024 19:35:24.249696016 CET	64541	23	192.168.2.23	220.38.244.51
Dec 9, 2024 19:35:24.249716043 CET	64541	23	192.168.2.23	179.235.242.190
Dec 9, 2024 19:35:24.249722004 CET	64541	23	192.168.2.23	83.62.214.47
Dec 9, 2024 19:35:24.249742985 CET	64541	23	192.168.2.23	93.10.197.80
Dec 9, 2024 19:35:24.250318050 CET	23	64541	1.111.252.60	192.168.2.23
Dec 9, 2024 19:35:24.250329971 CET	23	64541	209.205.151.63	192.168.2.23
Dec 9, 2024 19:35:24.250339985 CET	23	64541	61.9.17.7	192.168.2.23
Dec 9, 2024 19:35:24.250359058 CET	64541	23	192.168.2.23	1.111.252.60
Dec 9, 2024 19:35:24.250363111 CET	23	64541	89.39.245.164	192.168.2.23
Dec 9, 2024 19:35:24.250370979 CET	64541	23	192.168.2.23	209.205.151.63
Dec 9, 2024 19:35:24.250370979 CET	64541	23	192.168.2.23	61.9.17.7
Dec 9, 2024 19:35:24.250374079 CET	23	64541	95.229.21.9	192.168.2.23
Dec 9, 2024 19:35:24.250386953 CET	2323	64541	46.242.223.207	192.168.2.23
Dec 9, 2024 19:35:24.250401974 CET	64541	23	192.168.2.23	89.39.245.164
Dec 9, 2024 19:35:24.250415087 CET	64541	23	192.168.2.23	95.229.21.9
Dec 9, 2024 19:35:24.250416994 CET	64541	2323	192.168.2.23	46.242.223.207
Dec 9, 2024 19:35:24.250484943 CET	23	64541	184.65.63.242	192.168.2.23
Dec 9, 2024 19:35:24.250494957 CET	23	64541	37.246.114.253	192.168.2.23
Dec 9, 2024 19:35:24.250514984 CET	23	64541	8.6.88.106	192.168.2.23
Dec 9, 2024 19:35:24.250523090 CET	23	64541	204.102.107.225	192.168.2.23
Dec 9, 2024 19:35:24.250524044 CET	64541	23	192.168.2.23	184.65.63.242
Dec 9, 2024 19:35:24.250533104 CET	64541	23	192.168.2.23	37.246.114.253
Dec 9, 2024 19:35:24.250535965 CET	23	64541	175.225.19.234	192.168.2.23
Dec 9, 2024 19:35:24.250549078 CET	64541	23	192.168.2.23	8.6.88.106
Dec 9, 2024 19:35:24.250556946 CET	64541	23	192.168.2.23	204.102.107.225
Dec 9, 2024 19:35:24.250582933 CET	23	64541	148.250.57.156	192.168.2.23
Dec 9, 2024 19:35:24.250583887 CET	64541	23	192.168.2.23	175.225.19.234
Dec 9, 2024 19:35:24.250593901 CET	23	64541	23.146.18.192	192.168.2.23
Dec 9, 2024 19:35:24.250619888 CET	64541	23	192.168.2.23	148.250.57.156
Dec 9, 2024 19:35:24.250641108 CET	64541	23	192.168.2.23	23.146.18.192
Dec 9, 2024 19:35:24.250649929 CET	23	64541	89.130.132.186	192.168.2.23
Dec 9, 2024 19:35:24.250678062 CET	23	64541	194.148.216.246	192.168.2.23
Dec 9, 2024 19:35:24.250684023 CET	64541	23	192.168.2.23	89.130.132.186
Dec 9, 2024 19:35:24.250715971 CET	64541	23	192.168.2.23	194.148.216.246
Dec 9, 2024 19:35:24.250776052 CET	23	64541	149.89.166.1	192.168.2.23
Dec 9, 2024 19:35:24.250791073 CET	2323	64541	184.42.70.11	192.168.2.23
Dec 9, 2024 19:35:24.250802040 CET	23	64541	112.173.102.117	192.168.2.23
Dec 9, 2024 19:35:24.250817060 CET	64541	23	192.168.2.23	149.89.166.1
Dec 9, 2024 19:35:24.250819921 CET	64541	2323	192.168.2.23	184.42.70.11
Dec 9, 2024 19:35:24.250819921 CET	64541	23	192.168.2.23	112.173.102.117
Dec 9, 2024 19:35:24.250854015 CET	23	64541	162.169.62.173	192.168.2.23
Dec 9, 2024 19:35:24.250890017 CET	23	64541	200.230.44.110	192.168.2.23
Dec 9, 2024 19:35:24.250890017 CET	64541	23	192.168.2.23	162.169.62.173
Dec 9, 2024 19:35:24.250931025 CET	64541	23	192.168.2.23	200.230.44.110
Dec 9, 2024 19:35:24.250942945 CET	23	64541	14.183.103.0	192.168.2.23
Dec 9, 2024 19:35:24.250955105 CET	23	64541	191.107.104.115	192.168.2.23
Dec 9, 2024 19:35:24.250965118 CET	23	64541	106.116.174.115	192.168.2.23
Dec 9, 2024 19:35:24.250972033 CET	64541	23	192.168.2.23	14.183.103.0
Dec 9, 2024 19:35:24.250986099 CET	64541	23	192.168.2.23	191.107.104.115
Dec 9, 2024 19:35:24.251008987 CET	64541	23	192.168.2.23	106.116.174.115
Dec 9, 2024 19:35:24.251024008 CET	23	64541	31.182.193.243	192.168.2.23
Dec 9, 2024 19:35:24.251064062 CET	2323	64541	206.209.191.238	192.168.2.23
Dec 9, 2024 19:35:24.251074076 CET	23	64541	223.85.223.103	192.168.2.23
Dec 9, 2024 19:35:24.251079082 CET	64541	23	192.168.2.23	31.182.193.243
Dec 9, 2024 19:35:24.251097918 CET	64541	2323	192.168.2.23	206.209.191.238
Dec 9, 2024 19:35:24.251101971 CET	64541	23	192.168.2.23	223.85.223.103
Dec 9, 2024 19:35:24.251146078 CET	23	64541	156.248.98.135	192.168.2.23
Dec 9, 2024 19:35:24.251157045 CET	23	64541	198.102.88.107	192.168.2.23
Dec 9, 2024 19:35:24.251183033 CET	64541	23	192.168.2.23	156.248.98.135
Dec 9, 2024 19:35:24.251203060 CET	64541	23	192.168.2.23	198.102.88.107
Dec 9, 2024 19:35:24.252094030 CET	23	64541	124.55.188.231	192.168.2.23
Dec 9, 2024 19:35:24.252151012 CET	64541	23	192.168.2.23	124.55.188.231
Dec 9, 2024 19:35:24.252156973 CET	23	64541	157.94.33.20	192.168.2.23
Dec 9, 2024 19:35:24.252183914 CET	64541	23	192.168.2.23	157.94.33.20
Dec 9, 2024 19:35:24.252197027 CET	23	64541	101.144.76.199	192.168.2.23
Dec 9, 2024 19:35:24.252206087 CET	23	64541	64.64.48.194	192.168.2.23
Dec 9, 2024 19:35:24.252223969 CET	23	64541	150.185.103.195	192.168.2.23
Dec 9, 2024 19:35:24.252235889 CET	64541	23	192.168.2.23	101.144.76.199
Dec 9, 2024 19:35:24.252243996 CET	64541	23	192.168.2.23	64.64.48.194
Dec 9, 2024 19:35:24.252249002 CET	23	64541	212.253.194.120	192.168.2.23
Dec 9, 2024 19:35:24.252264023 CET	64541	23	192.168.2.23	150.185.103.195
Dec 9, 2024 19:35:24.252307892 CET	64541	23	192.168.2.23	212.253.194.120
Dec 9, 2024 19:35:24.252336979 CET	23	64541	37.5.180.148	192.168.2.23
Dec 9, 2024 19:35:24.252347946 CET	2323	64541	212.249.223.61	192.168.2.23
Dec 9, 2024 19:35:24.252367973 CET	23	64541	119.123.82.193	192.168.2.23
Dec 9, 2024 19:35:24.252377987 CET	23	64541	169.241.104.28	192.168.2.23
Dec 9, 2024 19:35:24.252387047 CET	23	64541	59.106.242.237	192.168.2.23
Dec 9, 2024 19:35:24.252389908 CET	64541	2323	192.168.2.23	212.249.223.61
Dec 9, 2024 19:35:24.252396107 CET	64541	23	192.168.2.23	37.5.180.148
Dec 9, 2024 19:35:24.252398968 CET	64541	23	192.168.2.23	119.123.82.193
Dec 9, 2024 19:35:24.252413034 CET	23	64541	149.51.231.153	192.168.2.23
Dec 9, 2024 19:35:24.252424955 CET	23	64541	168.141.78.184	192.168.2.23
Dec 9, 2024 19:35:24.252435923 CET	23	64541	79.101.136.94	192.168.2.23
Dec 9, 2024 19:35:24.252446890 CET	64541	23	192.168.2.23	169.241.104.28
Dec 9, 2024 19:35:24.252448082 CET	64541	23	192.168.2.23	149.51.231.153
Dec 9, 2024 19:35:24.252453089 CET	64541	23	192.168.2.23	59.106.242.237
Dec 9, 2024 19:35:24.252475977 CET	64541	23	192.168.2.23	168.141.78.184
Dec 9, 2024 19:35:24.252475977 CET	64541	23	192.168.2.23	79.101.136.94
Dec 9, 2024 19:35:24.252491951 CET	23	64541	150.55.21.223	192.168.2.23
Dec 9, 2024 19:35:24.252501965 CET	23	64541	144.93.87.30	192.168.2.23
Dec 9, 2024 19:35:24.252530098 CET	2323	64541	203.141.64.57	192.168.2.23
Dec 9, 2024 19:35:24.252531052 CET	64541	23	192.168.2.23	144.93.87.30
Dec 9, 2024 19:35:24.252552986 CET	64541	23	192.168.2.23	150.55.21.223
Dec 9, 2024 19:35:24.252562046 CET	64541	2323	192.168.2.23	203.141.64.57
Dec 9, 2024 19:35:24.252579927 CET	23	64541	37.57.147.44	192.168.2.23
Dec 9, 2024 19:35:24.252588987 CET	23	64541	5.36.128.118	192.168.2.23
Dec 9, 2024 19:35:24.252608061 CET	23	64541	146.210.13.107	192.168.2.23
Dec 9, 2024 19:35:24.252623081 CET	23	64541	203.83.73.128	192.168.2.23
Dec 9, 2024 19:35:24.252629042 CET	64541	23	192.168.2.23	37.57.147.44
Dec 9, 2024 19:35:24.252635002 CET	23	64541	178.30.107.47	192.168.2.23
Dec 9, 2024 19:35:24.252640963 CET	64541	23	192.168.2.23	5.36.128.118
Dec 9, 2024 19:35:24.252666950 CET	64541	23	192.168.2.23	146.210.13.107
Dec 9, 2024 19:35:24.252667904 CET	64541	23	192.168.2.23	203.83.73.128
Dec 9, 2024 19:35:24.252681017 CET	64541	23	192.168.2.23	178.30.107.47
Dec 9, 2024 19:35:24.252707005 CET	23	64541	159.248.247.154	192.168.2.23
Dec 9, 2024 19:35:24.252717018 CET	23	64541	219.41.207.201	192.168.2.23
Dec 9, 2024 19:35:24.252727985 CET	23	64541	58.239.83.46	192.168.2.23
Dec 9, 2024 19:35:24.252741098 CET	64541	23	192.168.2.23	219.41.207.201
Dec 9, 2024 19:35:24.252748966 CET	64541	23	192.168.2.23	159.248.247.154
Dec 9, 2024 19:35:24.252753019 CET	2323	64541	102.149.212.7	192.168.2.23
Dec 9, 2024 19:35:24.252763033 CET	64541	23	192.168.2.23	58.239.83.46
Dec 9, 2024 19:35:24.252770901 CET	23	64541	142.122.122.40	192.168.2.23
Dec 9, 2024 19:35:24.252778053 CET	64541	2323	192.168.2.23	102.149.212.7
Dec 9, 2024 19:35:24.252799988 CET	23	64541	170.181.227.161	192.168.2.23
Dec 9, 2024 19:35:24.252806902 CET	64541	23	192.168.2.23	142.122.122.40
Dec 9, 2024 19:35:24.252831936 CET	64541	23	192.168.2.23	170.181.227.161
Dec 9, 2024 19:35:24.253213882 CET	23	64541	115.103.41.212	192.168.2.23
Dec 9, 2024 19:35:24.253249884 CET	64541	23	192.168.2.23	115.103.41.212
Dec 9, 2024 19:35:24.253281116 CET	23	64541	122.32.108.133	192.168.2.23
Dec 9, 2024 19:35:24.253292084 CET	23	64541	209.95.167.25	192.168.2.23
Dec 9, 2024 19:35:24.253300905 CET	23	64541	105.105.221.110	192.168.2.23
Dec 9, 2024 19:35:24.253319025 CET	23	64541	108.156.24.56	192.168.2.23
Dec 9, 2024 19:35:24.253319025 CET	64541	23	192.168.2.23	122.32.108.133
Dec 9, 2024 19:35:24.253324986 CET	64541	23	192.168.2.23	209.95.167.25
Dec 9, 2024 19:35:24.253328085 CET	23	64541	121.121.219.105	192.168.2.23
Dec 9, 2024 19:35:24.253329039 CET	64541	23	192.168.2.23	105.105.221.110
Dec 9, 2024 19:35:24.253336906 CET	23	64541	38.195.70.173	192.168.2.23
Dec 9, 2024 19:35:24.253351927 CET	64541	23	192.168.2.23	108.156.24.56
Dec 9, 2024 19:35:24.253357887 CET	64541	23	192.168.2.23	121.121.219.105
Dec 9, 2024 19:35:24.253371000 CET	64541	23	192.168.2.23	38.195.70.173
Dec 9, 2024 19:35:24.253437042 CET	2323	64541	124.216.211.60	192.168.2.23
Dec 9, 2024 19:35:24.253448009 CET	23	64541	5.30.187.121	192.168.2.23
Dec 9, 2024 19:35:24.253458023 CET	23	64541	91.131.88.234	192.168.2.23
Dec 9, 2024 19:35:24.253467083 CET	23	64541	136.238.12.155	192.168.2.23
Dec 9, 2024 19:35:24.253474951 CET	64541	2323	192.168.2.23	124.216.211.60
Dec 9, 2024 19:35:24.253475904 CET	23	64541	102.201.206.134	192.168.2.23
Dec 9, 2024 19:35:24.253478050 CET	64541	23	192.168.2.23	5.30.187.121
Dec 9, 2024 19:35:24.253485918 CET	23	64541	136.39.107.158	192.168.2.23
Dec 9, 2024 19:35:24.253488064 CET	64541	23	192.168.2.23	91.131.88.234
Dec 9, 2024 19:35:24.253494978 CET	23	64541	148.230.166.94	192.168.2.23
Dec 9, 2024 19:35:24.253503084 CET	23	64541	220.227.228.104	192.168.2.23
Dec 9, 2024 19:35:24.253506899 CET	23	64541	5.198.166.191	192.168.2.23
Dec 9, 2024 19:35:24.253509045 CET	64541	23	192.168.2.23	136.238.12.155
Dec 9, 2024 19:35:24.253516912 CET	23	64541	122.218.157.206	192.168.2.23
Dec 9, 2024 19:35:24.253518105 CET	64541	23	192.168.2.23	102.201.206.134
Dec 9, 2024 19:35:24.253525972 CET	23	64541	182.196.63.37	192.168.2.23
Dec 9, 2024 19:35:24.253530025 CET	64541	23	192.168.2.23	136.39.107.158
Dec 9, 2024 19:35:24.253530025 CET	64541	23	192.168.2.23	220.227.228.104
Dec 9, 2024 19:35:24.253535032 CET	64541	23	192.168.2.23	148.230.166.94
Dec 9, 2024 19:35:24.253546953 CET	23	64541	79.196.161.2	192.168.2.23
Dec 9, 2024 19:35:24.253550053 CET	64541	23	192.168.2.23	5.198.166.191
Dec 9, 2024 19:35:24.253561974 CET	64541	23	192.168.2.23	122.218.157.206
Dec 9, 2024 19:35:24.253576994 CET	64541	23	192.168.2.23	182.196.63.37
Dec 9, 2024 19:35:24.253582954 CET	64541	23	192.168.2.23	79.196.161.2
Dec 9, 2024 19:35:24.479213953 CET	63645	37024	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:24.479269028 CET	37024	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:24.479439020 CET	37024	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:24.482525110 CET	37028	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:24.601778030 CET	63645	37028	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:24.601957083 CET	37028	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:24.608352900 CET	37028	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:24.727648973 CET	63645	37028	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:24.727698088 CET	37028	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:24.846890926 CET	63645	37028	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:24.884183884 CET	37028	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:25.048804045 CET	63645	37028	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:25.431220055 CET	43928	443	192.168.2.23	91.189.91.42
Dec 9, 2024 19:35:25.574317932 CET	63645	37028	154.213.187.84	192.168.2.23
Dec 9, 2024 19:35:25.579018116 CET	37028	63645	192.168.2.23	154.213.187.84
Dec 9, 2024 19:35:31.062586069 CET	42836	443	192.168.2.23	91.189.91.43
Dec 9, 2024 19:35:32.598368883 CET	42516	80	192.168.2.23	109.202.202.202
Dec 9, 2024 19:35:46.164554119 CET	43928	443	192.168.2.23	91.189.91.42
Dec 9, 2024 19:35:58.450848103 CET	42836	443	192.168.2.23	91.189.91.43
Dec 9, 2024 19:36:02.546123028 CET	42516	80	192.168.2.23	109.202.202.202
Dec 9, 2024 19:36:27.118746996 CET	43928	443	192.168.2.23	91.189.91.42

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 9, 2024 19:35:33.186485052 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 9, 2024 19:36:53.201143026 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

System Behavior

Analysis Process: Fantazy.spc.elf PID: 6217, Parent PID: 6134

General

Start time (UTC):	18:35:21
Start date (UTC):	09/12/2024
Path:	/tmp/Fantazy.spc.elf
Arguments:	/tmp/Fantazy.spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6219, Parent PID: 6217

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/tmp/Fantazy.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6221, Parent PID: 6217

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/tmp/Fantazy.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6223, Parent PID: 6221

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/tmp/Fantazy.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6225, Parent PID: 6221

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/tmp/Fantazy.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6226, Parent PID: 6221

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/tmp/Fantazy.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: systemd PID: 6232, Parent PID: 1

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: journalctl PID: 6232, Parent PID: 1

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/bin/journalctl
Arguments:	/usr/bin/journalctl --smart-relinquish-var
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Chronological Activities

Analysis Process: systemd PID: 6247, Parent PID: 1

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6247, Parent PID: 1

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: gdm3 PID: 6263, Parent PID: 1320

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6263, Parent PID: 1320

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 6266, Parent PID: 1320

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6266, Parent PID: 1320

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 6267, Parent PID: 1

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6267, Parent PID: 1

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: gdm3 PID: 6268, Parent PID: 1320

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6268, Parent PID: 1320

General

Start time (UTC):	18:35:22
Start date (UTC):	09/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 6269, Parent PID: 1860

General

Start time (UTC):	18:35:23
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6269, Parent PID: 1860

General

Start time (UTC):	18:35:23
Start date (UTC):	09/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6270, Parent PID: 1

General

Start time (UTC):	18:35:23
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 6270, Parent PID: 1

General

Start time (UTC):	18:35:23
Start date (UTC):	09/12/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: gvfsd-fuse PID: 6271, Parent PID: 2038

General

Start time (UTC):	18:35:23
Start date (UTC):	09/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Chronological Activities

Analysis Process: fusermount PID: 6271, Parent PID: 2038

General

Start time (UTC):	18:35:23
Start date (UTC):	09/12/2024
Path:	/bin/fusermount
Arguments:	fusermount -u -q -z -- /run/user/1000/gvfs
File size:	39144 bytes
MD5 hash:	576a1b135c82bdcbc97a91acea900566

Chronological Activities

Analysis Process: systemd PID: 6281, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6281, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6282, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 6282, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 6283, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6283, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6284, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6284, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6286, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 6286, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 6287, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6287, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6288, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 6288, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 6289, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6289, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6290, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 6290, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 6291, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6291, Parent PID: 1

General

Start time (UTC):	18:35:24
Start date (UTC):	09/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6294, Parent PID: 1

General

Start time (UTC):	18:35:25
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6294, Parent PID: 1

General

Start time (UTC):	18:35:25
Start date (UTC):	09/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6296, Parent PID: 1

General

Start time (UTC):	18:35:25
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6296, Parent PID: 1

General

Start time (UTC):	18:35:25
Start date (UTC):	09/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.pRGNKV (deleted)

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

ICMP Packets

System Behavior

Analysis Process: Fantazy.spc.elf PID: 6217, Parent PID: 6134

General

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6219, Parent PID: 6217

General

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6221, Parent PID: 6217

General

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6223, Parent PID: 6221

General

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6225, Parent PID: 6221

General

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6226, Parent PID: 6221

General

Chronological Activities

Analysis Process: systemd PID: 6232, Parent PID: 1

General

Chronological Activities

Analysis Process: journalctl PID: 6232, Parent PID: 1

Linux Analysis Report
Fantazy.spc.elf