Edit tour

Linux Analysis Report
Space.arm7.elf

Overview

General Information

Sample name:	Space.arm7.elf
Analysis ID:	1575725
MD5:	2a3fee148c081e6d892f579b9638706a
SHA1:	f3e6164b6ecbc7c2ae1a56a4f85b66c93b050d62
SHA256:	e17eae56011f4f12044a1df31c1245b95ebfb01caf39fc9758f49594c1165cad
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575725
Start date and time:	2024-12-16 09:01:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.arm7.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.arm7.elf
PID:	5485
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.arm7.elf (PID: 5485, Parent: 5404, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Space.arm7.elf

Space.arm7.elf New Fork (PID: 5487, Parent: 5485)

Space.arm7.elf New Fork (PID: 5489, Parent: 5487)

Space.arm7.elf New Fork (PID: 5491, Parent: 5487)

Space.arm7.elf New Fork (PID: 5496, Parent: 5485)

Space.arm7.elf New Fork (PID: 5498, Parent: 5485)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5485.1.00007f8148017000.00007f814802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5485.1.00007f8148017000.00007f814802f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5496.1.00007f8148017000.00007f814802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5496.1.00007f8148017000.00007f814802f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5489.1.00007f8148017000.00007f814802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5489.1.00007f8148017000.00007f814802f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5487.1.00007f8148017000.00007f814802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5487.1.00007f8148017000.00007f814802f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm7.elf PID: 5485	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.arm7.elf PID: 5485	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2b45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ba9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2be5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bf9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm7.elf PID: 5487	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.arm7.elf PID: 5487	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x38d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x390d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3921:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3935:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3949:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x395d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3971:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3985:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3999:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm7.elf PID: 5489	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.arm7.elf PID: 5489	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1172e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11742:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11756:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1176a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1177e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11792:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1180a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1181e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11832:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11846:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1185a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1186e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11882:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11896:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm7.elf PID: 5496	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.arm7.elf PID: 5496	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1901:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1915:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1929:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1951:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1965:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1979:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x198d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.arm7.elf	Virustotal: Detection: 36%			Perma Link
Source: Space.arm7.elf	ReversingLabs: Detection: 36%

Source: global traffic

TCP traffic: 192.168.2.13:48188 -> 89.169.4.44:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44
Source: unknown	TCP traffic detected without corresponding DNS query: 89.169.4.44

Source: Space.arm7.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5485.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5496.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5489.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5487.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm7.elf PID: 5485, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm7.elf PID: 5487, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm7.elf PID: 5489, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm7.elf PID: 5496, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 5485.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5496.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5489.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5487.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm7.elf PID: 5485, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm7.elf PID: 5487, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm7.elf PID: 5489, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm7.elf PID: 5496, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/3655/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/816/status	Jump to behavior
Source: /tmp/Space.arm7.elf (PID: 5485)	File opened: /proc/35/status	Jump to behavior

Source: Space.arm7.elf

Submission file: segment LOAD with 7.9743 entropy (max. 8.0)

Source: /tmp/Space.arm7.elf (PID: 5485)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.arm7.elf, 5485.1.0000564e8d7bd000.0000564e8da0b000.rw-.sdmp, Space.arm7.elf, 5487.1.0000564e8d7bd000.0000564e8d9eb000.rw-.sdmp, Space.arm7.elf, 5489.1.0000564e8d7bd000.0000564e8d9eb000.rw-.sdmp, Space.arm7.elf, 5496.1.0000564e8d7bd000.0000564e8da0b000.rw-.sdmp	Binary or memory string: NV!/etc/qemu-binfmt/arm
Source: Space.arm7.elf, 5485.1.0000564e8d7bd000.0000564e8da0b000.rw-.sdmp, Space.arm7.elf, 5487.1.0000564e8d7bd000.0000564e8d9eb000.rw-.sdmp, Space.arm7.elf, 5489.1.0000564e8d7bd000.0000564e8d9eb000.rw-.sdmp, Space.arm7.elf, 5496.1.0000564e8d7bd000.0000564e8da0b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Space.arm7.elf, 5485.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp, Space.arm7.elf, 5487.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp, Space.arm7.elf, 5489.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp, Space.arm7.elf, 5496.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Space.arm7.elf, 5485.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp, Space.arm7.elf, 5487.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp, Space.arm7.elf, 5489.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp, Space.arm7.elf, 5496.1.00007ffe9c2ce000.00007ffe9c2ef000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Space.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.arm7.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5485.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5487.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5485, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5487, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5496, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5485.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5487.1.00007f8148017000.00007f814802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5485, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5487, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.arm7.elf PID: 5496, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.arm7.elf	37%	Virustotal		Browse
Space.arm7.elf	37%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.arm7.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.169.4.44	unknown	Russian Federation		31514	INF-NET-ASRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.169.4.44	Space.i686.elf	Get hash	malicious	Mirai	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.spc.elf	Get hash	malicious	Mirai	Browse
	Space.x86_64.elf	Get hash	malicious	Mirai	Browse
	Space.mips.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Mirai	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	Space.sh4.elf	Get hash	malicious	Mirai	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INF-NET-ASRU	Space.i686.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.spc.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.x86_64.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.mips.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.x86.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.arm.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	Space.sh4.elf	Get hash	malicious	Mirai	Browse	89.169.4.44
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	89.169.156.74
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	87.228.10.139

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.984199715605501
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.arm7.elf
File size:	61'864 bytes
MD5:	2a3fee148c081e6d892f579b9638706a
SHA1:	f3e6164b6ecbc7c2ae1a56a4f85b66c93b050d62
SHA256:	e17eae56011f4f12044a1df31c1245b95ebfb01caf39fc9758f49594c1165cad
SHA512:	e8131117e17ac3913d8ce91f662dca1eca10a7965e204177c0b031ad10b62482c2fa00dc7e1d47d65f3d2cb6851c6541774cd626f7d89c9097fba5309fcd013d
SSDEEP:	1536:mVQgIB+iQv0pfhr5T3e2trLNM5Tfv83KJJSFkd:mVIB+iQv0pfbTO2trLeTX83Kckd
TLSH:	B5530251990F89F6E2715BF49CB1E907F66A6F74E851485010BCB22440F7A41B9BF387
File Content Preview:	.ELF..............(.........4...........4. ...(.....................u...u................6...6...6..................Q.td...............................OUPX!.........n...n......j..........?.E.h;....#..$...o....P.G.o.....X.*.V...g..HW.T.qh...4.8..!.G...ae..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x11c88
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xae75	0xae75	7.9743	0x5	R E	0x8000
LOAD	0x36c8	0x236c8	0x236c8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:02:18.359812975 CET	48188	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:18.479671955 CET	3778	48188	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:18.479743004 CET	48188	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:18.507966995 CET	48188	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:18.627741098 CET	3778	48188	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:18.628063917 CET	48188	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:18.747829914 CET	3778	48188	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:19.830612898 CET	3778	48188	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:19.831350088 CET	48188	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:19.831350088 CET	48188	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:19.832415104 CET	48190	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:19.952224970 CET	3778	48190	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:19.952359915 CET	48190	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:19.954313993 CET	48190	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:20.074068069 CET	3778	48190	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:20.077436924 CET	48190	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:20.197212934 CET	3778	48190	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:21.280900955 CET	3778	48190	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:21.281141043 CET	48190	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:21.281373978 CET	48190	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:21.282174110 CET	48192	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:21.401907921 CET	3778	48192	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:21.402185917 CET	48192	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:21.403340101 CET	48192	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:21.523222923 CET	3778	48192	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:21.523478985 CET	48192	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:21.643250942 CET	3778	48192	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:22.729376078 CET	3778	48192	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:22.729747057 CET	48192	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:22.729747057 CET	48192	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:22.730480909 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:22.851897955 CET	3778	48194	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:22.852077007 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:23.742994070 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:23.863275051 CET	3778	48194	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:23.863466024 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:23.864804029 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:23.984612942 CET	3778	48194	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:23.984848976 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:24.104794025 CET	3778	48194	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:24.519623995 CET	48196	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:24.639672995 CET	3778	48196	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:24.639734030 CET	48196	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:24.652507067 CET	48196	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:24.772450924 CET	3778	48196	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:24.772507906 CET	48196	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:24.892276049 CET	3778	48196	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:25.184535027 CET	3778	48194	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:25.184806108 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.184806108 CET	48194	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.185842991 CET	48198	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.305576086 CET	3778	48198	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:25.305685997 CET	48198	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.306930065 CET	48198	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.426829100 CET	3778	48198	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:25.426984072 CET	48198	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.546994925 CET	3778	48198	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:25.960161924 CET	3778	48196	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:25.960345984 CET	48196	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.960892916 CET	48196	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:25.961639881 CET	48200	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.152080059 CET	3778	48200	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:26.152277946 CET	48200	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.153795958 CET	48200	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.286900997 CET	3778	48200	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:26.287206888 CET	48200	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.407090902 CET	3778	48200	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:26.630991936 CET	3778	48198	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:26.631292105 CET	48198	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.631292105 CET	48198	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.632081985 CET	48202	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.751919985 CET	3778	48202	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:26.752046108 CET	48202	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.753422022 CET	48202	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.873265028 CET	3778	48202	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:26.873378038 CET	48202	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:26.993257046 CET	3778	48202	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:27.476319075 CET	3778	48200	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:27.476566076 CET	48200	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:27.476660013 CET	48200	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:27.477555037 CET	48204	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:27.597369909 CET	3778	48204	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:27.597517014 CET	48204	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:27.599220037 CET	48204	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:27.719139099 CET	3778	48204	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:27.719305992 CET	48204	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:27.839060068 CET	3778	48204	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:28.110647917 CET	3778	48202	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:28.110831976 CET	48202	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.111011982 CET	48202	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.112097979 CET	48206	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.231982946 CET	3778	48206	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:28.232240915 CET	48206	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.233931065 CET	48206	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.353796959 CET	3778	48206	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:28.353952885 CET	48206	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.473886013 CET	3778	48206	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:28.922424078 CET	3778	48204	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:28.922561884 CET	48204	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.922626972 CET	48204	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:28.923566103 CET	48208	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.043466091 CET	3778	48208	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:29.043704033 CET	48208	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.044708014 CET	48208	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.164462090 CET	3778	48208	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:29.164637089 CET	48208	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.284554005 CET	3778	48208	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:29.556497097 CET	3778	48206	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:29.556787968 CET	48206	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.556787968 CET	48206	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.557332039 CET	48210	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.677110910 CET	3778	48210	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:29.677331924 CET	48210	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.678293943 CET	48210	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.798928976 CET	3778	48210	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:29.799052954 CET	48210	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:29.918958902 CET	3778	48210	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:30.370609999 CET	3778	48208	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:30.370851994 CET	48208	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:30.370904922 CET	48208	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:30.371831894 CET	48212	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:30.491837025 CET	3778	48212	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:30.492041111 CET	48212	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:30.493273973 CET	48212	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:30.613212109 CET	3778	48212	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:30.613380909 CET	48212	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:30.733270884 CET	3778	48212	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:31.005112886 CET	3778	48210	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:31.005286932 CET	48210	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.005376101 CET	48210	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.006092072 CET	48214	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.126102924 CET	3778	48214	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:31.126219034 CET	48214	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.127258062 CET	48214	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.247107983 CET	3778	48214	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:31.247246981 CET	48214	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.367083073 CET	3778	48214	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:31.817022085 CET	3778	48212	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:31.817338943 CET	48212	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.817388058 CET	48212	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.818067074 CET	48216	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.937747002 CET	3778	48216	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:31.937944889 CET	48216	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:31.939527988 CET	48216	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.059351921 CET	3778	48216	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:32.059509039 CET	48216	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.179361105 CET	3778	48216	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:32.447915077 CET	3778	48214	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:32.448050022 CET	48214	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.448091984 CET	48214	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.448785067 CET	48218	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.568854094 CET	3778	48218	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:32.569025040 CET	48218	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.570079088 CET	48218	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.690069914 CET	3778	48218	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:32.690220118 CET	48218	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:32.810045004 CET	3778	48218	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:33.259474039 CET	3778	48216	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:33.259577036 CET	48216	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.259624004 CET	48216	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.260236025 CET	48220	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.380156994 CET	3778	48220	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:33.380302906 CET	48220	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.381597042 CET	48220	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.501410007 CET	3778	48220	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:33.501501083 CET	48220	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.621373892 CET	3778	48220	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:33.894012928 CET	3778	48218	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:33.894382000 CET	48218	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.894382000 CET	48218	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:33.894925117 CET	48222	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.014816046 CET	3778	48222	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:34.014980078 CET	48222	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.016324997 CET	48222	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.136193037 CET	3778	48222	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:34.136323929 CET	48222	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.256063938 CET	3778	48222	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:34.705344915 CET	3778	48220	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:34.705493927 CET	48220	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.705576897 CET	48220	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.706319094 CET	48224	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.826045990 CET	3778	48224	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:34.826159954 CET	48224	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.827416897 CET	48224	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:34.947123051 CET	3778	48224	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:34.947244883 CET	48224	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:35.066922903 CET	3778	48224	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:35.339200020 CET	3778	48222	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:35.339308023 CET	48222	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:35.339370012 CET	48222	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:35.340060949 CET	48226	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:35.459760904 CET	3778	48226	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:35.459894896 CET	48226	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:35.461128950 CET	48226	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:35.580848932 CET	3778	48226	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:35.580998898 CET	48226	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:35.700740099 CET	3778	48226	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:36.152972937 CET	3778	48224	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:36.153327942 CET	48224	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.153358936 CET	48224	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.154463053 CET	48228	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.274403095 CET	3778	48228	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:36.274703979 CET	48228	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.276048899 CET	48228	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.395821095 CET	3778	48228	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:36.396186113 CET	48228	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.516052961 CET	3778	48228	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:36.785353899 CET	3778	48226	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:36.785717010 CET	48226	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.785789967 CET	48226	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.786663055 CET	48230	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.906590939 CET	3778	48230	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:36.906800032 CET	48230	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:36.907946110 CET	48230	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.027596951 CET	3778	48230	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:37.027923107 CET	48230	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.147778988 CET	3778	48230	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:37.598880053 CET	3778	48228	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:37.599029064 CET	48228	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.599118948 CET	48228	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.599941015 CET	48232	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.719819069 CET	3778	48232	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:37.720072031 CET	48232	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.721055031 CET	48232	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.840816021 CET	3778	48232	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:37.840965033 CET	48232	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:37.961386919 CET	3778	48232	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:39.042525053 CET	3778	48232	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:39.042787075 CET	48232	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:39.042802095 CET	48232	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:39.043631077 CET	48234	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:39.163351059 CET	3778	48234	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:39.163574934 CET	48234	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:39.164652109 CET	48234	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:39.284800053 CET	3778	48234	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:39.284931898 CET	48234	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:39.404628038 CET	3778	48234	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:40.487685919 CET	3778	48234	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:40.487768888 CET	48234	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:40.487873077 CET	48234	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:40.488708019 CET	48236	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:40.608417988 CET	3778	48236	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:40.608565092 CET	48236	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:40.610225916 CET	48236	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:40.729971886 CET	3778	48236	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:40.730180979 CET	48236	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:40.849836111 CET	3778	48236	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:41.941320896 CET	3778	48236	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:41.941464901 CET	48236	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:41.941464901 CET	48236	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:41.941977978 CET	48238	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:42.061741114 CET	3778	48238	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:42.062021017 CET	48238	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:42.063528061 CET	48238	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:42.183317900 CET	3778	48238	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:42.183756113 CET	48238	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:42.303739071 CET	3778	48238	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:43.393831968 CET	3778	48238	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:43.394020081 CET	48238	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:43.394097090 CET	48238	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:43.394690990 CET	48240	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:43.514480114 CET	3778	48240	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:43.514585972 CET	48240	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:43.515724897 CET	48240	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:43.635406017 CET	3778	48240	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:43.635559082 CET	48240	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:43.755331039 CET	3778	48240	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:44.968938112 CET	3778	48240	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:44.969161987 CET	48240	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:44.969188929 CET	48240	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:44.970133066 CET	48242	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:45.078407049 CET	3778	48240	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:45.078551054 CET	48240	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:45.089785099 CET	3778	48242	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:45.089868069 CET	48242	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:45.091048002 CET	48242	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:45.210894108 CET	3778	48242	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:45.211211920 CET	48242	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:45.331084013 CET	3778	48242	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:46.421149015 CET	3778	48242	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:46.421287060 CET	48242	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:46.421375036 CET	48242	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:46.422027111 CET	48244	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:46.542066097 CET	3778	48244	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:46.542191982 CET	48244	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:46.543694973 CET	48244	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:46.663687944 CET	3778	48244	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:46.663805008 CET	48244	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:46.783885002 CET	3778	48244	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:46.918188095 CET	48230	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:47.037904024 CET	3778	48230	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:47.351653099 CET	3778	48230	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:47.351820946 CET	48230	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:47.862576962 CET	3778	48244	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:47.862888098 CET	48244	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:47.862889051 CET	48244	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:47.863662958 CET	48246	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:47.983422041 CET	3778	48246	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:47.983521938 CET	48246	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:47.985194921 CET	48246	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:48.105249882 CET	3778	48246	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:48.105341911 CET	48246	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:48.225085020 CET	3778	48246	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:49.308881998 CET	3778	48246	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:49.309236050 CET	48246	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:49.309322119 CET	48246	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:49.310112000 CET	48248	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:49.429924965 CET	3778	48248	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:49.430016041 CET	48248	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:49.431271076 CET	48248	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:49.551145077 CET	3778	48248	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:49.551275015 CET	48248	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:49.671174049 CET	3778	48248	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:50.782134056 CET	3778	48248	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:50.782390118 CET	48248	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:50.782390118 CET	48248	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:50.783231974 CET	48250	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:50.903347015 CET	3778	48250	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:50.903568029 CET	48250	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:50.905066013 CET	48250	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:51.024844885 CET	3778	48250	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:51.025031090 CET	48250	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:51.144803047 CET	3778	48250	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:52.224261999 CET	3778	48250	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:52.224533081 CET	48250	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:52.224642038 CET	48250	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:52.225647926 CET	48252	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:52.345478058 CET	3778	48252	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:52.345657110 CET	48252	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:52.347599030 CET	48252	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:52.467869997 CET	3778	48252	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:52.468035936 CET	48252	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:52.587913990 CET	3778	48252	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:53.670717001 CET	3778	48252	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:53.671207905 CET	48252	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:53.671309948 CET	48252	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:53.672281981 CET	48254	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:53.792038918 CET	3778	48254	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:53.792325020 CET	48254	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:53.794358969 CET	48254	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:53.914119959 CET	3778	48254	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:53.914216042 CET	48254	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:54.034415007 CET	3778	48254	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:55.113586903 CET	3778	48254	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:55.113804102 CET	48254	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:55.113804102 CET	48254	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:55.114662886 CET	48256	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:55.234446049 CET	3778	48256	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:55.234585047 CET	48256	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:55.236358881 CET	48256	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:55.356089115 CET	3778	48256	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:55.356256962 CET	48256	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:55.476254940 CET	3778	48256	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:56.562464952 CET	3778	48256	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:56.562618017 CET	48256	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:56.562858105 CET	48256	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:56.563828945 CET	48258	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:56.683698893 CET	3778	48258	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:56.683860064 CET	48258	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:56.685128927 CET	48258	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:56.804877043 CET	3778	48258	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:56.805042028 CET	48258	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:56.925028086 CET	3778	48258	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:58.006804943 CET	3778	48258	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:58.007009029 CET	48258	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:58.007153034 CET	48258	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:58.007972002 CET	48260	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:58.127928972 CET	3778	48260	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:58.128299952 CET	48260	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:58.130223036 CET	48260	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:58.250135899 CET	3778	48260	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:58.250288963 CET	48260	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:58.370120049 CET	3778	48260	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:59.461363077 CET	3778	48260	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:59.461510897 CET	48260	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:59.461607933 CET	48260	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:59.462564945 CET	48262	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:59.582564116 CET	3778	48262	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:59.582745075 CET	48262	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:59.584707022 CET	48262	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:59.705138922 CET	3778	48262	89.169.4.44	192.168.2.13
Dec 16, 2024 09:02:59.705621004 CET	48262	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:02:59.825544119 CET	3778	48262	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:00.903956890 CET	3778	48262	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:00.904155016 CET	48262	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:00.904275894 CET	48262	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:00.905287027 CET	48264	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:01.025476933 CET	3778	48264	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:01.025600910 CET	48264	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:01.026981115 CET	48264	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:01.146740913 CET	3778	48264	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:01.146851063 CET	48264	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:01.266679049 CET	3778	48264	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:02.347384930 CET	3778	48264	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:02.347594023 CET	48264	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:02.347683907 CET	48264	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:02.348198891 CET	48266	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:02.468067884 CET	3778	48266	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:02.468199015 CET	48266	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:02.469887972 CET	48266	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:02.589749098 CET	3778	48266	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:02.589896917 CET	48266	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:02.709685087 CET	3778	48266	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:03.792454958 CET	3778	48266	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:03.792650938 CET	48266	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:03.792867899 CET	48266	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:03.793720007 CET	48268	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:03.913723946 CET	3778	48268	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:03.914005041 CET	48268	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:03.915328026 CET	48268	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:04.035564899 CET	3778	48268	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:04.035850048 CET	48268	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:04.155950069 CET	3778	48268	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:05.248231888 CET	3778	48268	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:05.248485088 CET	48268	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:05.248584032 CET	48268	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:05.249371052 CET	48270	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:05.369117022 CET	3778	48270	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:05.369223118 CET	48270	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:05.370820045 CET	48270	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:05.490612030 CET	3778	48270	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:05.490709066 CET	48270	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:05.610568047 CET	3778	48270	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:06.735358000 CET	3778	48270	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:06.735486031 CET	48270	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:06.735712051 CET	48270	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:06.736592054 CET	48272	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:06.857613087 CET	3778	48272	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:06.857764959 CET	48272	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:06.859446049 CET	48272	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:06.979269028 CET	3778	48272	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:06.979434967 CET	48272	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:07.099225044 CET	3778	48272	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:08.178937912 CET	3778	48272	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:08.179073095 CET	48272	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:08.179330111 CET	48272	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:08.180254936 CET	48274	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:08.300086975 CET	3778	48274	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:08.300226927 CET	48274	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:08.301764965 CET	48274	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:08.421665907 CET	3778	48274	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:08.421930075 CET	48274	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:08.541671991 CET	3778	48274	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:09.668687105 CET	3778	48274	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:09.669043064 CET	48274	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:09.669085979 CET	48274	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:09.669930935 CET	48276	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:09.789763927 CET	3778	48276	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:09.789931059 CET	48276	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:09.791702032 CET	48276	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:09.911501884 CET	3778	48276	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:09.911645889 CET	48276	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:10.031408072 CET	3778	48276	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:11.116266012 CET	3778	48276	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:11.116549969 CET	48276	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:11.116616011 CET	48276	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:11.117296934 CET	48278	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:11.237092018 CET	3778	48278	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:11.237297058 CET	48278	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:11.238883972 CET	48278	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:11.358763933 CET	3778	48278	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:11.358899117 CET	48278	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:11.478671074 CET	3778	48278	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:12.561582088 CET	3778	48278	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:12.561795950 CET	48278	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:12.561906099 CET	48278	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:12.563061953 CET	48280	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:12.683015108 CET	3778	48280	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:12.683382988 CET	48280	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:12.684942961 CET	48280	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:12.804764032 CET	3778	48280	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:12.804940939 CET	48280	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:12.924748898 CET	3778	48280	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:14.010546923 CET	3778	48280	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:14.010699987 CET	48280	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:14.010734081 CET	48280	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:14.011219978 CET	48282	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:14.130913973 CET	3778	48282	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:14.131228924 CET	48282	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:14.132025957 CET	48282	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:14.251719952 CET	3778	48282	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:14.251868010 CET	48282	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:14.371664047 CET	3778	48282	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:15.452801943 CET	3778	48282	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:15.453114033 CET	48282	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:15.453151941 CET	48282	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:15.453711033 CET	48284	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:15.573694944 CET	3778	48284	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:15.574012041 CET	48284	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:15.574748039 CET	48284	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:15.694407940 CET	3778	48284	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:15.694746971 CET	48284	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:15.814472914 CET	3778	48284	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:16.899707079 CET	3778	48284	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:16.899895906 CET	48284	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:16.899976969 CET	48284	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:16.901040077 CET	48286	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:17.020842075 CET	3778	48286	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:17.021070004 CET	48286	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:17.022784948 CET	48286	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:17.142512083 CET	3778	48286	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:17.142654896 CET	48286	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:17.262392044 CET	3778	48286	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:18.375803947 CET	3778	48286	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:18.376029968 CET	48286	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:18.376106977 CET	48286	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:18.377099037 CET	48288	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:18.496902943 CET	3778	48288	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:18.497068882 CET	48288	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:18.498936892 CET	48288	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:18.618937016 CET	3778	48288	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:18.619052887 CET	48288	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:18.738878012 CET	3778	48288	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:19.824382067 CET	3778	48288	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:19.824609995 CET	48288	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:19.824691057 CET	48288	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:19.825592041 CET	48290	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:19.945420980 CET	3778	48290	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:19.945559025 CET	48290	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:19.946980953 CET	48290	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:20.066752911 CET	3778	48290	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:20.066895008 CET	48290	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:20.186914921 CET	3778	48290	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:21.271380901 CET	3778	48290	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:21.271509886 CET	48290	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:21.271570921 CET	48290	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:21.272361040 CET	48292	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:21.393702030 CET	3778	48292	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:21.393810987 CET	48292	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:21.394892931 CET	48292	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:21.515408039 CET	3778	48292	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:21.515548944 CET	48292	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:21.635380030 CET	3778	48292	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:22.739820004 CET	3778	48292	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:22.739994049 CET	48292	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:22.740046024 CET	48292	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:22.741055965 CET	48294	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:22.860954046 CET	3778	48294	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:22.861124992 CET	48294	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:22.861903906 CET	48294	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:22.981805086 CET	3778	48294	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:22.981928110 CET	48294	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:23.101854086 CET	3778	48294	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:24.180879116 CET	3778	48294	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:24.181219101 CET	48294	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:24.181219101 CET	48294	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:24.181680918 CET	48296	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:24.301506042 CET	3778	48296	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:24.301887035 CET	48296	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:24.303184032 CET	48296	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:24.422914028 CET	3778	48296	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:24.423124075 CET	48296	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:24.543013096 CET	3778	48296	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:25.628313065 CET	3778	48296	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:25.628525019 CET	48296	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:25.628612995 CET	48296	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:25.629645109 CET	48298	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:25.750458002 CET	3778	48298	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:25.750629902 CET	48298	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:25.752475023 CET	48298	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:25.872231960 CET	3778	48298	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:25.872328043 CET	48298	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:25.992232084 CET	3778	48298	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:27.069247007 CET	3778	48298	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:27.069391012 CET	48298	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:27.069483042 CET	48298	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:27.070557117 CET	48300	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:27.190481901 CET	3778	48300	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:27.190608978 CET	48300	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:27.192197084 CET	48300	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:27.312118053 CET	3778	48300	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:27.312262058 CET	48300	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:27.432120085 CET	3778	48300	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:28.514717102 CET	3778	48300	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:28.514894009 CET	48300	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:28.514930964 CET	48300	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:28.515933990 CET	48302	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:28.635895014 CET	3778	48302	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:28.636239052 CET	48302	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:28.637427092 CET	48302	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:28.757411957 CET	3778	48302	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:28.757596970 CET	48302	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:28.877536058 CET	3778	48302	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:29.965230942 CET	3778	48302	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:29.965517998 CET	48302	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:29.965590000 CET	48302	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:29.966458082 CET	48304	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:30.086261988 CET	3778	48304	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:30.086504936 CET	48304	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:30.087477922 CET	48304	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:30.207881927 CET	3778	48304	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:30.207990885 CET	48304	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:30.327989101 CET	3778	48304	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:31.411957026 CET	3778	48304	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:31.412158966 CET	48304	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:31.412252903 CET	48304	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:31.413063049 CET	48306	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:31.532888889 CET	3778	48306	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:31.533092022 CET	48306	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:31.534885883 CET	48306	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:31.654884100 CET	3778	48306	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:31.655057907 CET	48306	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:31.775118113 CET	3778	48306	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:32.872802973 CET	3778	48306	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:32.873035908 CET	48306	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:32.873136044 CET	48306	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:32.874064922 CET	48308	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:32.994060993 CET	3778	48308	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:32.994251966 CET	48308	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:32.995676994 CET	48308	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:33.115437984 CET	3778	48308	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:33.115611076 CET	48308	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:33.235419035 CET	3778	48308	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:34.317576885 CET	3778	48308	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:34.317713022 CET	48308	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:34.317805052 CET	48308	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:34.318744898 CET	48310	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:34.438512087 CET	3778	48310	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:34.438690901 CET	48310	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:34.439846039 CET	48310	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:34.559755087 CET	3778	48310	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:34.559928894 CET	48310	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:34.679976940 CET	3778	48310	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:44.450095892 CET	48310	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:44.569863081 CET	3778	48310	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:44.882433891 CET	3778	48310	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:44.882662058 CET	48310	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:47.406902075 CET	48230	3778	192.168.2.13	89.169.4.44
Dec 16, 2024 09:03:47.526818037 CET	3778	48230	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:47.841119051 CET	3778	48230	89.169.4.44	192.168.2.13
Dec 16, 2024 09:03:47.841382980 CET	48230	3778	192.168.2.13	89.169.4.44

System Behavior

Analysis Process: Space.arm7.elf PID: 5485, Parent PID: 5404

General

Start time (UTC):	08:02:16
Start date (UTC):	16/12/2024
Path:	/tmp/Space.arm7.elf
Arguments:	/tmp/Space.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5487, Parent PID: 5485

General

Start time (UTC):	08:02:17
Start date (UTC):	16/12/2024
Path:	/tmp/Space.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5489, Parent PID: 5487

General

Start time (UTC):	08:02:17
Start date (UTC):	16/12/2024
Path:	/tmp/Space.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5491, Parent PID: 5487

General

Start time (UTC):	08:02:17
Start date (UTC):	16/12/2024
Path:	/tmp/Space.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5496, Parent PID: 5485

General

Start time (UTC):	08:02:23
Start date (UTC):	16/12/2024
Path:	/tmp/Space.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5498, Parent PID: 5485

General

Start time (UTC):	08:02:23
Start date (UTC):	16/12/2024
Path:	/tmp/Space.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.arm7.elf PID: 5485, Parent PID: 5404

General

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5487, Parent PID: 5485

General

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5489, Parent PID: 5487

General

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5491, Parent PID: 5487

General

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5496, Parent PID: 5485

General

Chronological Activities

Analysis Process: Space.arm7.elf PID: 5498, Parent PID: 5485

General

Chronological Activities

Linux Analysis Report
Space.arm7.elf