Edit tour

Linux Analysis Report
Space.m68k.elf

Overview

General Information

Sample name:	Space.m68k.elf
Analysis ID:	1579473
MD5:	929ac590fa87f77ff3df5e84a1398847
SHA1:	b933129df6cfd7f7b7e5eaad60f40068d2826161
SHA256:	d146ac6fb1cb18333d96ba26dcc4b14390c11d2f0afa29f2cfe81b5ccf3916e4
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579473
Start date and time:	2024-12-22 15:41:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.m68k.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.m68k.elf
PID:	5493
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.m68k.elf (PID: 5493, Parent: 5416, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/Space.m68k.elf

Space.m68k.elf New Fork (PID: 5495, Parent: 5493)

Space.m68k.elf New Fork (PID: 5497, Parent: 5495)

Space.m68k.elf New Fork (PID: 5499, Parent: 5495)

Space.m68k.elf New Fork (PID: 5513, Parent: 5493)

Space.m68k.elf New Fork (PID: 5515, Parent: 5493)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Space.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Space.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5493.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5493.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5497.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5497.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5495.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5495.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5513.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5513.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11cc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11db3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ddb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11def:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.m68k.elf PID: 5493	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.m68k.elf PID: 5493	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.m68k.elf PID: 5495	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.m68k.elf PID: 5495	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x605c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6070:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6084:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6098:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x614c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6174:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6188:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x619c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x61b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x61c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x61d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x61ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.m68k.elf PID: 5497	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.m68k.elf PID: 5497	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x177f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1833:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1847:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1883:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.m68k.elf PID: 5513	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.m68k.elf PID: 5513	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb766:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb77a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb78e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb806:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb81a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb82e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb842:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb856:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb86a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb87e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb892:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Space.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Space.m68k.elf	Virustotal: Detection: 60%			Perma Link
Source: Space.m68k.elf	ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.14:54616 -> 89.213.158.208:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208

System Summary

Malicious sample detected (through community Yara rule)

Source: Space.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5493.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5497.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5495.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5513.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.m68k.elf PID: 5493, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.m68k.elf PID: 5495, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.m68k.elf PID: 5497, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.m68k.elf PID: 5513, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/net/tcp.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc/proc/proc/%d/exe/proc/%s/statusName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog89.213.158.208

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Space.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5493.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5497.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5495.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5513.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.m68k.elf PID: 5493, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.m68k.elf PID: 5495, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.m68k.elf PID: 5497, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.m68k.elf PID: 5513, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3760/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3761/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1583/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/2672/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1577/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1593/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3094/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3406/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1589/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3402/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3762/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3763/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/806/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/807/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/928/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/135/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/3412/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/1371/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Space.m68k.elf (PID: 5493)	File opened: /proc/262/status	Jump to behavior

Source: /tmp/Space.m68k.elf (PID: 5493)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.m68k.elf, 5493.1.0000559e189cf000.0000559e18a54000.rw-.sdmp, Space.m68k.elf, 5495.1.0000559e189cf000.0000559e18a54000.rw-.sdmp, Space.m68k.elf, 5497.1.0000559e189cf000.0000559e18a54000.rw-.sdmp, Space.m68k.elf, 5513.1.0000559e189cf000.0000559e18a54000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: Space.m68k.elf, 5493.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp, Space.m68k.elf, 5495.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp, Space.m68k.elf, 5497.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp, Space.m68k.elf, 5513.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp	Binary or memory string: dx86_64/usr/bin/qemu-m68k/tmp/Space.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.m68k.elf
Source: Space.m68k.elf, 5493.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp, Space.m68k.elf, 5495.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp, Space.m68k.elf, 5497.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp, Space.m68k.elf, 5513.1.00007ffd2b35f000.00007ffd2b380000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: Space.m68k.elf, 5493.1.0000559e189cf000.0000559e18a54000.rw-.sdmp, Space.m68k.elf, 5495.1.0000559e189cf000.0000559e18a54000.rw-.sdmp, Space.m68k.elf, 5497.1.0000559e189cf000.0000559e18a54000.rw-.sdmp, Space.m68k.elf, 5513.1.0000559e189cf000.0000559e18a54000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Space.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5493.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5513.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5493, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5495, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5497, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5513, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Space.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5493.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5497.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5513.1.00007fd5ac001000.00007fd5ac016000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5493, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5495, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5497, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.m68k.elf PID: 5513, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.m68k.elf	60%	Virustotal		Browse
Space.m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
Space.m68k.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.213.158.208	unknown	United Kingdom		8851	EDGEtaGCIComGB	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EDGEtaGCIComGB	ppc.elf	Get hash	malicious	Mirai	Browse	77.107.120.29
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	89.213.109.95
	1.elf	Get hash	malicious	Unknown	Browse	89.213.55.225
	wi86CSarYC.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	UFh7A8CImG.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	nSORtPkIOR.msi	Get hash	malicious	DanaBot	Browse	213.210.13.4
	cloudflare.msi	Get hash	malicious	DanaBot	Browse	213.210.13.4
	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73
	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	185.49.126.73

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.29575593296095
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.m68k.elf
File size:	84'960 bytes
MD5:	929ac590fa87f77ff3df5e84a1398847
SHA1:	b933129df6cfd7f7b7e5eaad60f40068d2826161
SHA256:	d146ac6fb1cb18333d96ba26dcc4b14390c11d2f0afa29f2cfe81b5ccf3916e4
SHA512:	82068fadfb467f38b110638a3dea4ad4c3581b91eb893102722886b45a870beb1547812274ecd8fe0bebe9c0f45ae0301e3303b659ae9c037b2b4834a72f1db2
SSDEEP:	1536:fQijxmw2V2xAsV8eZoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7Ian:fQi4gZsd9lJP4npeqp+psrbIan
TLSH:	B483199BF800DDBDF80FD6B74463490EB931E3910A931A377767BD53AC721A14826E85
File Content Preview:	.ELF.......................D...4..JP.....4. ...(......................F...F....... .......F...f...f....l..(\...... .dt.Q............................NV..a....da....4N^NuNV..J9..j.f>"y..f. QJ.g.X.#...f.N."y..f. QJ.f.A.....J.g.Hy..F.N.X.......j.N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	84560
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x11b5e	0x0	0x6	AX	4
.fini	PROGBITS	0x80011c06	0x11c06	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x80011c14	0x11c14	0x2a8a	0x0	0x2	A	2
.ctors	PROGBITS	0x800166a4	0x146a4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x800166ac	0x146ac	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800166b8	0x146b8	0x358	0x0	0x3	WA	4
.bss	NOBITS	0x80016a10	0x14a10	0x24f0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x14a10	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1469e	0x1469e	6.3260	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x146a4	0x800166a4	0x800166a4	0x36c	0x285c	2.8711	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 15:42:02.059166908 CET	54616	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:02.179290056 CET	3778	54616	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:02.179353952 CET	54616	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:02.220155001 CET	54616	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:02.340014935 CET	3778	54616	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:02.340065956 CET	54616	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:02.460048914 CET	3778	54616	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:04.684108019 CET	3778	54616	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:04.684247971 CET	54616	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:04.684456110 CET	54616	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:04.685025930 CET	54618	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:04.805938005 CET	3778	54618	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:04.806262970 CET	54618	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:04.807003975 CET	54618	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:04.927166939 CET	3778	54618	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:04.927352905 CET	54618	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:05.049767017 CET	3778	54618	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:07.782702923 CET	54620	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:07.903084993 CET	3778	54620	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:07.903163910 CET	54620	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:07.906498909 CET	54620	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.026767015 CET	3778	54620	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:08.026940107 CET	54620	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.147011995 CET	3778	54620	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:08.159392118 CET	3778	54618	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:08.159516096 CET	54618	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.159553051 CET	54618	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.160337925 CET	54622	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.285002947 CET	3778	54622	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:08.285845995 CET	54622	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.286778927 CET	54622	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.413590908 CET	3778	54622	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:08.413819075 CET	54622	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:08.535531998 CET	3778	54622	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:09.330094099 CET	3778	54620	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:09.330353975 CET	54620	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:09.330400944 CET	54620	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:09.330873966 CET	54624	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:09.451241970 CET	3778	54624	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:09.451466084 CET	54624	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:09.452105045 CET	54624	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:09.573998928 CET	3778	54624	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:09.574083090 CET	54624	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:09.694025993 CET	3778	54624	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:10.602431059 CET	3778	54622	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:10.602678061 CET	54622	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:10.602678061 CET	54622	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:10.603317022 CET	54626	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:10.723177910 CET	3778	54626	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:10.723259926 CET	54626	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:10.724092960 CET	54626	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:10.844270945 CET	3778	54626	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:10.844408035 CET	54626	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:10.964602947 CET	3778	54626	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:12.655431032 CET	3778	54626	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:12.655644894 CET	54626	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:12.655644894 CET	54626	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:12.656193972 CET	54628	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:12.776165009 CET	3778	54628	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:12.776412010 CET	54628	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:12.777479887 CET	54628	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:12.897706985 CET	3778	54628	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:12.897831917 CET	54628	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:13.017844915 CET	3778	54628	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:13.618933916 CET	3778	54624	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:13.619061947 CET	54624	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:13.619096041 CET	54624	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:13.619544029 CET	54630	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:13.739953041 CET	3778	54630	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:13.740108013 CET	54630	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:13.740817070 CET	54630	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:13.860766888 CET	3778	54630	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:13.860965014 CET	54630	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:13.984016895 CET	3778	54630	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:14.063736916 CET	3778	54628	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:14.063970089 CET	54628	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:14.063970089 CET	54628	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:14.064256907 CET	54632	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:14.184262991 CET	3778	54632	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:14.184371948 CET	54632	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:14.185211897 CET	54632	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:14.306760073 CET	3778	54632	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:14.306832075 CET	54632	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:14.426640034 CET	3778	54632	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:16.607481956 CET	3778	54630	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:16.607611895 CET	3778	54632	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:16.607634068 CET	54630	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.607705116 CET	54630	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.607753992 CET	54632	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.607753992 CET	54632	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.608381033 CET	54634	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.608586073 CET	54636	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.847435951 CET	3778	54634	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:16.847469091 CET	3778	54636	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:16.847568989 CET	54634	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.847656012 CET	54636	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.848885059 CET	54636	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.848974943 CET	54634	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.969988108 CET	3778	54636	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:16.970063925 CET	3778	54634	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:16.970115900 CET	54636	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:16.970128059 CET	54634	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:17.089827061 CET	3778	54634	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:17.089842081 CET	3778	54636	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.413108110 CET	3778	54634	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.413238049 CET	54634	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.413273096 CET	54634	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.413925886 CET	54638	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.426152945 CET	3778	54636	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.426326036 CET	54636	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.426425934 CET	54636	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.426886082 CET	54640	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.534976959 CET	3778	54638	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.535079956 CET	54638	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.536214113 CET	54638	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.653788090 CET	3778	54640	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.654014111 CET	54640	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.655421972 CET	54640	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.655802965 CET	3778	54638	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.656008005 CET	54638	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.779742956 CET	3778	54640	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.779814005 CET	54640	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:20.780359983 CET	3778	54638	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:20.900810957 CET	3778	54640	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.518376112 CET	3778	54640	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.518392086 CET	3778	54638	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.518518925 CET	54640	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.518619061 CET	54638	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.518619061 CET	54638	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.518656969 CET	54640	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.519349098 CET	54642	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.519748926 CET	54644	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.698487997 CET	3778	54642	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.698527098 CET	3778	54644	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.698589087 CET	54644	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.698599100 CET	54642	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.700519085 CET	54644	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.700644016 CET	54642	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.820271969 CET	3778	54644	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.820287943 CET	3778	54642	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.820347071 CET	54644	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.820388079 CET	54642	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:22.940432072 CET	3778	54644	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:22.940474987 CET	3778	54642	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.332995892 CET	3778	54642	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.333014011 CET	3778	54644	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.333123922 CET	54644	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.333152056 CET	54642	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.333167076 CET	54644	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.333178043 CET	54642	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.333904028 CET	54646	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.334120989 CET	54648	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.455461979 CET	3778	54646	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.455539942 CET	54646	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.455722094 CET	3778	54648	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.455806971 CET	54648	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.456829071 CET	54646	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.457139015 CET	54648	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.576271057 CET	3778	54646	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.576349974 CET	54646	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.576612949 CET	3778	54648	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.576817036 CET	54648	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:24.697866917 CET	3778	54646	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:24.698138952 CET	3778	54648	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:26.997497082 CET	3778	54648	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:26.997514963 CET	3778	54646	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:26.997589111 CET	54646	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:26.997631073 CET	54646	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:26.997636080 CET	54648	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:26.997636080 CET	54648	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:26.998481035 CET	54650	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:26.998647928 CET	54652	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:27.118073940 CET	3778	54650	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:27.118098974 CET	3778	54652	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:27.118170023 CET	54652	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:27.118298054 CET	54650	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:27.120136023 CET	54652	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:27.120342016 CET	54650	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:27.239778996 CET	3778	54652	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:27.239850998 CET	54652	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:27.239907026 CET	3778	54650	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:27.240040064 CET	54650	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:27.362637043 CET	3778	54652	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:27.362665892 CET	3778	54650	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.543414116 CET	3778	54652	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.543514967 CET	3778	54650	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.543663025 CET	54650	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.543680906 CET	54652	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.543720961 CET	54652	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.543837070 CET	54650	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.544579983 CET	54654	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.544938087 CET	54656	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.664529085 CET	3778	54654	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.664593935 CET	54654	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.664978981 CET	3778	54656	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.665199041 CET	54656	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.665868044 CET	54654	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.666728020 CET	54656	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.785960913 CET	3778	54654	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.786047935 CET	54654	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.786780119 CET	3778	54656	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.786951065 CET	54656	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:30.910001040 CET	3778	54654	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:30.910867929 CET	3778	54656	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:32.821538925 CET	3778	54656	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:32.821624994 CET	3778	54654	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:32.821732044 CET	54654	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.821764946 CET	54654	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.821851015 CET	54656	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.821851015 CET	54656	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.822377920 CET	54658	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.822568893 CET	54660	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.942887068 CET	3778	54658	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:32.942903042 CET	3778	54660	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:32.942980051 CET	54660	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.943142891 CET	54658	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.944484949 CET	54658	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:32.944627047 CET	54660	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:33.064671040 CET	3778	54658	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:33.064785957 CET	54658	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:33.064832926 CET	3778	54660	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:33.064893961 CET	54660	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:33.184417009 CET	3778	54658	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:33.184441090 CET	3778	54660	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.445606947 CET	3778	54658	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.445640087 CET	3778	54660	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.445734978 CET	54660	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.445857048 CET	54660	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.445857048 CET	54658	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.445857048 CET	54658	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.446465969 CET	54662	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.446670055 CET	54664	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.566191912 CET	3778	54662	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.566211939 CET	3778	54664	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.566271067 CET	54662	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.566421986 CET	54664	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.567749023 CET	54662	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.567873001 CET	54664	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.687339067 CET	3778	54662	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.687407017 CET	3778	54664	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.687433958 CET	54662	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.687632084 CET	54664	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:35.807248116 CET	3778	54662	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:35.807298899 CET	3778	54664	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.240109921 CET	3778	54664	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.240350008 CET	54664	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.240350962 CET	54664	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.240552902 CET	3778	54662	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.240622044 CET	54662	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.240665913 CET	54662	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.241296053 CET	54666	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.241592884 CET	54668	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.479698896 CET	3778	54666	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.479732037 CET	3778	54668	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.479824066 CET	54666	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.479885101 CET	54668	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.482311010 CET	54668	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.482491970 CET	54666	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.601988077 CET	3778	54668	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.602121115 CET	54668	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.602168083 CET	3778	54666	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.602269888 CET	54666	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:37.721563101 CET	3778	54668	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:37.721806049 CET	3778	54666	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.448786974 CET	3778	54668	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.448883057 CET	3778	54666	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.448977947 CET	54666	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.449009895 CET	54666	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.449084044 CET	54668	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.449213982 CET	54668	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.449615955 CET	54670	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.450373888 CET	54672	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.588856936 CET	3778	54670	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.588942051 CET	54670	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.588972092 CET	3778	54672	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.589072943 CET	54672	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.590112925 CET	54670	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.590415001 CET	54672	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.710264921 CET	3778	54670	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.710314035 CET	3778	54672	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.710359097 CET	54670	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.710444927 CET	54672	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:40.832560062 CET	3778	54670	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:40.832736015 CET	3778	54672	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.110179901 CET	3778	54670	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.110245943 CET	3778	54672	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.110280037 CET	54670	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.110316038 CET	54672	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.110326052 CET	54670	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.110435963 CET	54672	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.111526012 CET	54674	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.111855984 CET	54676	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.343708038 CET	3778	54674	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.343846083 CET	3778	54676	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.344012022 CET	54676	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.344079971 CET	54674	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.346395969 CET	54674	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.346704960 CET	54676	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.466131926 CET	3778	54674	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.466363907 CET	54674	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.466566086 CET	3778	54676	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.466667891 CET	54676	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:42.586462021 CET	3778	54674	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:42.586486101 CET	3778	54676	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.364681959 CET	3778	54676	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.364715099 CET	3778	54674	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.364800930 CET	54676	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.364834070 CET	54676	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.364840984 CET	54674	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.364927053 CET	54674	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.365663052 CET	54678	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.365951061 CET	54680	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.485354900 CET	3778	54678	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.485414028 CET	3778	54680	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.485496998 CET	54680	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.485598087 CET	54678	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.487183094 CET	54678	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.487567902 CET	54680	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.606758118 CET	3778	54678	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.607096910 CET	54678	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.607393026 CET	3778	54680	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.607460022 CET	54680	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:45.727492094 CET	3778	54678	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:45.727540016 CET	3778	54680	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.522670031 CET	3778	54680	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.522696018 CET	3778	54678	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.522772074 CET	54680	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.522809982 CET	54680	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.523139000 CET	54678	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.523139954 CET	54678	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.523719072 CET	54682	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.523978949 CET	54684	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.649168015 CET	3778	54682	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.649266005 CET	3778	54684	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.649326086 CET	54682	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.649343014 CET	54684	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.651104927 CET	54684	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.651300907 CET	54682	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.770677090 CET	3778	54684	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.770800114 CET	3778	54682	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.770910978 CET	54684	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.770984888 CET	54682	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:48.891424894 CET	3778	54684	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:48.891446114 CET	3778	54682	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.126913071 CET	3778	54682	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.126945019 CET	3778	54684	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.127160072 CET	54684	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.127173901 CET	54682	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.127250910 CET	54684	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.127418041 CET	54682	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.128443003 CET	54686	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.128767967 CET	54688	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.247942924 CET	3778	54686	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.248236895 CET	54686	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.249439955 CET	54686	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.342612982 CET	3778	54688	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.342888117 CET	54688	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.344183922 CET	54688	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.368951082 CET	3778	54686	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.369334936 CET	54686	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.463835001 CET	3778	54688	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.464050055 CET	54688	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:52.488835096 CET	3778	54686	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:52.585344076 CET	3778	54688	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:53.955023050 CET	3778	54688	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:53.955360889 CET	54688	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:53.955518961 CET	54688	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:53.956192017 CET	54690	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:53.958148956 CET	3778	54686	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:53.958261013 CET	54686	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:53.958302021 CET	54686	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:53.958800077 CET	54692	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:54.076386929 CET	3778	54690	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:54.076575041 CET	54690	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:54.077789068 CET	54690	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:54.079428911 CET	3778	54692	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:54.079685926 CET	54692	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:54.080492973 CET	54692	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:54.197756052 CET	3778	54690	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:54.197890997 CET	54690	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:54.200257063 CET	3778	54692	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:54.200373888 CET	54692	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:54.317750931 CET	3778	54690	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:54.320791006 CET	3778	54692	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.304831982 CET	3778	54692	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.304898977 CET	3778	54690	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.305052996 CET	54690	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.305064917 CET	54692	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.305082083 CET	54690	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.305191040 CET	54692	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.305574894 CET	54694	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.306260109 CET	54696	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.425800085 CET	3778	54694	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.426019907 CET	54694	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.427206993 CET	54694	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.487212896 CET	3778	54696	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.487332106 CET	54696	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.488368034 CET	54696	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.546983957 CET	3778	54694	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.547168016 CET	54694	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.609186888 CET	3778	54696	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.609288931 CET	54696	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:56.666837931 CET	3778	54694	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:56.729091883 CET	3778	54696	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.320997000 CET	3778	54694	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.321028948 CET	3778	54696	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.321156025 CET	54696	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.321183920 CET	54696	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.321296930 CET	54694	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.321540117 CET	54694	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.321662903 CET	54698	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.322436094 CET	54700	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.560611963 CET	3778	54698	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.560658932 CET	3778	54700	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.560806036 CET	54700	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.560884953 CET	54698	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.563003063 CET	54698	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.563138962 CET	54700	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.682832956 CET	3778	54698	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.682879925 CET	3778	54700	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.682939053 CET	54698	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.682959080 CET	54700	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:42:59.803133011 CET	3778	54698	89.213.158.208	192.168.2.14
Dec 22, 2024 15:42:59.803242922 CET	3778	54700	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.269027948 CET	3778	54698	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.269114017 CET	3778	54700	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.269217968 CET	54698	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.269293070 CET	54700	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.269294024 CET	54700	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.269299030 CET	54698	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.269768953 CET	54702	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.270528078 CET	54704	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.391113043 CET	3778	54702	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.391499996 CET	54702	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.391851902 CET	54702	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.392404079 CET	3778	54704	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.392628908 CET	54704	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.393116951 CET	54704	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.511629105 CET	3778	54702	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.511740923 CET	54702	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.512788057 CET	3778	54704	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.512856960 CET	54704	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:02.631561995 CET	3778	54702	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:02.632652998 CET	3778	54704	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:04.715358019 CET	3778	54702	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:04.715393066 CET	3778	54704	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:04.715512991 CET	54702	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.715519905 CET	54704	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.715564966 CET	54702	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.715713978 CET	54704	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.716619968 CET	54706	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.716799021 CET	54708	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.956410885 CET	3778	54706	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:04.956460953 CET	3778	54708	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:04.956535101 CET	54708	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.956628084 CET	54706	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.958300114 CET	54708	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:04.958436012 CET	54706	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:05.078493118 CET	3778	54708	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:05.078538895 CET	3778	54706	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:05.078572989 CET	54708	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:05.078705072 CET	54706	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:05.199044943 CET	3778	54708	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:05.199090958 CET	3778	54706	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:06.533881903 CET	3778	54706	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:06.533941031 CET	3778	54708	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:06.534063101 CET	54708	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.534126043 CET	54708	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.534106016 CET	54706	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.534203053 CET	54706	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.534888983 CET	54710	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.535152912 CET	54712	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.773955107 CET	3778	54710	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:06.773987055 CET	3778	54712	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:06.774100065 CET	54712	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.774225950 CET	54710	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.776230097 CET	54710	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.776608944 CET	54712	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.896034956 CET	3778	54710	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:06.896122932 CET	54710	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:06.896365881 CET	3778	54712	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:06.896507025 CET	54712	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:07.015737057 CET	3778	54710	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:07.015985012 CET	3778	54712	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.023013115 CET	3778	54710	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.023047924 CET	3778	54712	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.023129940 CET	54710	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.023289919 CET	54710	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.023299932 CET	54712	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.023538113 CET	54712	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.024188042 CET	54714	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.024410009 CET	54716	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.143961906 CET	3778	54714	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.144184113 CET	54714	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.145523071 CET	54714	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.264492035 CET	3778	54716	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.264705896 CET	54716	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.266060114 CET	54716	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.266809940 CET	3778	54714	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.266870975 CET	54714	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.386262894 CET	3778	54716	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.386435032 CET	54716	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:11.386846066 CET	3778	54714	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:11.506733894 CET	3778	54716	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:12.829500914 CET	3778	54714	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:12.829586983 CET	3778	54716	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:12.829756975 CET	54716	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:12.829793930 CET	54714	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:12.829802990 CET	54716	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:12.829794884 CET	54714	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:12.830878019 CET	54718	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:12.831295967 CET	54720	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:13.068466902 CET	3778	54718	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:13.068497896 CET	3778	54720	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:13.068748951 CET	54718	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:13.068809986 CET	54720	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:13.070980072 CET	54720	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:13.071134090 CET	54718	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:13.190442085 CET	3778	54720	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:13.190630913 CET	3778	54718	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:13.190702915 CET	54720	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:13.190707922 CET	54718	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:13.310421944 CET	3778	54718	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:13.310437918 CET	3778	54720	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:14.626081944 CET	3778	54718	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:14.626117945 CET	3778	54720	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:14.626213074 CET	54718	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.626245022 CET	54720	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.626274109 CET	54718	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.626473904 CET	54720	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.626867056 CET	54722	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.627007008 CET	54724	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.864741087 CET	3778	54722	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:14.864773989 CET	3778	54724	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:14.864975929 CET	54724	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.864969969 CET	54722	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.866069078 CET	54722	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.866183043 CET	54724	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.985956907 CET	3778	54722	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:14.986005068 CET	3778	54724	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:14.986073017 CET	54724	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:14.986222029 CET	54722	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:15.108318090 CET	3778	54724	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:15.108349085 CET	3778	54722	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.000071049 CET	3778	54722	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.000135899 CET	3778	54724	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.000279903 CET	54724	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.000358105 CET	54722	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.000494003 CET	54722	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.000622988 CET	54724	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.001379967 CET	54726	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.001630068 CET	54728	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.153788090 CET	3778	54726	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.153821945 CET	3778	54728	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.153938055 CET	54726	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.154125929 CET	54728	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.155339003 CET	54726	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.155348063 CET	54728	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.274848938 CET	3778	54726	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.275016069 CET	54726	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.367265940 CET	3778	54728	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.367650032 CET	54728	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:18.394804955 CET	3778	54726	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:18.488400936 CET	3778	54728	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.428299904 CET	3778	54726	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.428481102 CET	54726	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.428481102 CET	54726	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.429028988 CET	54730	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.449109077 CET	3778	54728	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.449314117 CET	54728	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.449395895 CET	54728	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.449600935 CET	54732	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.548480034 CET	3778	54730	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.548650980 CET	54730	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.549738884 CET	54730	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.570113897 CET	3778	54732	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.570185900 CET	54732	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.571142912 CET	54732	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.669528008 CET	3778	54730	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.669874907 CET	54730	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.691052914 CET	3778	54732	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.691236973 CET	54732	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:21.789587021 CET	3778	54730	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:21.811156988 CET	3778	54732	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.170649052 CET	3778	54730	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.170738935 CET	3778	54732	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.170866013 CET	54732	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.170893908 CET	54730	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.170918941 CET	54732	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.171056032 CET	54730	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.171659946 CET	54734	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.171838999 CET	54736	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.291214943 CET	3778	54734	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.291409969 CET	3778	54736	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.291495085 CET	54734	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.291501045 CET	54736	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.292664051 CET	54734	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.292766094 CET	54736	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.412456989 CET	3778	54734	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.412544012 CET	3778	54736	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.412672043 CET	54734	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.412672997 CET	54736	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:25.532593012 CET	3778	54734	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:25.532639980 CET	3778	54736	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.186729908 CET	3778	54736	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.186830997 CET	3778	54734	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.186954021 CET	54734	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.186959982 CET	54736	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.186960936 CET	54736	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.187207937 CET	54734	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.188103914 CET	54738	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.188482046 CET	54740	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.309387922 CET	3778	54738	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.309483051 CET	3778	54740	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.309537888 CET	54738	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.309832096 CET	54740	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.311716080 CET	54738	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.312103987 CET	54740	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.431440115 CET	3778	54738	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.431613922 CET	54738	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.431916952 CET	3778	54740	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.432125092 CET	54740	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:27.551645994 CET	3778	54738	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:27.551863909 CET	3778	54740	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.584266901 CET	3778	54738	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.584384918 CET	3778	54740	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.584564924 CET	54740	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.584582090 CET	54738	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.584692001 CET	54738	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.584893942 CET	54740	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.586004019 CET	54742	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.586318016 CET	54744	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.736386061 CET	3778	54742	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.736409903 CET	3778	54744	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.736557007 CET	54744	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.736767054 CET	54742	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.739037991 CET	54744	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.739331961 CET	54742	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.858967066 CET	3778	54744	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.859060049 CET	3778	54742	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.859139919 CET	54744	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.859375954 CET	54742	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:29.979688883 CET	3778	54744	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:29.979945898 CET	3778	54742	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:31.424840927 CET	3778	54742	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:31.425193071 CET	54742	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:31.425259113 CET	54742	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:31.425930977 CET	54746	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:31.545984983 CET	3778	54746	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:31.546267033 CET	54746	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:31.547635078 CET	54746	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:31.667464018 CET	3778	54746	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:31.667764902 CET	54746	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:31.788144112 CET	3778	54746	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:33.177232981 CET	3778	54744	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:33.177447081 CET	54744	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:33.177475929 CET	54744	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:33.178330898 CET	54748	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:33.300379038 CET	3778	54748	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:33.300553083 CET	54748	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:33.301827908 CET	54748	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:33.421562910 CET	3778	54748	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:33.421798944 CET	54748	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:33.541524887 CET	3778	54748	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.462651014 CET	3778	54746	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.462830067 CET	54746	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.462932110 CET	54746	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.463670969 CET	54750	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.465075970 CET	3778	54748	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.465183020 CET	54748	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.465265036 CET	54748	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.465917110 CET	54752	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.583388090 CET	3778	54750	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.583543062 CET	54750	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.584726095 CET	54750	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.656434059 CET	3778	54752	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.656672955 CET	54752	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.658143044 CET	54752	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.704314947 CET	3778	54750	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.704428911 CET	54750	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.777733088 CET	3778	54752	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.777853966 CET	54752	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:36.824089050 CET	3778	54750	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:36.897722006 CET	3778	54752	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:39.742652893 CET	3778	54750	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:39.742810965 CET	3778	54752	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:39.742841005 CET	54750	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.742885113 CET	54752	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.742938042 CET	54752	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.742966890 CET	54750	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.744396925 CET	54754	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.744796991 CET	54756	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.863873005 CET	3778	54754	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:39.864089966 CET	54754	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.864264011 CET	3778	54756	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:39.864547014 CET	54756	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.867028952 CET	54754	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.867664099 CET	54756	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.986795902 CET	3778	54754	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:39.986860037 CET	54754	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:39.987651110 CET	3778	54756	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:39.987864017 CET	54756	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:40.106406927 CET	3778	54754	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:40.107377052 CET	3778	54756	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.352339983 CET	3778	54756	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.352355003 CET	3778	54754	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.352514982 CET	54754	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.352526903 CET	54756	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.352595091 CET	54756	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.352654934 CET	54754	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.353732109 CET	54758	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.353883982 CET	54760	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.475167036 CET	3778	54758	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.475281000 CET	3778	54760	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.475419998 CET	54758	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.475531101 CET	54760	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.478100061 CET	54760	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.478243113 CET	54758	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.597924948 CET	3778	54760	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.598052979 CET	3778	54758	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.598109961 CET	54760	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.598176956 CET	54758	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:42.717657089 CET	3778	54760	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:42.717705965 CET	3778	54758	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.148459911 CET	3778	54758	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.148649931 CET	3778	54760	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.148773909 CET	54758	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.148811102 CET	54760	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.148870945 CET	54760	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.149095058 CET	54758	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.149887085 CET	54762	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.150738001 CET	54764	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.270797014 CET	3778	54762	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.270912886 CET	54762	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.271626949 CET	3778	54764	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.271720886 CET	54764	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.272660971 CET	54762	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.273466110 CET	54764	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.392165899 CET	3778	54762	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.392472982 CET	54762	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.393105030 CET	3778	54764	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.393229961 CET	54764	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:44.512100935 CET	3778	54762	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:44.512865067 CET	3778	54764	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:45.967782021 CET	3778	54764	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:45.967921019 CET	54764	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:45.968022108 CET	54764	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:45.968739986 CET	54766	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.088980913 CET	3778	54766	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:46.089118004 CET	54766	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.090214014 CET	54766	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.209872007 CET	3778	54766	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:46.210002899 CET	54766	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.329735994 CET	3778	54766	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:46.524127960 CET	3778	54762	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:46.524218082 CET	54762	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.524270058 CET	54762	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.524997950 CET	54768	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.644956112 CET	3778	54768	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:46.645025969 CET	54768	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.646505117 CET	54768	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.766997099 CET	3778	54768	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:46.767091990 CET	54768	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:46.886555910 CET	3778	54768	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:48.921942949 CET	3778	54766	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:48.922235012 CET	54766	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:48.922235012 CET	54766	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:48.922679901 CET	54770	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.043768883 CET	3778	54770	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:49.044003963 CET	54770	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.045156002 CET	54770	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.164834976 CET	3778	54770	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:49.165091038 CET	54770	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.284866095 CET	3778	54770	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:49.834887981 CET	3778	54768	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:49.835160017 CET	54768	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.835160017 CET	54768	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.836462975 CET	54772	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.956206083 CET	3778	54772	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:49.956382036 CET	54772	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:49.957695007 CET	54772	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:50.077404976 CET	3778	54772	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:50.077570915 CET	54772	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:50.197227955 CET	3778	54772	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:51.932048082 CET	3778	54770	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:51.932260990 CET	54770	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:51.932261944 CET	54770	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:51.932984114 CET	54774	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:52.052731991 CET	3778	54774	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:52.052995920 CET	54774	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:52.054565907 CET	54774	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:52.175508976 CET	3778	54774	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:52.175581932 CET	54774	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:52.295344114 CET	3778	54774	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:53.816040993 CET	3778	54772	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:53.816190004 CET	54772	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:53.816216946 CET	54772	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:53.816864967 CET	54776	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:53.938170910 CET	3778	54776	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:53.938251972 CET	54776	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:53.939387083 CET	54776	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:54.059453964 CET	3778	54776	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:54.059530020 CET	54776	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:54.179038048 CET	3778	54776	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:55.591305971 CET	3778	54776	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:55.591430902 CET	54776	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:55.591526985 CET	54776	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:55.592797995 CET	54778	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:55.715554953 CET	3778	54778	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:55.715701103 CET	54778	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:55.717650890 CET	54778	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:55.837999105 CET	3778	54778	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:55.838232994 CET	54778	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:55.957777023 CET	3778	54778	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:56.469743013 CET	3778	54774	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:56.469939947 CET	54774	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:56.470000029 CET	54774	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:56.470833063 CET	54780	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:56.590593100 CET	3778	54780	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:56.590768099 CET	54780	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:56.592407942 CET	54780	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:56.711993933 CET	3778	54780	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:56.712161064 CET	54780	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:56.831861973 CET	3778	54780	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:57.295079947 CET	3778	54778	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:57.295337915 CET	54778	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:57.295443058 CET	54778	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:57.296152115 CET	54782	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:57.416615009 CET	3778	54782	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:57.416712046 CET	54782	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:57.417759895 CET	54782	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:57.538590908 CET	3778	54782	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:57.538700104 CET	54782	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:57.659166098 CET	3778	54782	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.037754059 CET	3778	54780	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.037821054 CET	3778	54782	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.037883043 CET	54780	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.037957907 CET	54782	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.037957907 CET	54780	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.038019896 CET	54782	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.039102077 CET	54784	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.039243937 CET	54786	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.158605099 CET	3778	54784	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.158750057 CET	3778	54786	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.158778906 CET	54784	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.158886909 CET	54786	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.162134886 CET	54784	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.162568092 CET	54786	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.282126904 CET	3778	54784	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.282282114 CET	54784	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.282444954 CET	3778	54786	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.282530069 CET	54786	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:43:59.402046919 CET	3778	54784	89.213.158.208	192.168.2.14
Dec 22, 2024 15:43:59.402082920 CET	3778	54786	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:00.839157104 CET	3778	54786	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:00.839224100 CET	3778	54784	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:00.839303970 CET	54786	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.839303970 CET	54784	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.839380980 CET	54784	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.839380980 CET	54786	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.840270042 CET	54788	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.840507984 CET	54790	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.962517977 CET	3778	54788	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:00.962575912 CET	3778	54790	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:00.962614059 CET	54788	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.962666035 CET	54790	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.964441061 CET	54790	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:00.964560032 CET	54788	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:01.086568117 CET	3778	54790	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:01.086664915 CET	54790	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:01.086698055 CET	3778	54788	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:01.086790085 CET	54788	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:01.208738089 CET	3778	54790	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:01.208847046 CET	3778	54788	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.596035957 CET	3778	54790	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.596234083 CET	54790	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.596317053 CET	54790	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.596929073 CET	3778	54788	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.597033024 CET	54788	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.597158909 CET	54788	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.597307920 CET	54792	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.598402023 CET	54794	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.716928005 CET	3778	54792	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.717166901 CET	54792	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.718853951 CET	54792	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.740088940 CET	3778	54794	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.740159988 CET	54794	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.741810083 CET	54794	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.839034081 CET	3778	54792	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.839175940 CET	54792	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.861435890 CET	3778	54794	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.861524105 CET	54794	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:02.958733082 CET	3778	54792	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:02.981231928 CET	3778	54794	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.303576946 CET	3778	54792	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.303625107 CET	3778	54794	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.303711891 CET	54792	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.303770065 CET	54792	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.303770065 CET	54794	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.303833008 CET	54794	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.304809093 CET	54796	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.305139065 CET	54798	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.424983978 CET	3778	54796	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.425050020 CET	3778	54798	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.425101042 CET	54796	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.425194979 CET	54798	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.427306890 CET	54796	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.427834034 CET	54798	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.547168016 CET	3778	54796	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.547249079 CET	54796	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.547589064 CET	3778	54798	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.547665119 CET	54798	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:04.667200089 CET	3778	54796	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:04.667478085 CET	3778	54798	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:07.788677931 CET	3778	54796	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:07.788738012 CET	3778	54798	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:07.788872957 CET	54798	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.788872957 CET	54796	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.788918018 CET	54798	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.788964033 CET	54796	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.789715052 CET	54800	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.790039062 CET	54802	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.909456968 CET	3778	54800	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:07.909569025 CET	54800	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.909720898 CET	3778	54802	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:07.909822941 CET	54802	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.911739111 CET	54800	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:07.912224054 CET	54802	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:08.031410933 CET	3778	54800	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:08.031522036 CET	54800	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:08.031948090 CET	3778	54802	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:08.032041073 CET	54802	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:08.150959015 CET	3778	54800	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:08.151504040 CET	3778	54802	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.372083902 CET	3778	54800	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.372104883 CET	3778	54802	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.372308969 CET	54802	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.372308969 CET	54800	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.372347116 CET	54800	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.372419119 CET	54802	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.373399019 CET	54804	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.373526096 CET	54806	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.497396946 CET	3778	54804	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.497407913 CET	3778	54806	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.497538090 CET	54806	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.497652054 CET	54804	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.500339985 CET	54806	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.500536919 CET	54804	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.621149063 CET	3778	54806	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.621294022 CET	3778	54804	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.621460915 CET	54806	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.621505976 CET	54804	3778	192.168.2.14	89.213.158.208
Dec 22, 2024 15:44:10.742861986 CET	3778	54806	89.213.158.208	192.168.2.14
Dec 22, 2024 15:44:10.742916107 CET	3778	54804	89.213.158.208	192.168.2.14

System Behavior

Analysis Process: Space.m68k.elf PID: 5493, Parent PID: 5416

General

Start time (UTC):	14:42:00
Start date (UTC):	22/12/2024
Path:	/tmp/Space.m68k.elf
Arguments:	/tmp/Space.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5495, Parent PID: 5493

General

Start time (UTC):	14:42:01
Start date (UTC):	22/12/2024
Path:	/tmp/Space.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5497, Parent PID: 5495

General

Start time (UTC):	14:42:01
Start date (UTC):	22/12/2024
Path:	/tmp/Space.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5499, Parent PID: 5495

General

Start time (UTC):	14:42:01
Start date (UTC):	22/12/2024
Path:	/tmp/Space.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5513, Parent PID: 5493

General

Start time (UTC):	14:42:06
Start date (UTC):	22/12/2024
Path:	/tmp/Space.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5515, Parent PID: 5493

General

Start time (UTC):	14:42:06
Start date (UTC):	22/12/2024
Path:	/tmp/Space.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.m68k.elf PID: 5493, Parent PID: 5416

General

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5495, Parent PID: 5493

General

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5497, Parent PID: 5495

General

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5499, Parent PID: 5495

General

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5513, Parent PID: 5493

General

Chronological Activities

Analysis Process: Space.m68k.elf PID: 5515, Parent PID: 5493

General

Chronological Activities

Linux Analysis Report
Space.m68k.elf