Edit tour

Linux Analysis Report
Space.i686.elf

Overview

General Information

Sample name:	Space.i686.elf
Analysis ID:	1579475
MD5:	69bb2976de3feee44a259aba3d6e6339
SHA1:	5ae7aa7d99a2ec82de2d9a9da57a9acd5176b939
SHA256:	fb5e5e67d08d25421f3d1acfea212d860a41c97ffcbd3d30094362cccaaf9d76
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579475
Start date and time:	2024-12-22 15:45:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.i686.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.i686.elf
PID:	5488
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.i686.elf (PID: 5488, Parent: 5406, MD5: 69bb2976de3feee44a259aba3d6e6339) Arguments: /tmp/Space.i686.elf

Space.i686.elf New Fork (PID: 5489, Parent: 5488)

Space.i686.elf New Fork (PID: 5490, Parent: 5489)

Space.i686.elf New Fork (PID: 5491, Parent: 5489)

Space.i686.elf New Fork (PID: 5495, Parent: 5488)

Space.i686.elf New Fork (PID: 5496, Parent: 5488)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5495.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5495.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5488.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5488.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5490.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5490.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5489.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xec14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x531f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x52d2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x63ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x646d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_485c4b13	unknown	unknown	0xb08:$a: 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_7d05725e	unknown	unknown	0xa7e:$a: 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_0d73971c	unknown	unknown	0x6292:$a: 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x8282:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5489.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa2b1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Process Memory Space: Space.i686.elf PID: 5488	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1436:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1472:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1486:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x149a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1512:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1526:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1562:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1576:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 5489	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.i686.elf PID: 5489	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x585:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x599:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x611:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x625:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x639:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x64d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x661:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x675:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x689:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x69d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x701:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x715:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 5490	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.i686.elf PID: 5495	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x108c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 44 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.i686.elf	Virustotal: Detection: 44%			Perma Link
Source: Space.i686.elf	ReversingLabs: Detection: 47%

Machine Learning detection for sample

Source: Space.i686.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.13:44498 -> 89.213.158.208:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208

Source: Space.i686.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 5489, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 5490, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.i686.elf PID: 5495, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0d73971c reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5, id = 0d73971c-4253-4e7d-b1e1-20b031197f9e, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Process Memory Space: Space.i686.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 5489, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 5490, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.i686.elf PID: 5495, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/816/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.i686.elf (PID: 5488)	File opened: /proc/3310/status	Jump to behavior

Source: Space.i686.elf

Submission file: segment LOAD with 7.958 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 5489, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5495.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5488.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5490.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.i686.elf PID: 5489, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.i686.elf	44%	Virustotal		Browse
Space.i686.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
Space.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.i686.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.213.158.208	unknown	United Kingdom		8851	EDGEtaGCIComGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.213.158.208	Space.mips.elf	Get hash	malicious	Mirai	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EDGEtaGCIComGB	Space.mips.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.x86.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	ppc.elf	Get hash	malicious	Mirai	Browse	77.107.120.29
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	89.213.109.95
	1.elf	Get hash	malicious	Unknown	Browse	89.213.55.225
	wi86CSarYC.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	UFh7A8CImG.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	nSORtPkIOR.msi	Get hash	malicious	DanaBot	Browse	213.210.13.4
	cloudflare.msi	Get hash	malicious	DanaBot	Browse	213.210.13.4

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.955816610679686
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.i686.elf
File size:	35'948 bytes
MD5:	69bb2976de3feee44a259aba3d6e6339
SHA1:	5ae7aa7d99a2ec82de2d9a9da57a9acd5176b939
SHA256:	fb5e5e67d08d25421f3d1acfea212d860a41c97ffcbd3d30094362cccaaf9d76
SHA512:	c3292376c62e324d9b8e6773a78d5d0215feef9f2173f974f5e8ee4bf024aee817e4f6c497a38d285cb00383e28200983fd2be063b384a77d8f7d8c1dfc3388f
SSDEEP:	768:B9JFwkShNFPp2PxTNJgc/WbaaPTLRz73ninbcuyD7UHQRj7:fwkQX2P9NJg+a7LRz73ninouy8HyH
TLSH:	8CF2F1D6CD951784E0DC10B98844FC0E4B50E31FEF6EC1DA9ED4393A9894B893B7431A
File Content Preview:	.ELF....................x...4...........4. ...(.....................l...l...............@...@...@...................Q.td.............................-[.UPX!........T$..T$......U..........?..k.I/.j....\.h.blz.e...)....4.0.N..9..y...@$. ..qX.\Z.....0.v'...%

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc08978
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x8b6c	0x8b6c	7.9580	0x5	R E	0x1000
LOAD	0xc40	0x805cc40	0x805cc40	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 15:46:10.076361895 CET	44498	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:10.196299076 CET	3778	44498	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:10.196372986 CET	44498	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:10.196439028 CET	44498	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:10.316171885 CET	3778	44498	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:10.316234112 CET	44498	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:10.437992096 CET	3778	44498	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:13.076729059 CET	3778	44498	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:13.076879978 CET	44498	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:13.076916933 CET	44498	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:13.076948881 CET	44500	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:13.196651936 CET	3778	44500	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:13.196816921 CET	44500	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:13.196851969 CET	44500	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:13.316781998 CET	3778	44500	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:13.316919088 CET	44500	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:13.436940908 CET	3778	44500	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:15.685161114 CET	44502	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:15.808007002 CET	3778	44502	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:15.808080912 CET	44502	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:15.808134079 CET	44502	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:15.927733898 CET	3778	44502	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:15.927850008 CET	44502	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:16.047945976 CET	3778	44502	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:16.325922966 CET	3778	44500	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:16.326174021 CET	44500	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:16.326229095 CET	44500	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:16.326246977 CET	44504	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:16.445789099 CET	3778	44504	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:16.445923090 CET	44504	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:16.445957899 CET	44504	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:16.565546036 CET	3778	44504	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:16.565656900 CET	44504	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:16.685266018 CET	3778	44504	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:18.180028915 CET	3778	44504	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:18.180161953 CET	44504	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:18.180161953 CET	44504	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:18.180214882 CET	44506	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:18.300101042 CET	3778	44506	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:18.300318956 CET	44506	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:18.300401926 CET	44506	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:18.420021057 CET	3778	44506	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:18.420140028 CET	44506	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:18.539808989 CET	3778	44506	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:19.975965023 CET	3778	44502	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:19.976371050 CET	44502	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:19.976371050 CET	44502	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:19.976457119 CET	44508	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:20.096019030 CET	3778	44508	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:20.096329927 CET	44508	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:20.096440077 CET	44508	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:20.216012001 CET	3778	44508	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:20.216183901 CET	44508	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:20.335877895 CET	3778	44508	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:20.884913921 CET	3778	44506	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:20.885032892 CET	44506	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:20.885113001 CET	44506	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:20.885252953 CET	44510	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:21.004903078 CET	3778	44510	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:21.005084991 CET	44510	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:21.005330086 CET	44510	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:21.124968052 CET	3778	44510	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:21.125094891 CET	44510	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:21.246170044 CET	3778	44510	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:22.625140905 CET	3778	44510	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:22.625480890 CET	44510	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:22.625480890 CET	44510	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:22.625536919 CET	44512	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:22.745392084 CET	3778	44512	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:22.745677948 CET	44512	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:22.745677948 CET	44512	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:22.865638971 CET	3778	44512	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:22.865906954 CET	44512	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:22.985490084 CET	3778	44512	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:24.282788992 CET	3778	44508	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:24.283227921 CET	44508	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:24.283229113 CET	44508	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:24.283250093 CET	44514	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:24.403362989 CET	3778	44514	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:24.403491974 CET	44514	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:24.403580904 CET	44514	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:24.523130894 CET	3778	44514	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:24.523370981 CET	44514	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:24.642844915 CET	3778	44514	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:26.739363909 CET	3778	44512	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:26.739767075 CET	44512	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.739767075 CET	44512	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.739814043 CET	44516	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.759862900 CET	3778	44514	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:26.760052919 CET	44514	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.760052919 CET	44514	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.760060072 CET	44518	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.859406948 CET	3778	44516	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:26.859616995 CET	44516	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.859757900 CET	44516	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.879508018 CET	3778	44518	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:26.879678011 CET	44518	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.879678011 CET	44518	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.979290962 CET	3778	44516	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:26.979469061 CET	44516	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:26.999247074 CET	3778	44518	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:26.999442101 CET	44518	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:27.099466085 CET	3778	44516	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:27.118930101 CET	3778	44518	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:29.925198078 CET	3778	44516	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:29.925228119 CET	3778	44518	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:29.925432920 CET	44518	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:29.925432920 CET	44518	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:29.925432920 CET	44516	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:29.925506115 CET	44520	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:29.925528049 CET	44516	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:29.925554991 CET	44522	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:30.045473099 CET	3778	44520	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:30.045521975 CET	3778	44522	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:30.045643091 CET	44520	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:30.045757055 CET	44522	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:30.045757055 CET	44520	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:30.045881987 CET	44522	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:30.165246010 CET	3778	44520	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:30.165369034 CET	44520	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:30.165527105 CET	3778	44522	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:30.165746927 CET	44522	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:30.285300016 CET	3778	44520	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:30.285324097 CET	3778	44522	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:33.723130941 CET	3778	44520	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:33.723275900 CET	3778	44522	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:33.723292112 CET	44520	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.723339081 CET	44520	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.723359108 CET	44524	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.723550081 CET	44522	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.723583937 CET	44522	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.723596096 CET	44526	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.843117952 CET	3778	44524	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:33.843200922 CET	44524	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.843240023 CET	44524	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.843257904 CET	3778	44526	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:33.843378067 CET	44526	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.843416929 CET	44526	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.962799072 CET	3778	44524	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:33.962836981 CET	3778	44526	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:33.962949038 CET	44524	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:33.962949991 CET	44526	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:34.083030939 CET	3778	44524	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:34.083045959 CET	3778	44526	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:35.944046021 CET	3778	44526	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:35.944067001 CET	3778	44524	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:35.944394112 CET	44526	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:35.944394112 CET	44524	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:35.944394112 CET	44526	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:35.944454908 CET	44528	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:35.944478989 CET	44524	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:35.944535971 CET	44530	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:36.064270973 CET	3778	44528	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:36.064296007 CET	3778	44530	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:36.064368963 CET	44530	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:36.064393044 CET	44528	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:36.064400911 CET	44530	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:36.064429045 CET	44528	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:36.184515953 CET	3778	44530	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:36.184530020 CET	3778	44528	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:36.184612036 CET	44530	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:36.184634924 CET	44528	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:36.304197073 CET	3778	44530	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:36.304212093 CET	3778	44528	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.004169941 CET	3778	44528	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.004475117 CET	44528	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.004476070 CET	44528	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.004556894 CET	44532	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.124290943 CET	3778	44532	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.124646902 CET	44532	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.124711990 CET	44532	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.200006008 CET	3778	44530	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.200228930 CET	44534	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.200215101 CET	44530	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.200294018 CET	44530	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.244502068 CET	3778	44532	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.244769096 CET	44532	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.320569992 CET	3778	44534	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.320779085 CET	44534	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.320811987 CET	44534	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.364557028 CET	3778	44532	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.440623999 CET	3778	44534	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:39.440738916 CET	44534	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:39.560271978 CET	3778	44534	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.058624983 CET	3778	44534	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.058851004 CET	44534	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.058851004 CET	44534	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.058943033 CET	44536	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.179227114 CET	3778	44536	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.179517984 CET	44536	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.179591894 CET	44536	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.207287073 CET	3778	44532	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.207396030 CET	44532	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.207437992 CET	44532	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.207500935 CET	44538	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.299300909 CET	3778	44536	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.299479961 CET	44536	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.327209949 CET	3778	44538	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.327338934 CET	44538	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.327613115 CET	44538	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.419069052 CET	3778	44536	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.447244883 CET	3778	44538	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:41.447338104 CET	44538	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:41.567187071 CET	3778	44538	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:42.987828970 CET	3778	44536	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:42.987850904 CET	3778	44538	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:42.988060951 CET	44536	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:42.988060951 CET	44538	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:42.988061905 CET	44536	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:42.988128901 CET	44540	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:42.988132000 CET	44538	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:42.988168001 CET	44542	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:43.108072042 CET	3778	44540	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:43.108095884 CET	3778	44542	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:43.108231068 CET	44540	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:43.108231068 CET	44542	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:43.108282089 CET	44542	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:43.108318090 CET	44540	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:43.228102922 CET	3778	44542	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:43.228148937 CET	3778	44540	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:43.228318930 CET	44542	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:43.228318930 CET	44540	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:43.348244905 CET	3778	44542	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:43.348263979 CET	3778	44540	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.358042002 CET	3778	44540	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.358074903 CET	3778	44542	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.358263969 CET	44540	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.358263969 CET	44542	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.358309031 CET	44540	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.358448029 CET	44542	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.358526945 CET	44544	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.358526945 CET	44546	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.598336935 CET	3778	44544	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.598376989 CET	3778	44546	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.598573923 CET	44544	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.598573923 CET	44546	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.598638058 CET	44546	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.598748922 CET	44544	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.718617916 CET	3778	44546	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.718663931 CET	3778	44544	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.718796015 CET	44546	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.718885899 CET	44544	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:45.838424921 CET	3778	44546	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:45.838484049 CET	3778	44544	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.206696987 CET	3778	44546	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.206744909 CET	3778	44544	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.206907988 CET	44546	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.206907988 CET	44544	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.206983089 CET	44546	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.207077026 CET	44548	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.207125902 CET	44544	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.207166910 CET	44550	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.326687098 CET	3778	44548	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.326703072 CET	3778	44550	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.326783895 CET	44548	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.326884985 CET	44550	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.327064037 CET	44550	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.327127934 CET	44548	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.446754932 CET	3778	44550	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.446798086 CET	3778	44548	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.447149992 CET	44550	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.447149992 CET	44548	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:47.566864967 CET	3778	44550	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:47.566898108 CET	3778	44548	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.030191898 CET	3778	44550	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.030343056 CET	3778	44548	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.030476093 CET	44550	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.030476093 CET	44550	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.030492067 CET	44552	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.030663013 CET	44548	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.030705929 CET	44548	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.030771971 CET	44554	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.150682926 CET	3778	44552	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.150907040 CET	44552	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.150907993 CET	44552	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.270394087 CET	3778	44554	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.270591021 CET	3778	44552	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.270672083 CET	44554	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.270786047 CET	44552	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.270868063 CET	44554	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.392832041 CET	3778	44552	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.392874002 CET	3778	44554	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:49.392995119 CET	44554	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:49.512577057 CET	3778	44554	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:50.828748941 CET	3778	44552	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:50.829021931 CET	44552	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:50.829022884 CET	44552	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:50.829057932 CET	44556	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:50.830471039 CET	3778	44554	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:50.830565929 CET	44554	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:50.830612898 CET	44554	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:50.830620050 CET	44558	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:50.948896885 CET	3778	44556	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:50.949155092 CET	44556	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:50.949259043 CET	44556	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:51.067846060 CET	3778	44558	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:51.068165064 CET	44558	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:51.068166018 CET	44558	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:51.068835020 CET	3778	44556	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:51.068933964 CET	44556	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:51.188608885 CET	3778	44558	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:51.188703060 CET	3778	44556	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:51.188781977 CET	44558	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:51.308520079 CET	3778	44558	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.166682959 CET	3778	44556	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.167051077 CET	44560	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.167047977 CET	44556	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.167048931 CET	44556	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.286906958 CET	3778	44560	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.287302971 CET	44560	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.287302971 CET	44560	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.407522917 CET	3778	44560	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.407846928 CET	44560	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.527626038 CET	3778	44560	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.591424942 CET	3778	44558	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.591656923 CET	44558	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.591758966 CET	44558	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.591862917 CET	44562	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.711513996 CET	3778	44562	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.711872101 CET	44562	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.711872101 CET	44562	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.831509113 CET	3778	44562	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:53.831752062 CET	44562	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:53.951407909 CET	3778	44562	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.161900997 CET	3778	44560	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.161933899 CET	3778	44562	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.162245035 CET	44560	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.162245989 CET	44560	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.162245989 CET	44562	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.162264109 CET	44564	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.162350893 CET	44562	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.162369967 CET	44566	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.403657913 CET	3778	44564	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.403692961 CET	3778	44566	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.403973103 CET	44564	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.403973103 CET	44566	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.403973103 CET	44566	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.404057026 CET	44564	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.523683071 CET	3778	44566	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.523716927 CET	3778	44564	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.523926973 CET	44566	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.523926973 CET	44564	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:57.644398928 CET	3778	44566	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:57.644515991 CET	3778	44564	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:58.672723055 CET	3778	44566	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:58.672935963 CET	44566	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:58.673027992 CET	44566	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:58.673032999 CET	44568	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:58.792874098 CET	3778	44568	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:58.793009996 CET	44568	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:58.793148994 CET	44568	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:58.912801027 CET	3778	44568	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:58.913084984 CET	44568	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:59.032784939 CET	3778	44568	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:59.191561937 CET	3778	44564	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:59.191764116 CET	44564	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:59.191764116 CET	44564	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:59.191822052 CET	44570	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:59.315243959 CET	3778	44570	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:59.315377951 CET	44570	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:59.315681934 CET	44570	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:59.435194969 CET	3778	44570	89.213.158.208	192.168.2.13
Dec 22, 2024 15:46:59.435338974 CET	44570	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:46:59.554867029 CET	3778	44570	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:00.949297905 CET	3778	44568	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:00.949470043 CET	44568	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:00.949528933 CET	44568	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:00.949628115 CET	44572	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:01.070111036 CET	3778	44572	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:01.070425034 CET	44572	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:01.070478916 CET	44572	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:01.190434933 CET	3778	44572	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:01.190579891 CET	44572	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:01.310157061 CET	3778	44572	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:02.737947941 CET	3778	44570	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:02.738306046 CET	44570	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:02.738420963 CET	44570	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:02.738485098 CET	44574	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:02.858246088 CET	3778	44574	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:02.858500004 CET	44574	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:02.858633041 CET	44574	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:02.978254080 CET	3778	44574	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:02.978511095 CET	44574	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:03.098212004 CET	3778	44574	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.546154022 CET	3778	44572	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.546329975 CET	44572	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.546380043 CET	44576	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.546432018 CET	44572	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.564215899 CET	3778	44574	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.564445972 CET	44574	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.564486027 CET	44574	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.564512014 CET	44578	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.666074991 CET	3778	44576	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.666188955 CET	44576	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.666241884 CET	44576	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.785845041 CET	3778	44578	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.785881042 CET	3778	44576	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.785970926 CET	44578	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.786024094 CET	44578	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.786025047 CET	44576	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:04.905708075 CET	3778	44578	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.905740023 CET	3778	44576	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:04.905777931 CET	44578	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:05.025408983 CET	3778	44578	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:06.707866907 CET	3778	44576	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:06.708071947 CET	44576	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.708182096 CET	44576	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.708206892 CET	44580	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.816144943 CET	3778	44578	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:06.816427946 CET	44578	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.816502094 CET	44578	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.816515923 CET	44582	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.827883959 CET	3778	44580	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:06.828130960 CET	44580	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.828130960 CET	44580	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.947154045 CET	3778	44582	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:06.947431087 CET	44582	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.947530031 CET	44582	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:06.947663069 CET	3778	44580	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:06.947762966 CET	44580	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:07.067581892 CET	3778	44582	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:07.067601919 CET	3778	44580	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:07.067848921 CET	44582	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:07.187619925 CET	3778	44582	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.502473116 CET	3778	44580	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.502526999 CET	3778	44582	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.502664089 CET	44580	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.502664089 CET	44582	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.502747059 CET	44580	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.502861977 CET	44584	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.502928972 CET	44582	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.502994061 CET	44586	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.622628927 CET	3778	44584	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.622720957 CET	44584	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.622773886 CET	44584	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.739288092 CET	3778	44586	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.739511013 CET	44586	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.739511013 CET	44586	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.742403984 CET	3778	44584	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.742476940 CET	44584	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.859530926 CET	3778	44586	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.859714031 CET	44586	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:08.861985922 CET	3778	44584	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:08.979420900 CET	3778	44586	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.312247992 CET	3778	44584	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.312406063 CET	3778	44586	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.312441111 CET	44584	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.312521935 CET	44586	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.312521935 CET	44584	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.312588930 CET	44588	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.312668085 CET	44586	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.312680006 CET	44590	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.550474882 CET	3778	44588	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.550510883 CET	3778	44590	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.550786018 CET	44588	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.550816059 CET	44590	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.550988913 CET	44590	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.551063061 CET	44588	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.670464039 CET	3778	44590	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.670526028 CET	3778	44588	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.670605898 CET	44590	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.670640945 CET	44588	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:10.790301085 CET	3778	44590	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:10.790436983 CET	3778	44588	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:12.102427006 CET	3778	44590	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:12.102811098 CET	44592	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:12.102834940 CET	44590	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:12.102834940 CET	44590	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:12.222592115 CET	3778	44592	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:12.222949982 CET	44592	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:12.222949982 CET	44592	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:12.344589949 CET	3778	44592	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:12.344835997 CET	44592	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:12.465414047 CET	3778	44592	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:13.876699924 CET	3778	44588	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:13.876851082 CET	44588	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:13.876851082 CET	44588	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:13.876924992 CET	44594	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:13.895602942 CET	3778	44592	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:13.895756006 CET	44592	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:13.895756006 CET	44592	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:13.895800114 CET	44596	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:13.998059988 CET	3778	44594	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:13.998141050 CET	44594	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:13.998156071 CET	44594	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:14.015542030 CET	3778	44596	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:14.015899897 CET	44596	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:14.015901089 CET	44596	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:14.118640900 CET	3778	44594	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:14.118762970 CET	44594	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:14.135687113 CET	3778	44596	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:14.135795116 CET	44596	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:14.238372087 CET	3778	44594	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:14.255510092 CET	3778	44596	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:15.677268028 CET	3778	44596	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:15.677711964 CET	44596	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:15.677711964 CET	44596	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:15.677834034 CET	44598	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:15.797478914 CET	3778	44598	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:15.798111916 CET	44598	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:15.798463106 CET	44598	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:15.918101072 CET	3778	44598	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:15.918400049 CET	44598	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:16.038710117 CET	3778	44598	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.448556900 CET	3778	44594	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.448750973 CET	44594	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.448751926 CET	44594	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.448826075 CET	44600	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.449897051 CET	3778	44598	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.449963093 CET	44598	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.450000048 CET	44602	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.450078964 CET	44598	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.570766926 CET	3778	44600	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.570997953 CET	44600	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.571059942 CET	44600	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.690164089 CET	3778	44602	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.690279007 CET	44602	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.690402985 CET	44602	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.690766096 CET	3778	44600	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.690857887 CET	44600	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.810553074 CET	3778	44602	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.810650110 CET	44602	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:17.810820103 CET	3778	44600	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:17.930387020 CET	3778	44602	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.231615067 CET	3778	44600	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.231673002 CET	3778	44602	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.231817007 CET	44602	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.231925011 CET	44600	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.232021093 CET	44600	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.232120037 CET	44604	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.232168913 CET	44602	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.232209921 CET	44606	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.469629049 CET	3778	44604	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.469662905 CET	3778	44606	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.469772100 CET	44604	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.469825983 CET	44604	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.469937086 CET	44606	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.469937086 CET	44606	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.589550018 CET	3778	44604	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.589586020 CET	3778	44606	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.589694023 CET	44604	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.589804888 CET	44606	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:19.709436893 CET	3778	44604	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:19.709472895 CET	3778	44606	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.297074080 CET	3778	44604	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.297290087 CET	44604	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.297394991 CET	44604	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.297451019 CET	3778	44606	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.297458887 CET	44608	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.297573090 CET	44606	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.297595978 CET	44606	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.297625065 CET	44610	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.419255018 CET	3778	44608	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.419292927 CET	3778	44610	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.419384956 CET	44610	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.419384956 CET	44608	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.419441938 CET	44610	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.419441938 CET	44608	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.539035082 CET	3778	44610	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.539213896 CET	3778	44608	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.539371967 CET	44610	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.539371967 CET	44608	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:22.660978079 CET	3778	44610	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:22.661051989 CET	3778	44608	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:24.537981987 CET	3778	44608	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:24.538012981 CET	3778	44610	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:24.538284063 CET	44612	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.538284063 CET	44614	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.538295031 CET	44608	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.538295031 CET	44608	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.538295984 CET	44610	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.538295984 CET	44610	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.778625011 CET	3778	44612	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:24.778669119 CET	3778	44614	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:24.778932095 CET	44612	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.778932095 CET	44614	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.778932095 CET	44614	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.778932095 CET	44612	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.898880959 CET	3778	44614	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:24.898931026 CET	3778	44612	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:24.899025917 CET	44614	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:24.899096012 CET	44612	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:25.018845081 CET	3778	44614	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:25.018876076 CET	3778	44612	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.299890995 CET	3778	44612	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.299921989 CET	3778	44614	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.300179958 CET	44618	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.300179958 CET	44616	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.300204039 CET	44614	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.300204992 CET	44614	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.300204992 CET	44612	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.300204992 CET	44612	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.420053005 CET	3778	44618	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.420408010 CET	44618	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.420408010 CET	44618	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.518218040 CET	3778	44616	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.518424034 CET	44616	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.518424034 CET	44616	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.540005922 CET	3778	44618	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.540328979 CET	44618	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.638098955 CET	3778	44616	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.638309002 CET	44616	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:27.659835100 CET	3778	44618	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:27.757879972 CET	3778	44616	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:29.868324995 CET	3778	44618	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:29.868361950 CET	3778	44616	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:29.868597984 CET	44616	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:29.868597984 CET	44618	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:29.868597984 CET	44616	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:29.868643045 CET	44620	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:29.868686914 CET	44618	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:29.868731022 CET	44622	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:30.108303070 CET	3778	44620	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:30.108345985 CET	3778	44622	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:30.108504057 CET	44620	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:30.108504057 CET	44620	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:30.108608007 CET	44622	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:30.108608007 CET	44622	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:30.228574991 CET	3778	44620	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:30.228621960 CET	3778	44622	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:30.228743076 CET	44620	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:30.228832960 CET	44622	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:30.348871946 CET	3778	44620	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:30.348906994 CET	3778	44622	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.220458984 CET	3778	44620	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.220501900 CET	3778	44622	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.220877886 CET	44622	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.220877886 CET	44620	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.220877886 CET	44622	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.220896959 CET	44620	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.220917940 CET	44624	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.220917940 CET	44626	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.459966898 CET	3778	44624	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.459992886 CET	3778	44626	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.460196972 CET	44624	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.460285902 CET	44626	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.460453987 CET	44626	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.460529089 CET	44624	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.580765963 CET	3778	44626	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.580810070 CET	3778	44624	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.580907106 CET	44624	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.580907106 CET	44626	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:32.700668097 CET	3778	44624	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:32.700711966 CET	3778	44626	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:36.574820042 CET	3778	44624	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:36.574858904 CET	3778	44626	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:36.575097084 CET	44624	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.575150013 CET	44626	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.575167894 CET	44626	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.575277090 CET	44628	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.575309038 CET	44624	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.575345039 CET	44630	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.695050001 CET	3778	44628	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:36.695089102 CET	3778	44630	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:36.695184946 CET	44628	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.695184946 CET	44630	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.695251942 CET	44630	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.695277929 CET	44628	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.814783096 CET	3778	44630	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:36.815102100 CET	44630	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.933871984 CET	3778	44628	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:36.933969975 CET	44628	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:36.934583902 CET	3778	44630	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:37.053575993 CET	3778	44628	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.313350916 CET	3778	44630	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.313371897 CET	3778	44628	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.313628912 CET	44628	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.313628912 CET	44630	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.313628912 CET	44630	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.313668013 CET	44632	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.313734055 CET	44628	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.313749075 CET	44634	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.433370113 CET	3778	44632	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.433407068 CET	3778	44634	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.433520079 CET	44634	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.433636904 CET	44632	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.433799982 CET	44634	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.433854103 CET	44632	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.553451061 CET	3778	44634	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.553482056 CET	3778	44632	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.553587914 CET	44634	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.553718090 CET	44632	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:39.673485994 CET	3778	44634	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:39.673621893 CET	3778	44632	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:42.653081894 CET	3778	44634	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:42.653219938 CET	3778	44632	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:42.653440952 CET	44634	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.653440952 CET	44632	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.653440952 CET	44634	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.653486013 CET	44636	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.653486013 CET	44638	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.653558016 CET	44632	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.773741961 CET	3778	44636	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:42.773854017 CET	3778	44638	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:42.773983002 CET	44636	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.773983955 CET	44638	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.774075985 CET	44638	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.774141073 CET	44636	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.893604040 CET	3778	44638	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:42.893677950 CET	3778	44636	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:42.893747091 CET	44638	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:42.893924952 CET	44636	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:43.013545990 CET	3778	44638	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:43.013618946 CET	3778	44636	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.476948977 CET	3778	44636	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.477011919 CET	3778	44638	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.477300882 CET	44636	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.477300882 CET	44638	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.477400064 CET	44636	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.477451086 CET	44640	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.477485895 CET	44638	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.477579117 CET	44642	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.632652998 CET	3778	44640	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.632673025 CET	3778	44642	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.632786036 CET	44640	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.632786036 CET	44642	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.633068085 CET	44640	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.633068085 CET	44642	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.755152941 CET	3778	44640	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.755367994 CET	3778	44642	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.755403996 CET	44640	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.755536079 CET	44642	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:45.878273964 CET	3778	44640	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:45.878300905 CET	3778	44642	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.047981977 CET	3778	44640	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.047996044 CET	3778	44642	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.048259974 CET	44640	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.048259974 CET	44642	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.048346043 CET	44640	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.048450947 CET	44644	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.048485041 CET	44642	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.048536062 CET	44646	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.168385029 CET	3778	44644	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.168505907 CET	44644	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.168622017 CET	44644	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.287744045 CET	3778	44646	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.288059950 CET	44646	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.288059950 CET	44646	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.405427933 CET	3778	44644	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.405664921 CET	44644	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.407538891 CET	3778	44646	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.407788038 CET	44646	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:48.525819063 CET	3778	44644	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:48.527503014 CET	3778	44646	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.218533039 CET	3778	44644	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.218774080 CET	3778	44646	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.218858004 CET	44644	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.219034910 CET	44646	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.219124079 CET	44646	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.219269037 CET	44644	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.219364882 CET	44648	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.219485044 CET	44650	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.458049059 CET	3778	44648	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.458067894 CET	3778	44650	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.458327055 CET	44650	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.458327055 CET	44648	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.458327055 CET	44648	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.458425999 CET	44650	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.578020096 CET	3778	44648	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.578037024 CET	3778	44650	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.578346014 CET	44650	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.578346014 CET	44648	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:52.698143959 CET	3778	44650	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:52.698215008 CET	3778	44648	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:53.977961063 CET	3778	44648	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:53.978303909 CET	44648	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:53.978398085 CET	44648	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:53.978472948 CET	44652	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:53.979408979 CET	3778	44650	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:53.979543924 CET	44650	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:53.979568005 CET	44650	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:53.979623079 CET	44654	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:54.098458052 CET	3778	44652	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:54.098736048 CET	44652	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:54.098736048 CET	44652	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:54.099497080 CET	3778	44654	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:54.099626064 CET	44654	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:54.099626064 CET	44654	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:54.221724033 CET	3778	44652	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:54.221916914 CET	44652	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:54.222424030 CET	3778	44654	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:54.222533941 CET	44654	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:54.341375113 CET	3778	44652	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:54.342170000 CET	3778	44654	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:55.776786089 CET	3778	44652	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:55.776912928 CET	3778	44654	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:55.777107954 CET	44654	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.777107954 CET	44654	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.777107954 CET	44652	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.777108908 CET	44652	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.777116060 CET	44656	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.777116060 CET	44658	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.896977901 CET	3778	44656	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:55.896994114 CET	3778	44658	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:55.897098064 CET	44656	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.897150993 CET	44658	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.897150993 CET	44658	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:55.897273064 CET	44656	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:56.016640902 CET	3778	44658	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:56.016694069 CET	3778	44656	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:56.016802073 CET	44656	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:56.016863108 CET	44658	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:56.136244059 CET	3778	44656	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:56.136301041 CET	3778	44658	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.276987076 CET	3778	44656	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.276998043 CET	3778	44658	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.277241945 CET	44658	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.277241945 CET	44658	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.277321100 CET	44656	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.277321100 CET	44656	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.277493000 CET	44660	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.277493000 CET	44662	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.398360968 CET	3778	44660	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.398498058 CET	3778	44662	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.398766041 CET	44660	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.398766994 CET	44662	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.398982048 CET	44662	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.398983002 CET	44660	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.519835949 CET	3778	44662	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.519850969 CET	3778	44660	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.520070076 CET	44660	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.520070076 CET	44662	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:47:58.642247915 CET	3778	44660	89.213.158.208	192.168.2.13
Dec 22, 2024 15:47:58.642271042 CET	3778	44662	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:00.883028030 CET	3778	44662	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:00.883093119 CET	3778	44660	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:00.883223057 CET	44662	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:00.883223057 CET	44660	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:00.883338928 CET	44660	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:00.883420944 CET	44664	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:00.883505106 CET	44662	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:00.883511066 CET	44666	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.002923012 CET	3778	44664	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:01.003125906 CET	44664	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.003288984 CET	44664	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.105792046 CET	3778	44662	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:01.105947018 CET	44662	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.111884117 CET	3778	44666	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:01.112004042 CET	44666	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.112051964 CET	44666	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.122864008 CET	3778	44664	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:01.122927904 CET	44664	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.232093096 CET	3778	44666	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:01.232218981 CET	44666	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:01.242558002 CET	3778	44664	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:01.353365898 CET	3778	44666	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:02.663235903 CET	3778	44666	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:02.663444042 CET	44666	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:02.663477898 CET	44668	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:02.663505077 CET	44666	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:02.787853956 CET	3778	44668	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:02.788007021 CET	44668	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:02.788067102 CET	44668	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:02.914243937 CET	3778	44668	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:02.914376974 CET	44668	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:03.034080029 CET	3778	44668	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.458929062 CET	3778	44664	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.459333897 CET	44664	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.459333897 CET	44664	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.459424973 CET	44670	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.460730076 CET	3778	44668	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.460800886 CET	44668	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.460834980 CET	44668	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.460865021 CET	44672	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.579216957 CET	3778	44670	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.579417944 CET	44670	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.579509974 CET	44670	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.698129892 CET	3778	44672	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.698328018 CET	44672	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.698477030 CET	44672	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.698921919 CET	3778	44670	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.699002981 CET	44670	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.819322109 CET	3778	44672	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.819349051 CET	3778	44670	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:04.819618940 CET	44672	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:04.939403057 CET	3778	44672	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.258707047 CET	3778	44672	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.259073973 CET	44672	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.259130001 CET	44672	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.259212017 CET	44674	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.278253078 CET	3778	44670	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.278364897 CET	44670	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.278562069 CET	44670	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.278650999 CET	44676	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.378705978 CET	3778	44674	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.379005909 CET	44674	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.379254103 CET	44674	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.398133039 CET	3778	44676	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.398236990 CET	44676	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.398312092 CET	44676	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.498758078 CET	3778	44674	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.498955965 CET	44674	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.517777920 CET	3778	44676	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.517889023 CET	44676	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:06.618406057 CET	3778	44674	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:06.637382030 CET	3778	44676	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.367156029 CET	3778	44676	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.367228985 CET	3778	44674	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.367453098 CET	44676	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.367491961 CET	44674	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.367583990 CET	44676	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.367683887 CET	44678	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.367746115 CET	44674	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.367794037 CET	44680	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.487291098 CET	3778	44678	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.487376928 CET	3778	44680	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.487519026 CET	44680	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.487524986 CET	44678	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.487525940 CET	44678	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.487582922 CET	44680	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.607122898 CET	3778	44678	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.607217073 CET	3778	44680	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.607306957 CET	44678	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.607326031 CET	44680	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:08.726927996 CET	3778	44680	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:08.726980925 CET	3778	44678	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.142118931 CET	3778	44678	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.142349005 CET	44678	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.142399073 CET	44678	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.142417908 CET	44682	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.142466068 CET	3778	44680	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.142644882 CET	44680	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.142644882 CET	44680	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.142654896 CET	44684	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.262048006 CET	3778	44682	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.262192011 CET	3778	44684	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.262197018 CET	44682	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.262304068 CET	44682	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.262320995 CET	44684	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.262382030 CET	44684	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.381890059 CET	3778	44682	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.381973982 CET	3778	44684	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.382033110 CET	44682	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.382087946 CET	44684	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:10.502101898 CET	3778	44682	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:10.502130985 CET	3778	44684	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:13.747078896 CET	3778	44684	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:13.747234106 CET	3778	44682	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:13.747447014 CET	44684	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.747463942 CET	44682	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.747512102 CET	44684	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.747589111 CET	44686	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.747663021 CET	44682	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.747701883 CET	44688	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.867258072 CET	3778	44686	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:13.867373943 CET	44686	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.867429018 CET	44686	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.986548901 CET	3778	44688	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:13.986638069 CET	44688	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.986689091 CET	44688	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:13.986948967 CET	3778	44686	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:13.986998081 CET	44686	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:14.106973886 CET	3778	44688	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:14.107017994 CET	3778	44686	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:14.107173920 CET	44688	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:14.226840973 CET	3778	44688	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:15.568391085 CET	3778	44686	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:15.568459988 CET	3778	44688	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:15.568615913 CET	44686	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.568648100 CET	44688	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.568691969 CET	44686	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.568782091 CET	44690	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.568842888 CET	44692	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.568844080 CET	44688	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.808547020 CET	3778	44690	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:15.808590889 CET	3778	44692	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:15.808703899 CET	44690	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.808871031 CET	44692	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.809061050 CET	44692	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.809137106 CET	44690	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.928714991 CET	3778	44692	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:15.928778887 CET	3778	44690	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:15.928869963 CET	44690	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:15.928946972 CET	44692	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:16.050450087 CET	3778	44690	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:16.050487041 CET	3778	44692	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.363872051 CET	3778	44692	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.363998890 CET	3778	44690	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.364099979 CET	44692	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.364217997 CET	44692	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.364218950 CET	44694	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.364223003 CET	44690	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.364264011 CET	44690	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.364314079 CET	44696	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.484321117 CET	3778	44694	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.484482050 CET	44694	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.484564066 CET	44694	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.603509903 CET	3778	44696	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.603688002 CET	44696	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.603750944 CET	44696	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.604129076 CET	3778	44694	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.604203939 CET	44694	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.723421097 CET	3778	44696	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.723577976 CET	44696	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:17.723819017 CET	3778	44694	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:17.843231916 CET	3778	44696	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:19.670701981 CET	3778	44694	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:19.670794964 CET	44694	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.670824051 CET	3778	44696	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:19.670887947 CET	44694	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.670902014 CET	44696	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.671022892 CET	44698	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.671092033 CET	44696	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.671118021 CET	44700	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.790868044 CET	3778	44698	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:19.790939093 CET	3778	44700	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:19.791001081 CET	44698	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.791035891 CET	44700	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.791138887 CET	44698	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.791203022 CET	44700	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.910865068 CET	3778	44698	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:19.910901070 CET	3778	44700	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:19.910969973 CET	44698	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:19.910985947 CET	44700	3778	192.168.2.13	89.213.158.208
Dec 22, 2024 15:48:20.030705929 CET	3778	44698	89.213.158.208	192.168.2.13
Dec 22, 2024 15:48:20.030741930 CET	3778	44700	89.213.158.208	192.168.2.13

System Behavior

Analysis Process: Space.i686.elf PID: 5488, Parent PID: 5406

General

Start time (UTC):	14:46:09
Start date (UTC):	22/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	/tmp/Space.i686.elf
File size:	35948 bytes
MD5 hash:	69bb2976de3feee44a259aba3d6e6339

Chronological Activities

Analysis Process: Space.i686.elf PID: 5489, Parent PID: 5488

General

Start time (UTC):	14:46:09
Start date (UTC):	22/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	69bb2976de3feee44a259aba3d6e6339

Chronological Activities

Analysis Process: Space.i686.elf PID: 5490, Parent PID: 5489

General

Start time (UTC):	14:46:09
Start date (UTC):	22/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	69bb2976de3feee44a259aba3d6e6339

Chronological Activities

Analysis Process: Space.i686.elf PID: 5491, Parent PID: 5489

General

Start time (UTC):	14:46:09
Start date (UTC):	22/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	69bb2976de3feee44a259aba3d6e6339

Analysis Process: Space.i686.elf PID: 5495, Parent PID: 5488

General

Start time (UTC):	14:46:15
Start date (UTC):	22/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	69bb2976de3feee44a259aba3d6e6339

Chronological Activities

Analysis Process: Space.i686.elf PID: 5496, Parent PID: 5488

General

Start time (UTC):	14:46:15
Start date (UTC):	22/12/2024
Path:	/tmp/Space.i686.elf
Arguments:	-
File size:	35948 bytes
MD5 hash:	69bb2976de3feee44a259aba3d6e6339

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.i686.elf PID: 5488, Parent PID: 5406

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 5489, Parent PID: 5488

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 5490, Parent PID: 5489

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 5491, Parent PID: 5489

General

Analysis Process: Space.i686.elf PID: 5495, Parent PID: 5488

General

Chronological Activities

Analysis Process: Space.i686.elf PID: 5496, Parent PID: 5488

General

Linux Analysis Report
Space.i686.elf