Edit tour

Linux Analysis Report
Space.sh4.elf

Overview

General Information

Sample name:	Space.sh4.elf
Analysis ID:	1579476
MD5:	a79169b9cd91824eccb46ee18d3f4460
SHA1:	e0b4f4b61bbf63ba868547472f4cd5f84bc25a7e
SHA256:	f98782c58093e662930f61896a90a93eed7da232d87d3402a2fa3ccadc7f876e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579476
Start date and time:	2024-12-22 15:45:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.sh4.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.sh4.elf
PID:	6257
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.sh4.elf (PID: 6257, Parent: 6179, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/Space.sh4.elf

Space.sh4.elf New Fork (PID: 6259, Parent: 6257)

Space.sh4.elf New Fork (PID: 6261, Parent: 6259)

Space.sh4.elf New Fork (PID: 6263, Parent: 6259)

Space.sh4.elf New Fork (PID: 6271, Parent: 6257)

Space.sh4.elf New Fork (PID: 6273, Parent: 6257)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Space.sh4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Space.sh4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd75c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd84c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6271.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6271.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd75c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd84c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6261.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6261.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd75c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd84c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6259.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6259.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd75c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd84c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6257.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6257.1.00007f66d8400000.00007f66d8411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd75c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd84c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.sh4.elf PID: 6257	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.sh4.elf PID: 6257	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4112:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4126:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x413a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x414e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4162:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4176:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x419e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4202:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4216:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x422a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x423e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4252:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4266:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x427a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x428e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.sh4.elf PID: 6259	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.sh4.elf PID: 6259	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4a23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4aaf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ac3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ad7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4aeb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4aff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.sh4.elf PID: 6261	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.sh4.elf PID: 6261	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x464f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4663:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4677:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x468b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x469f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4703:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4717:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x472b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x473f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4753:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4767:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x477b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x478f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.sh4.elf PID: 6271	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.sh4.elf PID: 6271	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x102a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1142:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1156:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x117e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1192:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Space.sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Space.sh4.elf	Virustotal: Detection: 63%			Perma Link
Source: Space.sh4.elf	ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.23:49056 -> 89.213.158.208:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Space.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6271.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6261.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6257.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.sh4.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.sh4.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.sh4.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.sh4.elf PID: 6271, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/net/tcp.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc/proc/proc/%d/exe/proc/%s/statusrName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog89.213.158.208

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Space.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6271.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6261.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6259.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6257.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.sh4.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.sh4.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.sh4.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.sh4.elf PID: 6271, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/6238/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/6237/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/6257/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/4509/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/4503/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/4505/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Space.sh4.elf (PID: 6257)	File opened: /proc/6263/status	Jump to behavior

Source: /tmp/Space.sh4.elf (PID: 6257)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.sh4.elf, 6257.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp, Space.sh4.elf, 6259.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp, Space.sh4.elf, 6261.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp, Space.sh4.elf, 6271.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp	Binary or memory string: azG2x86_64/usr/bin/qemu-sh4/tmp/Space.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.sh4.elf
Source: Space.sh4.elf, 6257.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp, Space.sh4.elf, 6259.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp, Space.sh4.elf, 6261.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp, Space.sh4.elf, 6271.1.00007ffc33a79000.00007ffc33a9a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: Space.sh4.elf, 6257.1.00005580bd5eb000.00005580bd66e000.rw-.sdmp, Space.sh4.elf, 6259.1.00005580bd5eb000.00005580bd64e000.rw-.sdmp, Space.sh4.elf, 6261.1.00005580bd5eb000.00005580bd64e000.rw-.sdmp, Space.sh4.elf, 6271.1.00005580bd5eb000.00005580bd66e000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: Space.sh4.elf, 6257.1.00005580bd5eb000.00005580bd66e000.rw-.sdmp, Space.sh4.elf, 6259.1.00005580bd5eb000.00005580bd64e000.rw-.sdmp, Space.sh4.elf, 6261.1.00005580bd5eb000.00005580bd64e000.rw-.sdmp, Space.sh4.elf, 6271.1.00005580bd5eb000.00005580bd66e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Space.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6271.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6271, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Space.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6271.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6261.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.00007f66d8400000.00007f66d8411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.sh4.elf PID: 6271, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.sh4.elf	63%	Virustotal		Browse
Space.sh4.elf	66%	ReversingLabs	Linux.Trojan.Mirai
Space.sh4.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.213.158.208	unknown	United Kingdom	8851	EDGEtaGCIComGB	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.213.158.208	Space.i686.elf	Get hash	malicious	Mirai	Browse
	Space.mips.elf	Get hash	malicious	Mirai	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	Space.x86.elf	Get hash	malicious	Mirai	Browse
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	Space.x86.elf	Get hash	malicious	Mirai	Browse
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	vlxx.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Space.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	91.189.91.42
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	Space.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	91.189.91.42
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
EDGEtaGCIComGB	Space.i686.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.mips.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.x86.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	ppc.elf	Get hash	malicious	Mirai	Browse	77.107.120.29
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	89.213.109.95
	1.elf	Get hash	malicious	Unknown	Browse	89.213.55.225
	wi86CSarYC.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	UFh7A8CImG.exe	Get hash	malicious	DanaBot	Browse	213.210.13.4
	nSORtPkIOR.msi	Get hash	malicious	DanaBot	Browse	213.210.13.4
INIT7CH	Space.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	109.202.202.202
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	vlxx.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	vlxx.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	vlxx.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.874029287906143
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.sh4.elf
File size:	67'252 bytes
MD5:	a79169b9cd91824eccb46ee18d3f4460
SHA1:	e0b4f4b61bbf63ba868547472f4cd5f84bc25a7e
SHA256:	f98782c58093e662930f61896a90a93eed7da232d87d3402a2fa3ccadc7f876e
SHA512:	3631556816cf6fab6be51e0cd9fc14e084ac450968580a14bf3eb93701b1a4b6361accce615515356b6118ceb66d4705bd7e7318fe301cbc1ea041d3a22fa95e
SSDEEP:	1536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8udR:dWVkwgAYugsz9xznsxrdR
TLSH:	EE639E16D82109A9C28685B471ECCE3A1B13E5C063837EF71A7AC375A067D9CF849FB4
File Content Preview:	.ELF.....................@.4...$.......4. ...(...............@...@.t...t...............x...x.B.x.B.l....)..........Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66852
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xd4e0	0x0	0x6	AX	32
.fini	PROGBITS	0x40d5c0	0xd5c0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40d5e4	0xd5e4	0x2b90	0x0	0x2	A	4
.ctors	PROGBITS	0x420178	0x10178	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x420180	0x10180	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x42018c	0x1018c	0x358	0x0	0x3	WA	4
.bss	NOBITS	0x4204e4	0x104e4	0x2620	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x104e4	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10174	0x10174	6.9222	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x10178	0x420178	0x420178	0x36c	0x298c	2.7064	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 15:46:14.061721087 CET	49056	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:14.181828976 CET	3778	49056	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:14.181960106 CET	49056	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:14.214087963 CET	49056	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:14.333714008 CET	3778	49056	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:14.333801985 CET	49056	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:14.453361988 CET	3778	49056	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:14.742415905 CET	43928	443	192.168.2.23	91.189.91.42
Dec 22, 2024 15:46:16.022378922 CET	42516	80	192.168.2.23	109.202.202.202
Dec 22, 2024 15:46:16.056777954 CET	3778	49056	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:16.056977987 CET	49056	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:16.058178902 CET	49056	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:16.058722973 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:16.178294897 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:16.178402901 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:16.179331064 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:16.298896074 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:16.298998117 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:16.418616056 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:19.975936890 CET	3778	49058	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:19.976089001 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:19.976164103 CET	49058	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:19.976828098 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.070029974 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.096280098 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:20.096338987 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.117722988 CET	42836	443	192.168.2.23	91.189.91.43
Dec 22, 2024 15:46:20.131287098 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.189788103 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:20.189903975 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.205770016 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.250809908 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:20.250852108 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.325333118 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:20.325378895 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:20.370347977 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:20.444941044 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.282773018 CET	3778	49060	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.282866955 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.282916069 CET	49060	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.282932043 CET	3778	49062	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.282977104 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.283143997 CET	49062	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.283447981 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.284116030 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.403397083 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.403470993 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.404428959 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.521861076 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.521948099 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.523185968 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.523868084 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.523920059 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.642693043 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.642759085 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:24.643372059 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:24.762312889 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:26.759490013 CET	3778	49064	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:26.759830952 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:26.759830952 CET	49064	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:26.760554075 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:26.978555918 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:26.978734970 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:26.979758978 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:27.099520922 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:27.099699974 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:27.219266891 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:28.562743902 CET	3778	49066	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:28.563062906 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:28.563158035 CET	49066	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:28.564372063 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:28.684251070 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:28.684436083 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:28.686630964 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:28.806288958 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:28.806772947 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:28.926314116 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:29.925213099 CET	3778	49068	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:29.925427914 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:29.925452948 CET	49068	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:29.926310062 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:30.164752007 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:30.164973974 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:30.166454077 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:30.286375046 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:30.286701918 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:30.406184912 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:31.643435955 CET	3778	49070	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:31.643667936 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:31.643729925 CET	49070	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:31.644726038 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:31.764312983 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:31.764434099 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:31.766042948 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:31.885512114 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:31.885601044 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:32.005428076 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:33.723177910 CET	3778	49072	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:33.723289967 CET	3778	49074	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:33.723398924 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.723427057 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.723427057 CET	49072	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.723536968 CET	49074	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.724466085 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.724828005 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.843924999 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:33.843997955 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.845000029 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.962318897 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:33.962515116 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.964224100 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:33.964529037 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:33.964601040 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:34.083652020 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:34.083755016 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:34.084011078 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:34.203578949 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:35.731810093 CET	43928	443	192.168.2.23	91.189.91.42
Dec 22, 2024 15:46:35.944060087 CET	3778	49076	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:35.944086075 CET	3778	49078	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:35.944245100 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:35.944245100 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:35.944394112 CET	49076	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:35.944394112 CET	49078	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:35.945487976 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:35.945686102 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:36.184362888 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:36.184393883 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:36.184473991 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:36.184473991 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:36.187041998 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:36.187452078 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:36.306588888 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:36.306762934 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:36.306842089 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:36.306922913 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:36.426314116 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:36.426460028 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.004612923 CET	3778	49080	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.004630089 CET	3778	49082	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.004985094 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.005024910 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.005055904 CET	49082	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.005131006 CET	49080	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.006321907 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.006715059 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.244350910 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.244363070 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.244736910 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.244736910 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.247076035 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.247423887 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.366684914 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.366952896 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.367120981 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.367180109 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:39.486715078 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:39.486831903 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.207217932 CET	3778	49084	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.207354069 CET	3778	49086	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.207436085 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.207437038 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.207549095 CET	49084	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.207549095 CET	49086	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.209228992 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.209502935 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.418999910 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.419032097 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.419209003 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.419241905 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.423192024 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.423398972 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.542627096 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.542772055 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.542870045 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.542932034 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:41.662365913 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:41.662401915 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:42.987845898 CET	3778	49090	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:42.987857103 CET	3778	49088	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:42.988091946 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:42.988091946 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:42.988168001 CET	49088	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:42.988321066 CET	49090	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:42.989470005 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:42.989635944 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:43.108894110 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:43.109023094 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:43.109096050 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:43.109096050 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:43.112109900 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:43.112278938 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:43.231594086 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:43.231756926 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:43.231796026 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:43.231859922 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:43.351397991 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:43.351413012 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.358107090 CET	3778	49092	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.358138084 CET	3778	49094	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.358273029 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.358273029 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.358335018 CET	49094	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.358474016 CET	49092	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.359461069 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.360301018 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.598491907 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.598541975 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.598655939 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.598655939 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.600238085 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.600797892 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.720264912 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.720390081 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.720798969 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.720851898 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:45.839859962 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.840348959 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:45.970411062 CET	42836	443	192.168.2.23	91.189.91.43
Dec 22, 2024 15:46:45.970417023 CET	42516	80	192.168.2.23	109.202.202.202
Dec 22, 2024 15:46:47.125835896 CET	3778	49096	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:47.126072884 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.126193047 CET	49096	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.127069950 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.206775904 CET	3778	49098	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:47.206928015 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.206969976 CET	49098	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.207681894 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.246918917 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:47.247093916 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.248553038 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.327191114 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:47.327328920 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.329025984 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.368077993 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:47.368263006 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.448574066 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:47.448867083 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:47.487765074 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:47.568514109 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.030101061 CET	3778	49100	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.030158997 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.030489922 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.030491114 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.030580997 CET	49100	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.030771971 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.032291889 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.032769918 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.265153885 CET	3778	49102	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.265372992 CET	49102	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.270452023 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.270467043 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.270684004 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.270684004 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.273874044 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.274163961 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.394120932 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.394326925 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.394326925 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.394409895 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:49.514034986 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:49.514108896 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:50.828347921 CET	3778	49104	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:50.828505993 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:50.828573942 CET	49104	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:50.829452038 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:50.830152035 CET	3778	49106	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:50.830204010 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:50.830255985 CET	49106	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:50.831130981 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:50.949105024 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:50.949218035 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:50.955055952 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:51.067928076 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:51.068262100 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:51.070195913 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:51.074688911 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:51.074771881 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:51.190069914 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:51.190263987 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:51.194605112 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:51.309828997 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:52.783680916 CET	3778	49108	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:52.783900976 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:52.783951998 CET	49108	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:52.784980059 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:52.904717922 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:52.905082941 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:52.906528950 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.026320934 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:53.026432037 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.146331072 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:53.591468096 CET	3778	49110	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:53.591603041 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.591634989 CET	49110	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.592909098 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.712389946 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:53.712663889 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.714188099 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.833667994 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:53.833770037 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:53.953435898 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.161837101 CET	3778	49112	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.162003994 CET	3778	49114	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.162010908 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.162010908 CET	49112	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.162097931 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.162125111 CET	49114	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.163217068 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.163522005 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.403723955 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.403789997 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.403850079 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.403850079 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.405541897 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.405658007 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.525309086 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.525399923 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.525428057 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.525473118 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:57.646260023 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:57.646291018 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.191473961 CET	3778	49118	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.191526890 CET	3778	49116	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.191602945 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.191602945 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.191693068 CET	49118	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.191747904 CET	49116	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.192964077 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.193156004 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.434453964 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.434488058 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.434586048 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.434586048 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.436774969 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.436945915 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.556322098 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.556421041 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.556529999 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.556530952 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:46:59.676198006 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:46:59.677200079 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:02.738008976 CET	3778	49122	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:02.738168001 CET	3778	49120	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:02.738171101 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.738266945 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.738293886 CET	49122	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.738518953 CET	49120	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.739702940 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.740170002 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.859286070 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:02.859361887 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.859648943 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:02.859697104 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.861115932 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.861532927 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.980778933 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:02.980854034 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:02.981242895 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:02.981293917 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:03.100369930 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:03.100769043 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:04.546425104 CET	3778	49124	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:04.546612024 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.546729088 CET	49124	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.547913074 CET	3778	49126	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:04.547995090 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.548048973 CET	49126	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.548046112 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.549601078 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.667634964 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:04.667762995 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.669748068 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.785763025 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:04.785904884 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.787736893 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.789278984 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:04.789349079 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.907234907 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:04.907355070 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:04.908833981 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:05.026880026 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:06.707973003 CET	3778	49128	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:06.708122969 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.708194971 CET	49128	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.709342957 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.816082954 CET	3778	49130	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:06.816226006 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.816298008 CET	49130	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.817092896 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.828912973 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:06.829085112 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.830936909 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.947187901 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:06.947297096 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.948790073 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:06.950419903 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:06.950473070 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:07.068306923 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:07.068386078 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:07.069972992 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:07.187879086 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.499723911 CET	3778	49134	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.499900103 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.499986887 CET	49134	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.501080036 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.502659082 CET	3778	49132	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.502720118 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.502768993 CET	49132	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.503464937 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.621678114 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.621922016 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.623766899 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.741457939 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.741616964 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.743403912 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.858730078 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.858880043 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.862987995 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.863056898 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:08.978652000 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:08.982594013 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.310780048 CET	3778	49138	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.311110973 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.311110973 CET	49138	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.312084913 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.312211037 CET	3778	49136	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.312279940 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.312341928 CET	49136	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.313340902 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.431754112 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.431963921 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.433357954 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.550542116 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.550616980 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.552366018 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.552856922 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.552934885 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.671864986 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.672174931 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:10.672398090 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:10.791755915 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:13.876583099 CET	3778	49140	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:13.876629114 CET	3778	49142	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:13.876712084 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:13.876712084 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:13.876761913 CET	49140	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:13.876854897 CET	49142	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:13.877988100 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:13.878436089 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:13.998094082 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:13.998153925 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:13.998207092 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:13.998231888 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:14.000674009 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:14.000870943 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:14.120276928 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:14.120369911 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:14.120456934 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:14.120512009 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:14.239980936 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:14.240016937 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:16.686367035 CET	43928	443	192.168.2.23	91.189.91.42
Dec 22, 2024 15:47:17.448609114 CET	3778	49146	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:17.448681116 CET	3778	49144	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:17.448849916 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.448849916 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.448945999 CET	49146	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.449146032 CET	49144	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.450687885 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.451134920 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.690251112 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:17.690330982 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:17.690459013 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.690459013 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.694116116 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.694421053 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.814368963 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:17.814475060 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.814632893 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:17.814697981 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:17.934348106 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:17.934406996 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.231534958 CET	3778	49148	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.231749058 CET	3778	49150	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.231774092 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.231857061 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.231879950 CET	49148	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.231995106 CET	49150	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.233248949 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.233642101 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.469728947 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.469759941 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.469868898 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.469897032 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.473036051 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.473332882 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.592542887 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.592648983 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.592837095 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.592911959 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:19.712222099 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:19.712456942 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.297221899 CET	3778	49154	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.297257900 CET	3778	49152	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.297497988 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.297498941 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.297620058 CET	49154	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.297859907 CET	49152	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.299385071 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.300040960 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.538681030 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.538733006 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.538964987 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.538964987 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.542377949 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.542637110 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.663973093 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.664051056 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.664201975 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.664201975 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:22.788383007 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:22.788414001 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:23.925426006 CET	3778	49158	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:23.925682068 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:23.925683022 CET	49158	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:23.926775932 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.046660900 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:24.046814919 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.048554897 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.168190956 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:24.168313980 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.288053989 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:24.537858963 CET	3778	49156	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:24.538094997 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.538125992 CET	49156	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.539289951 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.778700113 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:24.779006004 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.780215979 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:24.899802923 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:24.900012970 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:25.019500017 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:25.527045012 CET	3778	49160	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:25.527343035 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:25.527405024 CET	49160	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:25.528528929 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:25.648142099 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:25.648374081 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:25.650099039 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:25.771085024 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:25.771306038 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:25.891036987 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.278702974 CET	3778	49164	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.278904915 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.279002905 CET	49164	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.280287027 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.299273968 CET	3778	49162	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.299360991 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.299544096 CET	49162	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.300416946 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.399880886 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.400011063 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.401436090 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.518254995 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.518551111 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.519998074 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.520979881 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.521029949 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.639523983 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.639818907 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:27.640526056 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:27.759521008 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:29.868242979 CET	3778	49166	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:29.868403912 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:29.868424892 CET	3778	49168	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:29.868482113 CET	49166	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:29.868643045 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:29.868643045 CET	49168	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:29.869582891 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:29.869982958 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:30.108376980 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:30.108443975 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:30.108577013 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:30.108608007 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:30.111099958 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:30.111495018 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:30.230743885 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:30.230848074 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:30.230946064 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:30.230999947 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:30.350429058 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:30.350500107 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.220535994 CET	3778	49172	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.220582962 CET	3778	49170	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.220746040 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.220758915 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.220807076 CET	49172	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.220813990 CET	49170	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.221697092 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.221997976 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.460009098 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.460040092 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.460155964 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.460177898 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.462244987 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.462366104 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.581845999 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.581914902 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.581967115 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.581976891 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:32.701647997 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:32.701710939 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:36.574852943 CET	3778	49174	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:36.574863911 CET	3778	49176	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:36.575139046 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.575151920 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.575280905 CET	49176	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.575469017 CET	49174	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.576551914 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.576948881 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.814553022 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:36.814572096 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:36.814752102 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.814762115 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.817931890 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.818180084 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.937479973 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:36.937638044 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:36.937710047 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:36.937750101 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:37.057279110 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:37.057310104 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:37.163712978 CET	42836	443	192.168.2.23	91.189.91.43
Dec 22, 2024 15:47:39.313399076 CET	3778	49180	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:39.313421965 CET	3778	49178	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:39.313610077 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.313611984 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.313708067 CET	49178	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.313904047 CET	49180	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.315133095 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.315567970 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.434595108 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:39.434807062 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.436629057 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.552886963 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:39.553024054 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.554791927 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.556246996 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:39.556318045 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.675124884 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:39.675407887 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:39.676495075 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:39.794964075 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:42.653191090 CET	3778	49184	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:42.653311968 CET	3778	49182	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:42.653322935 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.653410912 CET	49184	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.653640985 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.653749943 CET	49182	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.654098034 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.654925108 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.774030924 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:42.774338961 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.776010990 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.892843962 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:42.893163919 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.895040989 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:42.895482063 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:42.895551920 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:43.014952898 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:43.015088081 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:43.015574932 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:43.135248899 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.476890087 CET	3778	49186	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.476907969 CET	3778	49188	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.477034092 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.477037907 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.477113962 CET	49186	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.477148056 CET	49188	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.478234053 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.478682995 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.632697105 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.632802963 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.632822037 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.632988930 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.635468960 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.635874033 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.757668972 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.757821083 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.757929087 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.758002996 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:45.880369902 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:45.880538940 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.048373938 CET	3778	49190	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.048508883 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.048535109 CET	49190	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.048638105 CET	3778	49192	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.048805952 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.049115896 CET	49192	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.049420118 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.050232887 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.287763119 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.287781954 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.287919998 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.287928104 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.290503979 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.290891886 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.409943104 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.410079956 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.410295963 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.410353899 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:48.529653072 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:48.529892921 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.218729019 CET	3778	49196	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.218744993 CET	3778	49194	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.218878031 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.218887091 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.218961000 CET	49194	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.218964100 CET	49196	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.220082998 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.220261097 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.458081961 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.458096027 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.458257914 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.458348989 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.461407900 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.461642027 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.580899000 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.581084013 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.581160069 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.581285000 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:52.700814009 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:52.700874090 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:53.979479074 CET	3778	49198	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:53.979500055 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:53.979687929 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:53.979701996 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:53.979782104 CET	49198	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:53.979813099 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:53.981277943 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:53.981515884 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.213762999 CET	3778	49200	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:54.214054108 CET	49200	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.221365929 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:54.221376896 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:54.221466064 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.221525908 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.224137068 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.224503040 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.343652010 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:54.343772888 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.344002008 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:54.344088078 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:54.465646029 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:54.465933084 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:55.776897907 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:55.776927948 CET	3778	49204	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:55.777108908 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:55.777131081 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:55.777266979 CET	49204	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:55.777456045 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:55.778388023 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:55.779290915 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.009951115 CET	3778	49202	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:56.010083914 CET	49202	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.010919094 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:56.010932922 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:56.011033058 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.011046886 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.013484001 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.014301062 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.132914066 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:56.133007050 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.133820057 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:56.133889914 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:56.253118038 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:56.253736973 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:57.563323021 CET	3778	49208	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:57.563595057 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:57.563649893 CET	49208	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:57.564590931 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:57.684196949 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:57.684428930 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:57.686172009 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:57.805906057 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:57.806116104 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:57.925748110 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:58.277007103 CET	3778	49206	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:58.277312994 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:58.277409077 CET	49206	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:58.278538942 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:58.399583101 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:58.399768114 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:58.402159929 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:58.523092031 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:47:58.523309946 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:47:58.645515919 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:00.872236967 CET	3778	49210	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:00.872546911 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:00.872678995 CET	49210	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:00.873620987 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:00.883044958 CET	3778	49212	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:00.883116007 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:00.883194923 CET	49212	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:00.883824110 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:00.993254900 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:00.993514061 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:00.995032072 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:01.111901045 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:01.111982107 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:01.113643885 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:01.114532948 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:01.114605904 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:01.233624935 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:01.233769894 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:01.234617949 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:01.354444027 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.458642006 CET	3778	49214	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.458816051 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.458920002 CET	49214	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.459095955 CET	3778	49216	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.459197044 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.459287882 CET	49216	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.460417986 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.460582018 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.698065996 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.698098898 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.698363066 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.698436975 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.701154947 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.701572895 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.821377039 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.821415901 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.821528912 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.821552992 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:04.941128016 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:04.941180944 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.278973103 CET	3778	49220	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.279078960 CET	3778	49218	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.279192924 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.279215097 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.279228926 CET	49220	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.279357910 CET	49218	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.280714035 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.281316042 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.498236895 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.498419046 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.498562098 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.498568058 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.500844002 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.501286983 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.620389938 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.620538950 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.620790958 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.620882034 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:06.740472078 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:06.740674019 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:07.883424997 CET	3778	49224	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:07.883605957 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:07.883675098 CET	49224	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:07.884453058 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.005213022 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:08.005388021 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.006966114 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.126656055 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:08.126951933 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.246871948 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:08.367183924 CET	3778	49222	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:08.367292881 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.367356062 CET	49222	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.367996931 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.606585026 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:08.606838942 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.608668089 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.728247881 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:08.728436947 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:08.848057985 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.140017986 CET	3778	49228	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.140317917 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.140476942 CET	49228	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.141391993 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.141904116 CET	3778	49226	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.141993999 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.142093897 CET	49226	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.142796993 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.260967970 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.261217117 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.263343096 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.379745007 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.379957914 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.381947994 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.382889032 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.382942915 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.502046108 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.502295971 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:10.503271103 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:10.622005939 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:11.935780048 CET	3778	49232	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:11.936065912 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:11.936136007 CET	49232	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:11.937024117 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:12.057121038 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:12.057245970 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:12.058233976 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:12.178009987 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:12.178271055 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:12.297930002 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:13.747138977 CET	3778	49230	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:13.747277975 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.747370958 CET	49230	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.748250008 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.748955965 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:13.749037981 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.749089956 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.749655962 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.981797934 CET	3778	49234	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:13.981920004 CET	49234	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.986737967 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:13.986787081 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:13.986846924 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.986892939 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.989561081 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:13.989765882 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:14.109870911 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:14.109973907 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:14.110093117 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:14.110093117 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:14.229959011 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:14.229989052 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:15.567013979 CET	3778	49236	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:15.567166090 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.567222118 CET	49236	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.568056107 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.568547964 CET	3778	49238	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:15.568586111 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.568638086 CET	49238	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.569169044 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.687850952 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:15.688013077 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.689184904 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.808623075 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:15.808712006 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.810190916 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.921716928 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:15.921821117 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:15.929693937 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:15.929758072 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:16.043381929 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:16.051393986 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.363818884 CET	3778	49240	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.363966942 CET	3778	49242	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.364170074 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.364170074 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.364269018 CET	49240	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.364418983 CET	49242	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.365401030 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.365720987 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.603594065 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.603656054 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.603776932 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.603790998 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.606792927 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.607072115 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.726286888 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.726491928 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.726686001 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.726748943 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:17.846035957 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:17.846219063 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:19.670655012 CET	3778	49244	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:19.670813084 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.670842886 CET	49244	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.670862913 CET	3778	49246	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:19.670914888 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.670969009 CET	49246	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.672389030 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.672807932 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.792001009 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:19.792196035 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.792277098 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:19.792356014 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.796498060 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.796833038 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.916251898 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:19.916405916 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:19.916634083 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:19.916716099 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:20.035936117 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:20.036326885 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:21.070782900 CET	3778	49250	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:21.071052074 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.071125031 CET	49250	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.072295904 CET	49252	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.192317009 CET	3778	49252	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:21.192704916 CET	49252	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.194267035 CET	49252	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.313841105 CET	3778	49252	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:21.314126968 CET	49252	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.434007883 CET	3778	49252	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:21.654133081 CET	3778	49248	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:21.654305935 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.654385090 CET	49248	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.655297995 CET	49254	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.893564939 CET	3778	49254	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:21.893857956 CET	49254	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:21.895593882 CET	49254	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:22.015429020 CET	3778	49254	89.213.158.208	192.168.2.23
Dec 22, 2024 15:48:22.015655994 CET	49254	3778	192.168.2.23	89.213.158.208
Dec 22, 2024 15:48:22.135520935 CET	3778	49254	89.213.158.208	192.168.2.23

System Behavior

Analysis Process: Space.sh4.elf PID: 6257, Parent PID: 6179

General

Start time (UTC):	14:46:12
Start date (UTC):	22/12/2024
Path:	/tmp/Space.sh4.elf
Arguments:	/tmp/Space.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6259, Parent PID: 6257

General

Start time (UTC):	14:46:12
Start date (UTC):	22/12/2024
Path:	/tmp/Space.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6261, Parent PID: 6259

General

Start time (UTC):	14:46:12
Start date (UTC):	22/12/2024
Path:	/tmp/Space.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6263, Parent PID: 6259

General

Start time (UTC):	14:46:12
Start date (UTC):	22/12/2024
Path:	/tmp/Space.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6271, Parent PID: 6257

General

Start time (UTC):	14:46:19
Start date (UTC):	22/12/2024
Path:	/tmp/Space.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6273, Parent PID: 6257

General

Start time (UTC):	14:46:19
Start date (UTC):	22/12/2024
Path:	/tmp/Space.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.sh4.elf PID: 6257, Parent PID: 6179

General

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6259, Parent PID: 6257

General

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6261, Parent PID: 6259

General

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6263, Parent PID: 6259

General

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6271, Parent PID: 6257

General

Chronological Activities

Analysis Process: Space.sh4.elf PID: 6273, Parent PID: 6257

General

Chronological Activities

Linux Analysis Report
Space.sh4.elf