Edit tour

Linux Analysis Report
Space.x86_64.elf

Overview

General Information

Sample name:	Space.x86_64.elf
Analysis ID:	1579484
MD5:	3c733927caaa196b216421abb32e2632
SHA1:	0c2443725d846b98d0f43fd04d914fc9f0848595
SHA256:	5c26d99fcb4734a9fa1e742d0a2b79de476ad150afd2ab87212766a458eb3475
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579484
Start date and time:	2024-12-22 15:53:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.x86_64.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.x86_64.elf
PID:	5824
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.x86_64.elf (PID: 5824, Parent: 5747, MD5: 3c733927caaa196b216421abb32e2632) Arguments: /tmp/Space.x86_64.elf

Space.x86_64.elf New Fork (PID: 5825, Parent: 5824)

Space.x86_64.elf New Fork (PID: 5826, Parent: 5825)

Space.x86_64.elf New Fork (PID: 5827, Parent: 5825)

Space.x86_64.elf New Fork (PID: 5831, Parent: 5824)

Space.x86_64.elf New Fork (PID: 5832, Parent: 5824)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5826.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5826.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5824.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5831.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5824.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5831.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5825.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5825.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: Space.x86_64.elf PID: 5824	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86_64.elf PID: 5824	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1306:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x131a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1342:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1356:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x136a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x137e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1392:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1432:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1446:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86_64.elf PID: 5825	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86_64.elf PID: 5825	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x506:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x52e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x542:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x556:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x592:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x61e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x632:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x646:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x65a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x66e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86_64.elf PID: 5826	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1000:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1014:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1028:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86_64.elf PID: 5831	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.x86_64.elf PID: 5831	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x141f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1433:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1447:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1483:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1497:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1537:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1573:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1587:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 58 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.x86_64.elf	ReversingLabs: Detection: 39%
Source: Space.x86_64.elf	Virustotal: Detection: 37%			Perma Link

Machine Learning detection for sample

Source: Space.x86_64.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.15:56104 -> 89.213.158.208:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.213.158.208

Source: Space.x86_64.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5824, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5825, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5826, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86_64.elf PID: 5831, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x100000

Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5824, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5825, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5826, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86_64.elf PID: 5831, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1333/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1695/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/911/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1591/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/5827/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1585/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/804/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/5824/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/3407/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1484/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/133/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1479/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/931/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1595/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/812/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/933/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/3419/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/265/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/145/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/266/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/267/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/268/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/3303/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/269/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1486/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/1806/status	Jump to behavior
Source: /tmp/Space.x86_64.elf (PID: 5824)	File opened: /proc/3440/status	Jump to behavior

Source: Space.x86_64.elf

Submission file: segment LOAD with 7.9604 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.x86_64.elf PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86_64.elf PID: 5825, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86_64.elf PID: 5831, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5826.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5824.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5831.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5825.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Space.x86_64.elf PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86_64.elf PID: 5825, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.x86_64.elf PID: 5831, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.x86_64.elf	39%	ReversingLabs	Linux.Backdoor.Mirai
Space.x86_64.elf	37%	Virustotal		Browse
Space.x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.x86_64.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.213.158.208	unknown	United Kingdom		8851	EDGEtaGCIComGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.213.158.208	Space.arm.elf	Get hash	malicious	Mirai	Browse
	Space.mpsl.elf	Get hash	malicious	Mirai	Browse
	Space.spc.elf	Get hash	malicious	Mirai	Browse
	Space.sh4.elf	Get hash	malicious	Mirai	Browse
	Space.ppc.elf	Get hash	malicious	Mirai	Browse
	Space.i686.elf	Get hash	malicious	Mirai	Browse
	Space.mips.elf	Get hash	malicious	Mirai	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EDGEtaGCIComGB	Space.arm.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.mpsl.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.spc.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.sh4.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.ppc.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.i686.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.mips.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	Space.x86.elf	Get hash	malicious	Mirai	Browse	89.213.158.208
	ppc.elf	Get hash	malicious	Mirai	Browse	77.107.120.29

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.958349467127726
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.x86_64.elf
File size:	36'932 bytes
MD5:	3c733927caaa196b216421abb32e2632
SHA1:	0c2443725d846b98d0f43fd04d914fc9f0848595
SHA256:	5c26d99fcb4734a9fa1e742d0a2b79de476ad150afd2ab87212766a458eb3475
SHA512:	531651740555a3e4291b9de2a326a4dc5e69088e64264827f1a1f32be8882db930f183e8a145967e8d0976119e3e3d21ff95b9fdd80f3a20b63b801b3d790f08
SSDEEP:	768:Wkjvsa/voIrhf79v0ewoZ6SbFGx3aSbYwVmUx0nZB:NzHzJyKZ6Scx3a0Y2MZB
TLSH:	DCF2E1AB9537F9BCEC69C4BB4C2D5350E9A055A3AC1506EF9CEC33AD157379C0A80760
File Content Preview:	.ELF..............>......~......@...................@.8...@.....................................D.......D................................VQ......VQ.............................Q.td....................................................BGI.UPX!D.......P'..P'.

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x107e08
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x8f44	0x8f44	7.9604	0x5	R E	0x100000
LOAD	0x6e8	0x5156e8	0x5156e8	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 15:54:55.542294025 CET	56104	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:55.662192106 CET	3778	56104	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:55.662291050 CET	56104	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:55.663184881 CET	56104	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:55.782795906 CET	3778	56104	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:55.782854080 CET	56104	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:55.902456045 CET	3778	56104	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:57.306595087 CET	3778	56104	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:57.306931973 CET	56104	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:57.306932926 CET	56104	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:57.307626009 CET	56106	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:57.427223921 CET	3778	56106	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:57.427573919 CET	56106	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:57.428493023 CET	56106	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:57.548129082 CET	3778	56106	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:57.548418045 CET	56106	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:57.668000937 CET	3778	56106	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:59.578721046 CET	3778	56106	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:59.579108953 CET	56106	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:59.579108953 CET	56106	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:59.579647064 CET	56108	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:59.699373960 CET	3778	56108	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:59.699556112 CET	56108	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:59.700320959 CET	56108	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:59.821180105 CET	3778	56108	89.213.158.208	192.168.2.15
Dec 22, 2024 15:54:59.821367025 CET	56108	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:54:59.942229033 CET	3778	56108	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:01.007781982 CET	56110	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:01.127952099 CET	3778	56110	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:01.128040075 CET	56110	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:01.128880978 CET	56110	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:01.248467922 CET	3778	56110	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:01.248564005 CET	56110	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:01.368336916 CET	3778	56110	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:02.978977919 CET	3778	56110	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:02.979157925 CET	56110	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:02.979157925 CET	56110	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:02.979654074 CET	56112	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.099957943 CET	3778	56112	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:03.100069046 CET	56112	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.100707054 CET	56112	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.220432997 CET	3778	56112	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:03.220702887 CET	56112	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.340343952 CET	3778	56112	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:03.345133066 CET	3778	56108	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:03.345251083 CET	56108	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.345298052 CET	56108	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.345877886 CET	56114	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.466572046 CET	3778	56114	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:03.466700077 CET	56114	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.467710972 CET	56114	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.588433981 CET	3778	56114	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:03.588615894 CET	56114	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:03.708226919 CET	3778	56114	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.591604948 CET	3778	56112	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.591835976 CET	3778	56114	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.591860056 CET	56112	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.591898918 CET	56114	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.591898918 CET	56112	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.592009068 CET	56114	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.592556000 CET	56116	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.592715979 CET	56118	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.712202072 CET	3778	56116	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.712287903 CET	3778	56118	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.712313890 CET	56116	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.712327957 CET	56118	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.713713884 CET	56116	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.713807106 CET	56118	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.833446026 CET	3778	56116	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.833498955 CET	3778	56118	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.833535910 CET	56116	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.833549023 CET	56118	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:05.953995943 CET	3778	56116	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:05.954025984 CET	3778	56118	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.481729984 CET	3778	56118	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.481892109 CET	56118	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.481893063 CET	56118	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.482008934 CET	3778	56116	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.482157946 CET	56116	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.482247114 CET	56116	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.482785940 CET	56120	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.483616114 CET	56122	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.602428913 CET	3778	56120	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.602593899 CET	56120	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.603811026 CET	56120	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.721707106 CET	3778	56122	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.721883059 CET	56122	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.722985983 CET	56122	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.723668098 CET	3778	56120	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.723757982 CET	56120	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.842595100 CET	3778	56122	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.842727900 CET	56122	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:07.843300104 CET	3778	56120	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:07.962476969 CET	3778	56122	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.375134945 CET	3778	56122	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.375180006 CET	3778	56120	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.375484943 CET	56122	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.375485897 CET	56120	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.375485897 CET	56122	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.375546932 CET	56120	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.376220942 CET	56124	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.376451015 CET	56126	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.496018887 CET	3778	56124	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.496114016 CET	56124	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.496854067 CET	56124	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.615209103 CET	3778	56126	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.615403891 CET	56126	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.616112947 CET	56126	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.616970062 CET	3778	56124	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.617043972 CET	56124	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.735630989 CET	3778	56126	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.735757113 CET	56126	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:09.738220930 CET	3778	56124	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:09.855541945 CET	3778	56126	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:11.487766981 CET	3778	56126	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:11.488008022 CET	56126	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:11.488008022 CET	56126	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:11.488605976 CET	56128	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:11.608330011 CET	3778	56128	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:11.608481884 CET	56128	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:11.609277010 CET	56128	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:11.728863001 CET	3778	56128	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:11.729052067 CET	56128	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:11.849436045 CET	3778	56128	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:12.395802975 CET	3778	56124	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:12.396090984 CET	56124	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:12.396171093 CET	56124	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:12.397001028 CET	56130	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:12.516674995 CET	3778	56130	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:12.516866922 CET	56130	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:12.517570972 CET	56130	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:12.637173891 CET	3778	56130	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:12.637393951 CET	56130	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:12.757256985 CET	3778	56130	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.188935995 CET	3778	56128	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.189045906 CET	3778	56130	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.189433098 CET	56128	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.189433098 CET	56128	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.189433098 CET	56130	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.189433098 CET	56130	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.190476894 CET	56132	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.190752983 CET	56134	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.326874018 CET	3778	56132	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.326906919 CET	3778	56134	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.327076912 CET	56132	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.327076912 CET	56134	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.329080105 CET	56134	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.329204082 CET	56132	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.448590040 CET	3778	56134	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.448735952 CET	3778	56132	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.448817968 CET	56134	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.448817968 CET	56132	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:14.568595886 CET	3778	56134	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:14.568641901 CET	3778	56132	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:15.982723951 CET	3778	56134	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:15.982867956 CET	56134	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:15.982867956 CET	56134	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:15.983246088 CET	3778	56132	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:15.983310938 CET	56132	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:15.983371973 CET	56132	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:15.983392000 CET	56136	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:15.983980894 CET	56138	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:16.103012085 CET	3778	56136	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:16.103096962 CET	56136	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:16.103545904 CET	3778	56138	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:16.103591919 CET	56138	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:16.105758905 CET	56136	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:16.105920076 CET	56138	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:16.225178003 CET	3778	56136	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:16.225271940 CET	56136	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:16.225353003 CET	3778	56138	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:16.225411892 CET	56138	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:16.344995022 CET	3778	56136	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:16.345027924 CET	3778	56138	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:18.931675911 CET	3778	56138	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:18.931721926 CET	3778	56136	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:18.931915045 CET	56138	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:18.931915045 CET	56136	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:18.931915045 CET	56136	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:18.932909012 CET	56140	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:18.933188915 CET	56138	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:18.934343100 CET	56142	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:19.052525043 CET	3778	56140	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:19.052843094 CET	56140	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:19.053903103 CET	3778	56142	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:19.053971052 CET	56142	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:19.054368019 CET	56140	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:19.055624962 CET	56142	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:19.173878908 CET	3778	56140	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:19.174320936 CET	56140	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:19.175177097 CET	3778	56142	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:19.175246954 CET	56142	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:19.293975115 CET	3778	56140	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:19.294763088 CET	3778	56142	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:20.677356005 CET	3778	56142	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:20.677643061 CET	56142	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:20.677643061 CET	56142	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:20.678633928 CET	56144	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:20.799246073 CET	3778	56144	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:20.799618006 CET	56144	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:20.801131010 CET	56144	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:20.920769930 CET	3778	56144	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:20.920886993 CET	56144	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:21.040591955 CET	3778	56144	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:21.468137980 CET	3778	56140	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:21.468305111 CET	56140	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:21.468305111 CET	56140	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:21.468985081 CET	56146	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:21.590169907 CET	3778	56146	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:21.590425014 CET	56146	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:21.591831923 CET	56146	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:21.711635113 CET	3778	56146	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:21.711777925 CET	56146	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:21.831746101 CET	3778	56146	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:23.807607889 CET	3778	56144	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:23.807826042 CET	3778	56146	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:23.807873011 CET	56144	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.807895899 CET	56144	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.807907104 CET	56146	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.807982922 CET	56146	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.809097052 CET	56148	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.809468031 CET	56150	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.928730011 CET	3778	56148	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:23.928818941 CET	56148	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.928972960 CET	3778	56150	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:23.929023027 CET	56150	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.931845903 CET	56148	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:23.932040930 CET	56150	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:24.052093029 CET	3778	56148	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:24.052229881 CET	56148	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:24.052618027 CET	3778	56150	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:24.052683115 CET	56150	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:24.171972990 CET	3778	56148	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:24.172216892 CET	3778	56150	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:25.621963978 CET	3778	56150	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:25.622227907 CET	56150	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:25.622271061 CET	56150	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:25.622868061 CET	56152	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:25.742441893 CET	3778	56152	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:25.742763042 CET	56152	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:25.743890047 CET	56152	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:25.864381075 CET	3778	56152	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:25.864767075 CET	56152	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:25.984317064 CET	3778	56152	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:27.393767118 CET	3778	56148	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:27.393913984 CET	56148	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:27.394114017 CET	56148	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:27.395226002 CET	56154	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:27.515069962 CET	3778	56154	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:27.515294075 CET	56154	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:27.517532110 CET	56154	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:27.637011051 CET	3778	56154	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:27.637253046 CET	56154	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:27.756778002 CET	3778	56154	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:28.800524950 CET	3778	56154	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:28.800726891 CET	56154	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:28.800771952 CET	56154	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:28.801764011 CET	56156	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:28.921490908 CET	3778	56156	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:28.921746969 CET	56156	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:28.923563957 CET	56156	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.043097019 CET	3778	56156	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:29.043381929 CET	56156	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.162925959 CET	3778	56156	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:29.366583109 CET	3778	56152	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:29.366827965 CET	56152	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.366899014 CET	56152	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.367845058 CET	56158	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.487549067 CET	3778	56158	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:29.487823009 CET	56158	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.489331961 CET	56158	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.608913898 CET	3778	56158	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:29.609159946 CET	56158	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:29.729073048 CET	3778	56158	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.158446074 CET	3778	56156	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.158569098 CET	3778	56158	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.158869982 CET	56158	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.158871889 CET	56158	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.158871889 CET	56156	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.158996105 CET	56156	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.160106897 CET	56160	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.160523891 CET	56162	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.279692888 CET	3778	56160	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.280019045 CET	56160	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.282197952 CET	56160	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.397726059 CET	3778	56162	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.397965908 CET	56162	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.399727106 CET	56162	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.401612997 CET	3778	56160	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.401688099 CET	56160	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.519345999 CET	3778	56162	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.519656897 CET	56162	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:31.521217108 CET	3778	56160	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:31.639334917 CET	3778	56162	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:33.617625952 CET	3778	56160	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:33.617718935 CET	3778	56162	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:33.617878914 CET	56160	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.617878914 CET	56162	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.617878914 CET	56160	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.617995977 CET	56162	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.619148970 CET	56164	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.619505882 CET	56166	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.738732100 CET	3778	56164	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:33.738817930 CET	56164	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.740498066 CET	56164	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.857202053 CET	3778	56166	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:33.857399940 CET	56166	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.858800888 CET	56166	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.859925985 CET	3778	56164	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:33.859999895 CET	56164	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.978401899 CET	3778	56166	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:33.978470087 CET	56166	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:33.979510069 CET	3778	56164	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:34.098189116 CET	3778	56166	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.175470114 CET	3778	56164	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.175568104 CET	3778	56166	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.175694942 CET	56164	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.175694942 CET	56164	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.175694942 CET	56166	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.175694942 CET	56166	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.176939964 CET	56168	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.177364111 CET	56170	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.297157049 CET	3778	56168	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.297563076 CET	56168	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.298866034 CET	56168	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.414824009 CET	3778	56170	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.415049076 CET	56170	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.416466951 CET	56170	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.419270992 CET	3778	56168	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.419348001 CET	56168	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.537014961 CET	3778	56170	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.537333965 CET	56170	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:37.539289951 CET	3778	56168	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:37.657265902 CET	3778	56170	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:38.989799976 CET	3778	56170	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:38.989936113 CET	3778	56168	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:38.990070105 CET	56170	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:38.990070105 CET	56168	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:38.990070105 CET	56170	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:38.990159035 CET	56168	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:38.991364002 CET	56172	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:38.991713047 CET	56174	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:39.229597092 CET	3778	56172	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:39.229638100 CET	3778	56174	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:39.229780912 CET	56172	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:39.229827881 CET	56174	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:39.232247114 CET	56172	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:39.232445002 CET	56174	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:39.352169991 CET	3778	56172	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:39.352380991 CET	3778	56174	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:39.352440119 CET	56172	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:39.352514029 CET	56174	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:39.472179890 CET	3778	56172	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:39.472210884 CET	3778	56174	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:41.349476099 CET	3778	56172	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:41.349699020 CET	56172	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:41.349786997 CET	56172	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:41.350821018 CET	56176	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:41.471164942 CET	3778	56176	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:41.471256018 CET	56176	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:41.473304987 CET	56176	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:41.594743967 CET	3778	56176	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:41.594898939 CET	56176	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:41.714524984 CET	3778	56176	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:42.254345894 CET	3778	56174	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:42.254555941 CET	56174	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:42.254642010 CET	56174	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:42.255642891 CET	56178	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:42.377070904 CET	3778	56178	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:42.377183914 CET	56178	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:42.378726006 CET	56178	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:42.498259068 CET	3778	56178	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:42.498392105 CET	56178	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:42.618042946 CET	3778	56178	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:43.281364918 CET	3778	56176	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:43.281606913 CET	56176	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:43.281755924 CET	56176	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:43.282625914 CET	56180	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:43.402290106 CET	3778	56180	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:43.402456999 CET	56180	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:43.404238939 CET	56180	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:43.523821115 CET	3778	56180	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:43.524055958 CET	56180	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:43.644512892 CET	3778	56180	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:44.651257992 CET	3778	56178	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:44.651634932 CET	56178	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:44.651710033 CET	56178	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:44.652693033 CET	56182	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:44.772305965 CET	3778	56182	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:44.772628069 CET	56182	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:44.774334908 CET	56182	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:44.894530058 CET	3778	56182	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:44.894710064 CET	56182	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:45.014431000 CET	3778	56182	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.135651112 CET	3778	56182	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.135947943 CET	56182	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.136075974 CET	56182	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.136884928 CET	56184	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.256449938 CET	3778	56184	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.256619930 CET	56184	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.258407116 CET	56184	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.378032923 CET	3778	56184	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.378185987 CET	56184	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.497886896 CET	3778	56184	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.505290031 CET	3778	56180	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.505489111 CET	56180	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.505547047 CET	56180	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.506513119 CET	56186	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.627010107 CET	3778	56186	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.627191067 CET	56186	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.628753901 CET	56186	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.748354912 CET	3778	56186	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:46.748482943 CET	56186	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:46.868192911 CET	3778	56186	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:47.854995012 CET	3778	56184	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:47.855323076 CET	56184	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:47.855375051 CET	56184	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:47.856442928 CET	56188	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:47.976094007 CET	3778	56188	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:47.976258993 CET	56188	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:47.977524996 CET	56188	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.097152948 CET	3778	56188	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:48.097357988 CET	56188	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.217144012 CET	3778	56188	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:48.396279097 CET	3778	56186	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:48.396456003 CET	56186	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.396497965 CET	56186	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.397612095 CET	56190	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.517621994 CET	3778	56190	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:48.517896891 CET	56190	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.519943953 CET	56190	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.639981985 CET	3778	56190	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:48.640157938 CET	56190	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:48.759916067 CET	3778	56190	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:51.382196903 CET	3778	56190	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:51.382422924 CET	56190	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:51.382534981 CET	56190	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:51.383727074 CET	56192	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:51.503365040 CET	3778	56192	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:51.503575087 CET	56192	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:51.505394936 CET	56192	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:51.624968052 CET	3778	56192	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:51.625170946 CET	56192	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:51.744879007 CET	3778	56192	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:52.419353008 CET	3778	56188	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:52.419585943 CET	56188	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:52.419717073 CET	56188	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:52.420814037 CET	56194	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:52.540385962 CET	3778	56194	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:52.540579081 CET	56194	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:52.541948080 CET	56194	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:52.661792040 CET	3778	56194	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:52.662053108 CET	56194	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:52.781677961 CET	3778	56194	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.009414911 CET	3778	56192	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.009444952 CET	3778	56194	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.009609938 CET	56192	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.009651899 CET	56194	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.009651899 CET	56192	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.009844065 CET	56194	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.010865927 CET	56196	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.011238098 CET	56198	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.130716085 CET	3778	56196	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.130836964 CET	3778	56198	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.130974054 CET	56196	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.130974054 CET	56198	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.134407043 CET	56198	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.134635925 CET	56196	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.253981113 CET	3778	56198	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.254153013 CET	3778	56196	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.254256964 CET	56198	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.254256964 CET	56196	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:55.374320030 CET	3778	56198	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:55.374349117 CET	3778	56196	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.455996037 CET	3778	56198	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.456077099 CET	3778	56196	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.456362963 CET	56198	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.456362963 CET	56196	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.456460953 CET	56198	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.456569910 CET	56196	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.457936049 CET	56200	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.458388090 CET	56202	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.577591896 CET	3778	56200	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.577728033 CET	56200	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.577867031 CET	3778	56202	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.577934027 CET	56202	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.580349922 CET	56200	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.580545902 CET	56202	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.700026989 CET	3778	56200	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.700103998 CET	3778	56202	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.700165033 CET	56200	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.700165033 CET	56202	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:55:58.819895029 CET	3778	56200	89.213.158.208	192.168.2.15
Dec 22, 2024 15:55:58.819925070 CET	3778	56202	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:00.381231070 CET	3778	56202	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:00.381596088 CET	56202	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:00.381695032 CET	56202	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:00.382816076 CET	56204	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:00.502712011 CET	3778	56204	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:00.502988100 CET	56204	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:00.504796028 CET	56204	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:00.624566078 CET	3778	56204	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:00.624695063 CET	56204	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:00.744363070 CET	3778	56204	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:01.226731062 CET	3778	56200	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:01.226949930 CET	56200	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:01.227045059 CET	56200	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:01.228104115 CET	56206	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:01.348222971 CET	3778	56206	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:01.348341942 CET	56206	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:01.349849939 CET	56206	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:01.470531940 CET	3778	56206	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:01.470664024 CET	56206	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:01.590369940 CET	3778	56206	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.020255089 CET	3778	56204	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.020616055 CET	56204	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.020616055 CET	56204	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.021714926 CET	56208	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.039575100 CET	3778	56206	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.039823055 CET	56206	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.039907932 CET	56206	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.040975094 CET	56210	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.141848087 CET	3778	56208	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.142076015 CET	56208	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.143980026 CET	56208	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.260627031 CET	3778	56210	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.260957956 CET	56210	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.262351036 CET	56210	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.263685942 CET	3778	56208	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.263751030 CET	56208	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.381941080 CET	3778	56210	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.382065058 CET	56210	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:03.383285999 CET	3778	56208	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:03.509406090 CET	3778	56210	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:05.053136110 CET	3778	56210	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:05.053267002 CET	56210	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:05.053455114 CET	56210	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:05.054342985 CET	56212	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:05.173973083 CET	3778	56212	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:05.174299002 CET	56212	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:05.175832033 CET	56212	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:05.295527935 CET	3778	56212	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:05.295756102 CET	56212	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:05.415518999 CET	3778	56212	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:06.022135019 CET	3778	56208	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:06.022398949 CET	56208	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:06.022490978 CET	56208	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:06.023377895 CET	56214	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:06.142951965 CET	3778	56214	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:06.143076897 CET	56214	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:06.144905090 CET	56214	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:06.264492035 CET	3778	56214	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:06.264729977 CET	56214	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:06.384542942 CET	3778	56214	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:07.835501909 CET	3778	56212	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:07.835686922 CET	3778	56214	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:07.835736036 CET	56212	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.835773945 CET	56214	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.835774899 CET	56212	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.835869074 CET	56214	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.837286949 CET	56216	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.837709904 CET	56218	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.957020998 CET	3778	56216	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:07.957134962 CET	56216	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.957341909 CET	3778	56218	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:07.957393885 CET	56218	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.958960056 CET	56216	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:07.959110022 CET	56218	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:08.078598976 CET	3778	56216	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:08.078681946 CET	56216	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:08.078723907 CET	3778	56218	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:08.078767061 CET	56218	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:08.198318005 CET	3778	56216	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:08.198369026 CET	3778	56218	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:09.668011904 CET	3778	56218	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:09.668081045 CET	3778	56216	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:09.668329954 CET	56218	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.668329954 CET	56216	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.668415070 CET	56218	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.668469906 CET	56216	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.670072079 CET	56220	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.670238018 CET	56222	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.908600092 CET	3778	56220	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:09.908638954 CET	3778	56222	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:09.908791065 CET	56220	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.908791065 CET	56222	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.911185980 CET	56220	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:09.911542892 CET	56222	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:10.030725956 CET	3778	56220	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:10.030895948 CET	56220	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:10.031018019 CET	3778	56222	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:10.031117916 CET	56222	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:10.153001070 CET	3778	56220	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:10.153033018 CET	3778	56222	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:11.948932886 CET	3778	56220	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:11.949151039 CET	56220	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:11.949151039 CET	56220	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:11.949949980 CET	56224	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.069649935 CET	3778	56224	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:12.069782019 CET	56224	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.070774078 CET	56224	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.190515995 CET	3778	56224	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:12.190722942 CET	56224	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.310430050 CET	3778	56224	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:12.867392063 CET	3778	56222	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:12.867522001 CET	56222	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.867561102 CET	56222	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.868246078 CET	56226	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.987879038 CET	3778	56226	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:12.988038063 CET	56226	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:12.989273071 CET	56226	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:13.108843088 CET	3778	56226	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:13.109142065 CET	56226	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:13.229228020 CET	3778	56226	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:14.691674948 CET	3778	56224	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:14.691962957 CET	56224	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:14.692054033 CET	56224	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:14.693021059 CET	56228	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:14.814599037 CET	3778	56228	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:14.814861059 CET	56228	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:14.816143990 CET	56228	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:14.937869072 CET	3778	56228	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:14.938100100 CET	56228	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:15.062436104 CET	3778	56228	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.489299059 CET	3778	56226	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.489396095 CET	3778	56228	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.489506006 CET	56226	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.489506006 CET	56226	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.489595890 CET	56228	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.489595890 CET	56228	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.490799904 CET	56230	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.491168976 CET	56232	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.611183882 CET	3778	56230	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.611319065 CET	56230	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.611392975 CET	3778	56232	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.611484051 CET	56232	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.613918066 CET	56230	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.614104986 CET	56232	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.733475924 CET	3778	56230	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.733625889 CET	3778	56232	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.733634949 CET	56230	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.733793020 CET	56232	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:16.853346109 CET	3778	56230	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:16.853507042 CET	3778	56232	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.260715008 CET	3778	56232	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.260742903 CET	3778	56230	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.261034012 CET	56230	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.261050940 CET	56232	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.261130095 CET	56232	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.261277914 CET	56230	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.262972116 CET	56234	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.263159037 CET	56236	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.502194881 CET	3778	56234	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.502228022 CET	3778	56236	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.502563953 CET	56234	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.502609015 CET	56236	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.505408049 CET	56236	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.505678892 CET	56234	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.624910116 CET	3778	56236	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.625121117 CET	56236	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.625195026 CET	3778	56234	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.625323057 CET	56234	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:18.744888067 CET	3778	56236	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:18.744940042 CET	3778	56234	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.033314943 CET	3778	56236	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.033658028 CET	56236	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.033756018 CET	56236	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.034457922 CET	3778	56234	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.034729958 CET	56234	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.034818888 CET	56234	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.035047054 CET	56238	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.035842896 CET	56240	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.155795097 CET	3778	56238	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.155939102 CET	56238	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.156526089 CET	3778	56240	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.156609058 CET	56240	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.158200026 CET	56238	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.158690929 CET	56240	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.277717113 CET	3778	56238	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.277966022 CET	56238	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.278304100 CET	3778	56240	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.278395891 CET	56240	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:20.397559881 CET	3778	56238	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:20.397950888 CET	3778	56240	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:21.914190054 CET	3778	56240	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:21.914212942 CET	3778	56238	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:21.914345026 CET	56240	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:21.914345026 CET	56240	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:21.914424896 CET	56238	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:21.914448023 CET	56238	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:21.915442944 CET	56242	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:21.915580988 CET	56244	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:22.034962893 CET	3778	56242	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:22.035275936 CET	56242	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:22.037288904 CET	56242	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:22.131987095 CET	3778	56244	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:22.132544041 CET	56244	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:22.134179115 CET	56244	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:22.156718969 CET	3778	56242	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:22.156889915 CET	56242	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:22.253937960 CET	3778	56244	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:22.254226923 CET	56244	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:22.276385069 CET	3778	56242	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:22.373825073 CET	3778	56244	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:23.686714888 CET	3778	56244	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:23.687129021 CET	56244	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.687129021 CET	56244	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.687939882 CET	3778	56242	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:23.688169956 CET	56246	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.688174009 CET	56242	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.688216925 CET	56242	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.689096928 CET	56248	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.807694912 CET	3778	56246	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:23.808029890 CET	56246	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.808607101 CET	3778	56248	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:23.808849096 CET	56248	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.810261011 CET	56246	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.810827971 CET	56248	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.929852962 CET	3778	56246	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:23.930085897 CET	56246	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:23.930638075 CET	3778	56248	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:23.930896997 CET	56248	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:24.049669027 CET	3778	56246	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:24.050355911 CET	3778	56248	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.501449108 CET	3778	56248	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.501470089 CET	3778	56246	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.501667976 CET	56248	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.501667976 CET	56248	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.501806021 CET	56246	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.501878977 CET	56246	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.502881050 CET	56250	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.503104925 CET	56252	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.646543026 CET	3778	56250	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.646553993 CET	3778	56252	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.646703005 CET	56250	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.646768093 CET	56252	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.648272991 CET	56250	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.648399115 CET	56252	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.768946886 CET	3778	56250	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.769085884 CET	3778	56252	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.769085884 CET	56250	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.769310951 CET	56252	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:25.888572931 CET	3778	56250	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:25.888832092 CET	3778	56252	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:27.297717094 CET	3778	56250	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:27.298039913 CET	56250	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:27.298039913 CET	56250	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:27.299716949 CET	56254	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:27.419296026 CET	3778	56254	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:27.419783115 CET	56254	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:27.422544956 CET	56254	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:27.542256117 CET	3778	56254	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:27.542526960 CET	56254	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:27.662108898 CET	3778	56254	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:28.409776926 CET	3778	56252	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:28.410312891 CET	56252	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:28.410314083 CET	56252	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:28.411787987 CET	56256	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:28.532548904 CET	3778	56256	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:28.532973051 CET	56256	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:28.534594059 CET	56256	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:28.654333115 CET	3778	56256	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:28.654685020 CET	56256	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:28.776357889 CET	3778	56256	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:29.621150970 CET	3778	56254	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:29.621690989 CET	56254	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:29.621793985 CET	56254	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:29.623148918 CET	56258	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:29.743275881 CET	3778	56258	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:29.743632078 CET	56258	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:29.746123075 CET	56258	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:29.867131948 CET	3778	56258	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:29.867446899 CET	56258	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:29.986937046 CET	3778	56258	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:30.047473907 CET	3778	56256	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:30.047812939 CET	56256	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:30.047812939 CET	56256	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:30.048719883 CET	56260	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:30.170859098 CET	3778	56260	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:30.171166897 CET	56260	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:30.173171997 CET	56260	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:30.292606115 CET	3778	56260	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:30.293118954 CET	56260	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:30.412601948 CET	3778	56260	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:31.764106989 CET	3778	56258	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:31.764240980 CET	3778	56260	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:31.764404058 CET	56258	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.764441013 CET	56258	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.764616013 CET	56260	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.764616013 CET	56260	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.766141891 CET	56262	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.766199112 CET	56264	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.885793924 CET	3778	56262	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:31.885838032 CET	3778	56264	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:31.886152029 CET	56264	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.886279106 CET	56262	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.888870001 CET	56262	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:31.889146090 CET	56264	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:32.008625984 CET	3778	56262	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:32.008888006 CET	3778	56264	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:32.009131908 CET	56262	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:32.009258032 CET	56264	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:32.128807068 CET	3778	56262	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:32.128815889 CET	3778	56264	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.571944952 CET	3778	56264	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.572138071 CET	56264	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.572402954 CET	56264	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.572721004 CET	3778	56262	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.573028088 CET	56262	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.573028088 CET	56262	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.574322939 CET	56266	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.574482918 CET	56268	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.694017887 CET	3778	56266	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.694411039 CET	56266	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.694483042 CET	3778	56268	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.694628000 CET	56268	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.697618961 CET	56266	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.697895050 CET	56268	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.817032099 CET	3778	56266	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.817334890 CET	3778	56268	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.817351103 CET	56266	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.817924023 CET	56268	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:33.936794043 CET	3778	56266	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:33.937410116 CET	3778	56268	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:35.879097939 CET	3778	56266	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:35.879441977 CET	56266	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:35.879559040 CET	56266	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:35.880711079 CET	56270	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.000665903 CET	3778	56270	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:36.001164913 CET	56270	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.002300024 CET	56270	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.123547077 CET	3778	56270	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:36.123840094 CET	56270	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.243541002 CET	3778	56270	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:36.846734047 CET	3778	56268	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:36.847090006 CET	56268	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.847090006 CET	56268	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.848021984 CET	56272	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.967531919 CET	3778	56272	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:36.968048096 CET	56272	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:36.969750881 CET	56272	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:37.089261055 CET	3778	56272	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:37.089618921 CET	56272	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:37.209167004 CET	3778	56272	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:38.007426977 CET	3778	56270	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:38.007769108 CET	56270	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:38.007822990 CET	56270	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:38.009332895 CET	56274	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:38.128938913 CET	3778	56274	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:38.129343987 CET	56274	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:38.131201029 CET	56274	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:38.250870943 CET	3778	56274	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:38.251404047 CET	56274	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:38.371002913 CET	3778	56274	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:39.751368046 CET	3778	56274	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:39.751662016 CET	56274	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:39.751959085 CET	56274	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:39.753374100 CET	56276	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:39.872972012 CET	3778	56276	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:39.873405933 CET	56276	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:39.875638008 CET	56276	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:39.995080948 CET	3778	56276	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:39.995361090 CET	56276	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:40.115060091 CET	3778	56276	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.202689886 CET	3778	56272	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.203118086 CET	56272	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.203118086 CET	56272	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.204051018 CET	56278	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.220675945 CET	3778	56276	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.220736980 CET	56276	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.220736980 CET	56276	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.221163034 CET	56280	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.323606968 CET	3778	56278	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.323834896 CET	56278	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.325737000 CET	56278	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.340730906 CET	3778	56280	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.341013908 CET	56280	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.342554092 CET	56280	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.445156097 CET	3778	56278	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.445440054 CET	56278	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.462054968 CET	3778	56280	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.462263107 CET	56280	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:41.565072060 CET	3778	56278	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:41.582844019 CET	3778	56280	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.311892986 CET	3778	56280	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.311923027 CET	3778	56278	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.312041998 CET	56278	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.312041998 CET	56278	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.312243938 CET	56280	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.312243938 CET	56280	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.312947035 CET	56282	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.313898087 CET	56284	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.432496071 CET	3778	56282	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.432847977 CET	56282	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.433264971 CET	3778	56284	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.433336973 CET	56284	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.435363054 CET	56282	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.435878992 CET	56284	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.554841042 CET	3778	56282	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.555176973 CET	56282	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.555254936 CET	3778	56284	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.555512905 CET	56284	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:43.674721956 CET	3778	56282	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:43.674993038 CET	3778	56284	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.120367050 CET	3778	56284	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.120385885 CET	3778	56282	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.120605946 CET	56284	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.120676041 CET	56282	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.120744944 CET	56282	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.120883942 CET	56284	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.122714043 CET	56286	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.123147011 CET	56288	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.242223024 CET	3778	56286	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.242459059 CET	56286	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.242609978 CET	3778	56288	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.242825985 CET	56288	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.245641947 CET	56286	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.245835066 CET	56288	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.366473913 CET	3778	56286	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.366574049 CET	3778	56288	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.366812944 CET	56286	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.366841078 CET	56288	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:45.486257076 CET	3778	56286	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:45.486300945 CET	3778	56288	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:46.943736076 CET	3778	56286	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:46.943741083 CET	3778	56288	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:46.944037914 CET	56286	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:46.944066048 CET	56286	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:46.944200993 CET	56288	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:46.944201946 CET	56288	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:46.947124958 CET	56290	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:46.947628021 CET	56292	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:47.183383942 CET	3778	56290	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:47.183396101 CET	3778	56292	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:47.183506012 CET	56292	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:47.183790922 CET	56290	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:47.186974049 CET	56290	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:47.187521935 CET	56292	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:47.306741953 CET	3778	56290	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:47.306983948 CET	56290	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:47.307125092 CET	3778	56292	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:47.307190895 CET	56292	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:47.427566051 CET	3778	56290	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:47.427602053 CET	3778	56292	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:48.761562109 CET	3778	56290	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:48.762000084 CET	56290	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:48.762000084 CET	56290	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:48.763726950 CET	56294	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:48.883472919 CET	3778	56294	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:48.883569002 CET	56294	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:48.886440992 CET	56294	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:48.924186945 CET	3778	56292	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:48.924257994 CET	56292	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:48.924480915 CET	56292	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:48.926611900 CET	56296	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:49.005944967 CET	3778	56294	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:49.006059885 CET	56294	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:49.046097994 CET	3778	56296	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:49.046356916 CET	56296	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:49.049319029 CET	56296	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:49.125792027 CET	3778	56294	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:49.168740988 CET	3778	56296	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:49.169008017 CET	56296	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:49.288389921 CET	3778	56296	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:50.692770004 CET	3778	56294	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:50.692787886 CET	3778	56296	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:50.692913055 CET	56294	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.692940950 CET	56294	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.692962885 CET	56296	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.693048000 CET	56296	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.695425034 CET	56298	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.695662975 CET	56300	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.930259943 CET	3778	56298	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:50.930269957 CET	3778	56300	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:50.930609941 CET	56300	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.930668116 CET	56298	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.934376955 CET	56298	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:50.934494019 CET	56300	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:51.054369926 CET	3778	56298	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:51.054430962 CET	3778	56300	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:51.054711103 CET	56300	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:51.054711103 CET	56298	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:51.174650908 CET	3778	56300	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:51.174664021 CET	3778	56298	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.497996092 CET	3778	56300	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.498436928 CET	56300	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.498569012 CET	56300	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.499253988 CET	3778	56298	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.499332905 CET	56298	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.499417067 CET	56298	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.499728918 CET	56302	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.500564098 CET	56304	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.619143963 CET	3778	56302	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.619394064 CET	56302	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.621284962 CET	56302	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.737917900 CET	3778	56304	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.738251925 CET	56304	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.740262032 CET	56304	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.740772963 CET	3778	56302	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.740866899 CET	56302	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.859724998 CET	3778	56304	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.859939098 CET	56304	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:52.860279083 CET	3778	56302	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:52.979598999 CET	3778	56304	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:55.648633003 CET	3778	56302	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:55.648667097 CET	3778	56304	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:55.648960114 CET	56302	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.649012089 CET	56304	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.649024963 CET	56302	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.649208069 CET	56304	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.650913000 CET	56306	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.651242971 CET	56308	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.771281958 CET	3778	56306	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:55.771531105 CET	56306	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.771902084 CET	3778	56308	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:55.772392988 CET	56308	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.774509907 CET	56306	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.774808884 CET	56308	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.895119905 CET	3778	56306	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:55.895361900 CET	56306	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:55.895745039 CET	3778	56308	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:55.895945072 CET	56308	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:56.015877962 CET	3778	56306	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:56.016460896 CET	3778	56308	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.414485931 CET	3778	56308	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.414963007 CET	56308	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.414963007 CET	56308	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.415755987 CET	3778	56306	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.416122913 CET	56306	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.416122913 CET	56306	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.416735888 CET	56310	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.417608976 CET	56312	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.536370993 CET	3778	56310	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.536775112 CET	56310	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.538986921 CET	56310	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.654074907 CET	3778	56312	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.654553890 CET	56312	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.656472921 CET	56312	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.658463955 CET	3778	56310	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.658571005 CET	56310	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.775996923 CET	3778	56312	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.776196957 CET	56312	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:57.778193951 CET	3778	56310	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:57.896266937 CET	3778	56312	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.221987963 CET	3778	56312	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.222301960 CET	56312	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.222361088 CET	56312	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.223222971 CET	3778	56310	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.223645926 CET	56314	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.223659992 CET	56310	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.223659992 CET	56310	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.224728107 CET	56316	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.343606949 CET	3778	56314	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.343873978 CET	56314	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.344322920 CET	3778	56316	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.344726086 CET	56316	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.347513914 CET	56314	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.347697020 CET	56316	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.467040062 CET	3778	56314	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.467216015 CET	3778	56316	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.467324018 CET	56314	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.467670918 CET	56316	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:56:59.586740017 CET	3778	56314	89.213.158.208	192.168.2.15
Dec 22, 2024 15:56:59.587166071 CET	3778	56316	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.296509027 CET	3778	56314	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.297002077 CET	56314	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.297002077 CET	56314	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.298007965 CET	56318	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.418343067 CET	3778	56318	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.418838978 CET	56318	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.420304060 CET	56318	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.540251970 CET	3778	56318	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.540503979 CET	56318	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.660160065 CET	3778	56318	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.744237900 CET	3778	56316	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.744497061 CET	56316	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.744497061 CET	56316	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.745281935 CET	56320	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.865448952 CET	3778	56320	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.865731955 CET	56320	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.867345095 CET	56320	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:01.986881018 CET	3778	56320	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:01.987123013 CET	56320	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:02.107067108 CET	3778	56320	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:04.010559082 CET	3778	56318	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:04.010688066 CET	56318	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:04.010766029 CET	56318	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:04.011497974 CET	56322	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:04.131189108 CET	3778	56322	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:04.131305933 CET	56322	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:04.132811069 CET	56322	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:04.252774954 CET	3778	56322	89.213.158.208	192.168.2.15
Dec 22, 2024 15:57:04.252973080 CET	56322	3778	192.168.2.15	89.213.158.208
Dec 22, 2024 15:57:04.373481035 CET	3778	56322	89.213.158.208	192.168.2.15

System Behavior

Analysis Process: Space.x86_64.elf PID: 5824, Parent PID: 5747

General

Start time (UTC):	14:54:54
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	/tmp/Space.x86_64.elf
File size:	36932 bytes
MD5 hash:	3c733927caaa196b216421abb32e2632

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5825, Parent PID: 5824

General

Start time (UTC):	14:54:54
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	36932 bytes
MD5 hash:	3c733927caaa196b216421abb32e2632

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5826, Parent PID: 5825

General

Start time (UTC):	14:54:54
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	36932 bytes
MD5 hash:	3c733927caaa196b216421abb32e2632

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5827, Parent PID: 5825

General

Start time (UTC):	14:54:54
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	36932 bytes
MD5 hash:	3c733927caaa196b216421abb32e2632

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5831, Parent PID: 5824

General

Start time (UTC):	14:55:00
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	36932 bytes
MD5 hash:	3c733927caaa196b216421abb32e2632

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5832, Parent PID: 5824

General

Start time (UTC):	14:55:00
Start date (UTC):	22/12/2024
Path:	/tmp/Space.x86_64.elf
Arguments:	-
File size:	36932 bytes
MD5 hash:	3c733927caaa196b216421abb32e2632

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.x86_64.elf PID: 5824, Parent PID: 5747

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5825, Parent PID: 5824

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5826, Parent PID: 5825

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5827, Parent PID: 5825

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5831, Parent PID: 5824

General

Chronological Activities

Analysis Process: Space.x86_64.elf PID: 5832, Parent PID: 5824

General

Chronological Activities

Linux Analysis Report
Space.x86_64.elf