Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.sh4.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.sh4.elf
Analysis ID:	1579590
MD5:	0f6e25407420672302ab5f6466e764b8
SHA1:	7283781d8aa136b28755a2c123e518c48af1fe4b
SHA256:	e5fe4228d00c6a927789e93e71125ead96a2218d031e97d4c536881ffabb0a52
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579590
Start date and time:	2024-12-23 03:30:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.sh4.elf
Detection:	MAL
Classification:	mal64.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
PID:	6260
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260, Parent: 6181, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf

ub8ehJSePAfc9FYqZIT6.sh4.elf New Fork (PID: 6262, Parent: 6260)

ub8ehJSePAfc9FYqZIT6.sh4.elf New Fork (PID: 6264, Parent: 6262)

ub8ehJSePAfc9FYqZIT6.sh4.elf New Fork (PID: 6265, Parent: 6262)

ub8ehJSePAfc9FYqZIT6.sh4.elf New Fork (PID: 6270, Parent: 6260)

ub8ehJSePAfc9FYqZIT6.sh4.elf New Fork (PID: 6272, Parent: 6260)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ub8ehJSePAfc9FYqZIT6.sh4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1110c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1115c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6260.1.00007f3178400000.00007f3178414000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1110c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1115c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6262.1.00007f3178400000.00007f3178414000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1110c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1115c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6270.1.00007f3178400000.00007f3178414000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1110c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1115c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6264.1.00007f3178400000.00007f3178414000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1110c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1115c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6260	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4d36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4eb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ec6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6262	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x56c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5701:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5715:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5729:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x573d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5751:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5765:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5779:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x578d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5805:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5819:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x582d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5841:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5855:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6264	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x50cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5109:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x511d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5131:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5145:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5159:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x516d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5181:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5195:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x520d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5221:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5235:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5249:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x525d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6270	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x56a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x570c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x575c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ub8ehJSePAfc9FYqZIT6.sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.sh4.elf	Virustotal: Detection: 60%			Perma Link
Source: ub8ehJSePAfc9FYqZIT6.sh4.elf	ReversingLabs: Detection: 63%

Source: global traffic

TCP traffic: 192.168.2.23:45338 -> 195.26.252.19:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: ub8ehJSePAfc9FYqZIT6.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6260.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6262.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6270.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6264.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6262, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/net/tcp.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc/proc/proc/%d/exe/proc/%s/statusrName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog195.26.252.19

Source: ELF static info symbol of initial sample

.symtab present: no

Source: ub8ehJSePAfc9FYqZIT6.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6260.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6262.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6270.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6264.1.00007f3178400000.00007f3178414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6262, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.linELF@0/0@0/0

Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/6243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/6244/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/6265/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/1494/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)	File opened: /proc/260/status	Jump to behavior

Source: /tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf (PID: 6260)

Queries kernel information via 'uname':

Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.sh4.elf, 6260.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6262.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6264.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6270.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: ub8ehJSePAfc9FYqZIT6.sh4.elf, 6260.1.00005589ec7a0000.00005589ec82a000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6262.1.00005589ec7a0000.00005589ec803000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6264.1.00005589ec7a0000.00005589ec803000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6270.1.00005589ec7a0000.00005589ec82a000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: ub8ehJSePAfc9FYqZIT6.sh4.elf, 6260.1.00005589ec7a0000.00005589ec82a000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6262.1.00005589ec7a0000.00005589ec803000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6264.1.00005589ec7a0000.00005589ec803000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6270.1.00005589ec7a0000.00005589ec82a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: ub8ehJSePAfc9FYqZIT6.sh4.elf, 6260.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6262.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6264.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.sh4.elf, 6270.1.00007ffd4e66a000.00007ffd4e68b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.sh4.elf	60%	Virustotal		Browse
ub8ehJSePAfc9FYqZIT6.sh4.elf	63%	ReversingLabs	Linux.Backdoor.Mirai
ub8ehJSePAfc9FYqZIT6.sh4.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
195.26.252.19	unknown	United Kingdom	8897	KCOM-SPNService-ProviderNetworkex-MistralGB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
195.26.252.19	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.mips.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.arm6.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.i686.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse
	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
91.189.91.42	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse
	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
CANONICAL-ASGB	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
INIT7CH	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
KCOM-SPNService-ProviderNetworkex-MistralGB	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.mips.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm6.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.i686.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	213.254.174.221
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.108.169.23
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	217.154.178.248
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	159.15.89.185

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.603688690840329
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ub8ehJSePAfc9FYqZIT6.sh4.elf
File size:	82'652 bytes
MD5:	0f6e25407420672302ab5f6466e764b8
SHA1:	7283781d8aa136b28755a2c123e518c48af1fe4b
SHA256:	e5fe4228d00c6a927789e93e71125ead96a2218d031e97d4c536881ffabb0a52
SHA512:	685474c0aab4fb4fa8b9343fbf7138e9461ef9f1e8994e5ab4200011fb22d709dcec54fc0ba7d0bc60638fbdff2e2ae304f5dfb1b572a48190e72ba096ee90a1
SSDEEP:	1536:/RU/uDZhX+yTzUIDrnYVohwH5wX6SNmTdEyRir:q/+PX+yTzUEnY66L5dRa
TLSH:	5D839E61F0146CA5C86606B4F0F8ED35471369E123A52CB26EEEE9A184F368DF44AFD4
File Content Preview:	.ELF.....................@.4...LA......4. ...(...............@...@.L4..L4...............@...@B..@B.0...............Q.td..............................././"O.n......#.@........#.*@L...&O.n.l..................................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0xc
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	82252
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x2e	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x10e60	0x0	0x6	AX	32
.fini	PROGBITS	0x410f40	0x10f40	0x22	0x0	0x6	AX	4
.rodata	PROGBITS	0x410f64	0x10f64	0x24e8	0x0	0x2	A	4
.ctors	PROGBITS	0x4240dc	0x140dc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x4240e4	0x140e4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x4240f0	0x140f0	0x1c	0x0	0x3	WA	4
.bss	NOBITS	0x42410c	0x1410c	0xaec	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1410c	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1344c	0x1344c	6.7759	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x140dc	0x4240dc	0x4240dc	0x30	0xb1c	2.4711	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 03:31:13.880393028 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:14.000061989 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:14.000180006 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:14.005394936 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:14.124967098 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:14.125036001 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:14.140343904 CET	43928	443	192.168.2.23	91.189.91.42
Dec 23, 2024 03:31:14.244560957 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:15.418343067 CET	3778	45338	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:15.418596983 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:15.418787956 CET	45338	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:15.419343948 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:15.538826942 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:15.539108992 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:15.540278912 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:15.659689903 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:15.659807920 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:15.779546022 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:16.674936056 CET	3778	45340	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:16.675163984 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:16.675381899 CET	45340	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:16.675892115 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:16.795336008 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:16.795574903 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:16.796681881 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:16.916105032 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:16.916275024 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:17.035718918 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:17.935806036 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:17.935951948 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:17.936122894 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:17.936649084 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:18.488708019 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:18.488728046 CET	3778	45342	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:18.488830090 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:18.488939047 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:18.488939047 CET	45342	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:18.488949060 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:18.489876032 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:18.609294891 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:18.609417915 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:18.728955984 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:19.515779972 CET	42836	443	192.168.2.23	91.189.91.43
Dec 23, 2024 03:31:19.635154963 CET	3778	45344	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:19.635354996 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.635462999 CET	45344	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.636090994 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.666737080 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.755579948 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:19.755635977 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.777194023 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.786286116 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:19.786348104 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.794336081 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.896653891 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:19.896718025 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:19.913861990 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:19.914058924 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:20.016184092 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:20.033485889 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:20.893071890 CET	3778	45346	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:20.893327951 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:20.893512011 CET	45346	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:20.894207954 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:20.940046072 CET	3778	45348	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:20.940237999 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:20.940459967 CET	45348	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:20.941059113 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:21.013676882 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:21.013760090 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:21.060555935 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:21.060667992 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:21.061927080 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:21.181363106 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:21.181463003 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:21.300908089 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:21.915326118 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.034936905 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:22.035190105 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.036226988 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.155688047 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:22.155946970 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.198291063 CET	3778	45352	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:22.198493958 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.198493958 CET	45352	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.199251890 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.275419950 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:22.319089890 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:22.319345951 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.320261955 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.439667940 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:22.439814091 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:22.559278011 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.178535938 CET	3778	45350	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.178797960 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.178797960 CET	45350	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.179388046 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.298863888 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.298924923 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.299767017 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.419234991 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.419473886 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.467930079 CET	3778	45354	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.468118906 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.468118906 CET	45354	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.468566895 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.538965940 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.587987900 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.588095903 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.589050055 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.708439112 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:23.708514929 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:23.828036070 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.475204945 CET	3778	45356	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.475332975 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.475370884 CET	45356	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.475994110 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.595462084 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.595607996 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.596448898 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.715902090 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.716074944 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.735321045 CET	3778	45358	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.735502958 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.735502958 CET	45358	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.735970020 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.835556984 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.855443001 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.855644941 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.856781960 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:24.976278067 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:24.976543903 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:25.096048117 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.037728071 CET	3778	45360	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.038104057 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.038104057 CET	45360	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.038861036 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.158355951 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.158670902 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.159984112 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.225620985 CET	3778	45362	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.226054907 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.226056099 CET	45362	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.226628065 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.279429913 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.279654980 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.346085072 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.346242905 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.347103119 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.399173975 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.466528893 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:26.466743946 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:26.586559057 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:27.608861923 CET	3778	45364	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:27.609003067 CET	3778	45366	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:27.609117031 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.609148026 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.609148026 CET	45364	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.609357119 CET	45366	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.610400915 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.610553026 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.729801893 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:27.730113029 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.731009960 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.848014116 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:27.848203897 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.849473953 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.850402117 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:27.850477934 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.968899012 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:27.969136000 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:27.969880104 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:28.088603973 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:28.882458925 CET	3778	45368	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:28.882616043 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:28.882694006 CET	45368	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:28.883289099 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:28.985311031 CET	3778	45370	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:28.985434055 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:28.985584974 CET	45370	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:28.986041069 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:29.002720118 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:29.002824068 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:29.003701925 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:29.105586052 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:29.105679989 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:29.106841087 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:29.123095989 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:29.123157024 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:29.226313114 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:29.226521015 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:29.242575884 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:29.346071959 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:30.140734911 CET	3778	45372	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:30.141078949 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.141078949 CET	45372	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.141815901 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.245194912 CET	3778	45374	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:30.245531082 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.245531082 CET	45374	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.246258974 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.261311054 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:30.261406898 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.262307882 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.366494894 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:30.366786957 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.382503033 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:30.382711887 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:30.502181053 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:31.258173943 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.377778053 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:31.377902031 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.379097939 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.399126053 CET	3778	45376	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:31.399207115 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.399302959 CET	45376	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.399903059 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.498673916 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:31.498878956 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.519388914 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:31.519521952 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.520853043 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.618380070 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:31.640408993 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:31.640536070 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:31.760201931 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.515445948 CET	3778	45378	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.515796900 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.515851974 CET	45378	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.516870022 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.636621952 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.636781931 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.638267040 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.657339096 CET	3778	45380	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.657399893 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.657491922 CET	45380	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.658107042 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.757764101 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.757968903 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.777576923 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.777800083 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.779048920 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:32.877475023 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.898675919 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:32.899020910 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.018699884 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:33.774254084 CET	3778	45382	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:33.774491072 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.774491072 CET	45382	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.775111914 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.894732952 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:33.894937038 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.896050930 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.914911985 CET	3778	45384	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:33.914989948 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.915196896 CET	45384	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:33.915721893 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:34.015551090 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:34.015664101 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:34.035288095 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:34.035540104 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:34.036420107 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:34.135097027 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:34.155872107 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:34.156117916 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:34.275634050 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.034424067 CET	3778	45386	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.034672976 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.034672976 CET	45386	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.035456896 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.155731916 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.155997038 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.157598972 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.175515890 CET	3778	45388	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.175616026 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.175813913 CET	45388	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.176567078 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.277152061 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.277308941 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.296158075 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.296303034 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.297602892 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.396995068 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.417092085 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.417321920 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:35.536860943 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:35.897469997 CET	43928	443	192.168.2.23	91.189.91.42
Dec 23, 2024 03:31:36.295597076 CET	3778	45390	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:36.295749903 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.295845032 CET	45390	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.296632051 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.416163921 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:36.416323900 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.417896032 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.433810949 CET	3778	45392	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:36.433891058 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.433984041 CET	45392	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.434534073 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.537331104 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:36.537570953 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.554009914 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:36.554239035 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.555535078 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.657001019 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:36.675843000 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:36.676084042 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:36.795515060 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:37.764801979 CET	3778	45394	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:37.765124083 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:37.769186974 CET	45394	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:37.772506952 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:37.891901970 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:37.892155886 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:37.893249989 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:37.909214973 CET	3778	45396	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:37.909328938 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:37.909492970 CET	45396	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:37.909924984 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:38.013520002 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:38.013634920 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:38.029443979 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:38.029783010 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:38.030976057 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:38.133936882 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:38.151748896 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:38.152023077 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:38.271456003 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.029748917 CET	3778	45398	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.030152082 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.030152082 CET	45398	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.030803919 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.150264978 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.150438070 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.151767969 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.168756008 CET	3778	45400	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.168832064 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.169054031 CET	45400	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.169462919 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.271186113 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.271517992 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.288860083 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.288960934 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.290160894 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.390938997 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.409604073 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.409693003 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:39.529115915 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:39.993026972 CET	42516	80	192.168.2.23	109.202.202.202
Dec 23, 2024 03:31:40.288830996 CET	3778	45402	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:40.289019108 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:40.289048910 CET	45402	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:40.289756060 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:40.409163952 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:40.409301043 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:40.410876036 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:40.530374050 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:40.530563116 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:40.650063992 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:41.551211119 CET	3778	45406	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:41.551503897 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:41.551503897 CET	45406	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:41.552261114 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:41.671684027 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:41.671787024 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:41.673024893 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:41.792489052 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:41.792753935 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:41.912345886 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:42.824807882 CET	3778	45408	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:42.825293064 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:42.825293064 CET	45408	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:42.825937986 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:42.945399046 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:42.945678949 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:42.947045088 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:43.066632986 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:43.066781044 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:43.186292887 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:44.085259914 CET	3778	45410	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:44.085388899 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:44.085407972 CET	45410	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:44.086087942 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:44.205749989 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:44.205863953 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:45.112129927 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:45.231664896 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:45.231759071 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:45.232805014 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:45.352226019 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:45.352319956 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:45.471779108 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:46.136002064 CET	42836	443	192.168.2.23	91.189.91.43
Dec 23, 2024 03:31:46.372646093 CET	3778	45412	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:46.372864962 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:46.372905970 CET	45412	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:46.373707056 CET	45414	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:46.493170023 CET	3778	45414	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:46.493302107 CET	45414	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:46.494734049 CET	45414	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:46.614195108 CET	3778	45414	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:46.614460945 CET	45414	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:46.734025955 CET	3778	45414	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:47.630048990 CET	3778	45414	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:47.630341053 CET	45414	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:47.630341053 CET	45414	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:47.631002903 CET	45416	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:47.750591993 CET	3778	45416	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:47.750812054 CET	45416	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:47.752291918 CET	45416	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:47.871779919 CET	3778	45416	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:47.871936083 CET	45416	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:47.991538048 CET	3778	45416	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:49.078118086 CET	3778	45416	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:49.078434944 CET	45416	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:49.078605890 CET	45416	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:49.079711914 CET	45418	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:49.199223995 CET	3778	45418	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:49.199353933 CET	45418	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:49.201040983 CET	45418	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:49.299187899 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:49.320554018 CET	3778	45418	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:49.320789099 CET	45418	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:49.418770075 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:49.440567017 CET	3778	45418	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:49.639559984 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:49.639803886 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:50.460479975 CET	3778	45418	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:50.460787058 CET	45418	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:50.460886002 CET	45418	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:50.461848974 CET	45420	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:50.582647085 CET	3778	45420	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:50.582927942 CET	45420	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:50.584527969 CET	45420	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:50.704005957 CET	3778	45420	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:50.704144955 CET	45420	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:50.823698997 CET	3778	45420	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:51.720427036 CET	3778	45420	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:51.720741034 CET	45420	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:51.720830917 CET	45420	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:51.721738100 CET	45422	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:51.841247082 CET	3778	45422	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:51.841540098 CET	45422	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:51.843211889 CET	45422	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:51.962692022 CET	3778	45422	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:51.962949038 CET	45422	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:52.082551003 CET	3778	45422	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:52.980627060 CET	3778	45422	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:52.981029034 CET	45422	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:52.981128931 CET	45422	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:52.982021093 CET	45424	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:53.101522923 CET	3778	45424	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:53.101691961 CET	45424	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:53.103146076 CET	45424	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:53.222595930 CET	3778	45424	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:53.222891092 CET	45424	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:53.342504025 CET	3778	45424	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:54.265997887 CET	3778	45424	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:54.266175032 CET	45424	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:54.266175032 CET	45424	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:54.267178059 CET	45426	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:54.386703014 CET	3778	45426	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:54.386904955 CET	45426	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:54.388663054 CET	45426	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:54.508133888 CET	3778	45426	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:54.508263111 CET	45426	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:54.627763987 CET	3778	45426	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:55.524187088 CET	3778	45426	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:55.524430037 CET	45426	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:55.524527073 CET	45426	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:55.525310040 CET	45428	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:55.644870043 CET	3778	45428	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:55.645020962 CET	45428	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:55.646671057 CET	45428	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:55.766145945 CET	3778	45428	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:55.766326904 CET	45428	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:55.885902882 CET	3778	45428	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:56.782866001 CET	3778	45428	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:56.783071995 CET	45428	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:56.783138037 CET	45428	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:56.784081936 CET	45430	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:56.903574944 CET	3778	45430	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:56.903753996 CET	45430	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:56.905328035 CET	45430	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:57.024852037 CET	3778	45430	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:57.025010109 CET	45430	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:57.144612074 CET	3778	45430	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:58.041188002 CET	3778	45430	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:58.041376114 CET	45430	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:58.041465998 CET	45430	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:58.042494059 CET	45432	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:58.162107944 CET	3778	45432	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:58.162446976 CET	45432	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:58.164006948 CET	45432	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:58.283552885 CET	3778	45432	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:58.283682108 CET	45432	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:58.403307915 CET	3778	45432	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:59.301282883 CET	3778	45432	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:59.301436901 CET	45432	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:59.301502943 CET	45432	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:59.302213907 CET	45434	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:59.421881914 CET	3778	45434	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:59.422049999 CET	45434	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:59.423517942 CET	45434	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:59.542982101 CET	3778	45434	195.26.252.19	192.168.2.23
Dec 23, 2024 03:31:59.543075085 CET	45434	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:31:59.662744999 CET	3778	45434	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:00.560786963 CET	3778	45434	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:00.560923100 CET	45434	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:00.560987949 CET	45434	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:00.561629057 CET	45436	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:00.681395054 CET	3778	45436	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:00.681514025 CET	45436	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:00.682662010 CET	45436	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:00.802264929 CET	3778	45436	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:00.802417040 CET	45436	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:00.922027111 CET	3778	45436	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:02.387195110 CET	3778	45436	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:02.387458086 CET	45436	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:02.387563944 CET	45436	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:02.388581038 CET	45438	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:02.508177042 CET	3778	45438	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:02.508304119 CET	45438	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:02.509968996 CET	45438	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:02.629434109 CET	3778	45438	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:02.629564047 CET	45438	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:02.749166965 CET	3778	45438	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:03.646924019 CET	3778	45438	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:03.647172928 CET	45438	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:03.647264957 CET	45438	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:03.647852898 CET	45440	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:03.767430067 CET	3778	45440	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:03.767693043 CET	45440	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:03.768874884 CET	45440	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:03.888458967 CET	3778	45440	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:03.888564110 CET	45440	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:04.008250952 CET	3778	45440	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:04.905693054 CET	3778	45440	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:04.906055927 CET	45440	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:04.906152010 CET	45440	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:04.907217026 CET	45442	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:05.026810884 CET	3778	45442	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:05.026988029 CET	45442	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:05.028800011 CET	45442	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:05.151009083 CET	3778	45442	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:05.151141882 CET	45442	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:05.270814896 CET	3778	45442	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:06.164347887 CET	3778	45442	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:06.164535999 CET	45442	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:06.164618015 CET	45442	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:06.165323973 CET	45444	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:06.284878016 CET	3778	45444	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:06.284970999 CET	45444	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:06.285904884 CET	45444	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:06.405483961 CET	3778	45444	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:06.405587912 CET	45444	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:06.525095940 CET	3778	45444	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:07.427774906 CET	3778	45444	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:07.427975893 CET	45444	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:07.428067923 CET	45444	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:07.429079056 CET	45446	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:07.548604965 CET	3778	45446	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:07.548753023 CET	45446	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:07.550347090 CET	45446	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:07.669899940 CET	3778	45446	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:07.670109987 CET	45446	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:07.789673090 CET	3778	45446	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:08.706460953 CET	3778	45446	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:08.706600904 CET	45446	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:08.706691980 CET	45446	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:08.707487106 CET	45448	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:08.827151060 CET	3778	45448	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:08.827377081 CET	45448	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:08.828640938 CET	45448	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:08.948266983 CET	3778	45448	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:08.948472023 CET	45448	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:09.068185091 CET	3778	45448	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:09.965102911 CET	3778	45448	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:09.965694904 CET	45448	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:09.965769053 CET	45448	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:09.966701984 CET	45450	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:10.086172104 CET	3778	45450	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:10.086349964 CET	45450	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:10.087934971 CET	45450	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:10.207413912 CET	3778	45450	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:10.207545996 CET	45450	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:10.327261925 CET	3778	45450	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:11.230575085 CET	3778	45450	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:11.230858088 CET	45450	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:11.230859041 CET	45450	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:11.231741905 CET	45452	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:11.351281881 CET	3778	45452	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:11.351555109 CET	45452	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:11.352907896 CET	45452	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:11.472527981 CET	3778	45452	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:11.472707033 CET	45452	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:11.592334986 CET	3778	45452	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:12.492741108 CET	3778	45452	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:12.493025064 CET	45452	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:12.493025064 CET	45452	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:12.493792057 CET	45454	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:12.613333941 CET	3778	45454	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:12.613553047 CET	45454	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:12.614968061 CET	45454	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:12.734579086 CET	3778	45454	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:12.734827042 CET	45454	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:12.854553938 CET	3778	45454	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:13.752417088 CET	3778	45454	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:13.752679110 CET	45454	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:13.752679110 CET	45454	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:13.753495932 CET	45456	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:13.873069048 CET	3778	45456	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:13.873218060 CET	45456	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:13.874774933 CET	45456	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:13.994891882 CET	3778	45456	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:13.995120049 CET	45456	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:14.114952087 CET	3778	45456	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:15.011471987 CET	3778	45456	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:15.011749029 CET	45456	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:15.011862993 CET	45456	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:15.012474060 CET	45458	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:15.131995916 CET	3778	45458	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:15.132195950 CET	45458	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:15.133610010 CET	45458	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:15.253123999 CET	3778	45458	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:15.253427982 CET	45458	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:15.373100996 CET	3778	45458	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:16.272618055 CET	3778	45458	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:16.272768974 CET	45458	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:16.272819996 CET	45458	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:16.273561001 CET	45460	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:16.393356085 CET	3778	45460	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:16.393513918 CET	45460	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:16.394845009 CET	45460	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:16.514640093 CET	3778	45460	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:16.514763117 CET	45460	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:16.634309053 CET	3778	45460	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:16.851792097 CET	43928	443	192.168.2.23	91.189.91.42
Dec 23, 2024 03:32:17.531622887 CET	3778	45460	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:17.531909943 CET	45460	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:17.531910896 CET	45460	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:17.532697916 CET	45462	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:17.652183056 CET	3778	45462	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:17.652391911 CET	45462	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:17.653485060 CET	45462	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:17.773113012 CET	3778	45462	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:17.773358107 CET	45462	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:17.892884970 CET	3778	45462	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:18.790339947 CET	3778	45462	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:18.790612936 CET	45462	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:18.790716887 CET	45462	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:18.791786909 CET	45464	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:18.911269903 CET	3778	45464	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:18.911396027 CET	45464	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:18.912760019 CET	45464	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:19.032253027 CET	3778	45464	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:19.032398939 CET	45464	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:19.151916981 CET	3778	45464	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:20.054478884 CET	3778	45464	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:20.054585934 CET	45464	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:20.054624081 CET	45464	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:20.055136919 CET	45466	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:20.174659967 CET	3778	45466	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:20.174747944 CET	45466	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:20.175489902 CET	45466	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:20.294929981 CET	3778	45466	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:20.295023918 CET	45466	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:20.414534092 CET	3778	45466	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:21.316534996 CET	3778	45466	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:21.316739082 CET	45466	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:21.316776037 CET	45466	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:21.317650080 CET	45468	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:21.437140942 CET	3778	45468	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:21.437218904 CET	45468	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:21.438101053 CET	45468	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:21.557629108 CET	3778	45468	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:21.557718992 CET	45468	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:21.677263021 CET	3778	45468	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:22.574040890 CET	3778	45468	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:22.574448109 CET	45468	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:22.574512005 CET	45468	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:22.575226068 CET	45470	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:22.694679976 CET	3778	45470	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:22.694885969 CET	45470	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:22.695972919 CET	45470	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:22.815422058 CET	3778	45470	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:22.815498114 CET	45470	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:22.934988022 CET	3778	45470	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:23.844175100 CET	3778	45470	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:23.844527960 CET	45470	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:23.844527960 CET	45470	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:23.845194101 CET	45472	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:23.964677095 CET	3778	45472	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:23.964865923 CET	45472	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:23.966203928 CET	45472	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:24.085920095 CET	3778	45472	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:24.086127043 CET	45472	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:24.205612898 CET	3778	45472	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:25.126929045 CET	3778	45472	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:25.127290010 CET	45472	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:25.127290010 CET	45472	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:25.127974987 CET	45474	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:25.247483969 CET	3778	45474	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:25.247685909 CET	45474	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:25.248900890 CET	45474	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:25.368334055 CET	3778	45474	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:25.368633032 CET	45474	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:25.488132954 CET	3778	45474	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:26.386832952 CET	3778	45474	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:26.387058020 CET	45474	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:26.387098074 CET	45474	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:26.387687922 CET	45476	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:26.507189035 CET	3778	45476	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:26.507390976 CET	45476	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:26.508836985 CET	45476	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:26.628488064 CET	3778	45476	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:26.628724098 CET	45476	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:26.748259068 CET	3778	45476	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:27.645663977 CET	3778	45476	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:27.645973921 CET	45476	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:27.645973921 CET	45476	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:27.646706104 CET	45478	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:27.766211033 CET	3778	45478	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:27.766381979 CET	45478	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:27.767707109 CET	45478	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:27.887152910 CET	3778	45478	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:27.887339115 CET	45478	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:28.006812096 CET	3778	45478	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:28.904153109 CET	3778	45478	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:28.904473066 CET	45478	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:28.904504061 CET	45478	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:28.905350924 CET	45480	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:29.024872065 CET	3778	45480	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:29.025008917 CET	45480	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:29.026325941 CET	45480	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:29.145792007 CET	3778	45480	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:29.145920038 CET	45480	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:29.265408993 CET	3778	45480	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:30.163609028 CET	3778	45480	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:30.163728952 CET	45480	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:30.163906097 CET	45480	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:30.164690018 CET	45482	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:30.284140110 CET	3778	45482	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:30.284214020 CET	45482	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:30.285269976 CET	45482	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:30.404732943 CET	3778	45482	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:30.404964924 CET	45482	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:30.524573088 CET	3778	45482	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:31.423136950 CET	3778	45482	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:31.423264980 CET	45482	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:31.423374891 CET	45482	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:31.423964024 CET	45484	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:31.543446064 CET	3778	45484	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:31.543539047 CET	45484	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:31.544912100 CET	45484	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:31.667752981 CET	3778	45484	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:31.667834044 CET	45484	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:31.883090019 CET	3778	45484	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:32.690635920 CET	3778	45484	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:32.690768957 CET	45484	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:32.690908909 CET	45484	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:32.691766977 CET	45486	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:32.811186075 CET	3778	45486	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:32.811271906 CET	45486	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:32.812033892 CET	45486	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:32.931516886 CET	3778	45486	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:32.931612968 CET	45486	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:33.051116943 CET	3778	45486	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:33.949316025 CET	3778	45486	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:33.949448109 CET	45486	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:33.949496031 CET	45486	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:33.950112104 CET	45488	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:34.069616079 CET	3778	45488	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:34.069763899 CET	45488	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:34.071047068 CET	45488	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:34.190519094 CET	3778	45488	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:34.190638065 CET	45488	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:34.310201883 CET	3778	45488	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:35.209076881 CET	3778	45488	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:35.209238052 CET	45488	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:35.209311008 CET	45488	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:35.210381985 CET	45490	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:35.329953909 CET	3778	45490	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:35.330291986 CET	45490	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:35.331455946 CET	45490	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:35.450870037 CET	3778	45490	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:35.451112032 CET	45490	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:35.570694923 CET	3778	45490	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:36.467972994 CET	3778	45490	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:36.468173981 CET	45490	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:36.468229055 CET	45490	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:36.469024897 CET	45492	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:36.588520050 CET	3778	45492	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:36.588767052 CET	45492	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:36.589962959 CET	45492	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:36.709412098 CET	3778	45492	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:36.709697962 CET	45492	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:36.829140902 CET	3778	45492	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:37.727230072 CET	3778	45492	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:37.727368116 CET	45492	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:37.727484941 CET	45492	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:37.728116035 CET	45494	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:37.848408937 CET	3778	45494	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:37.848500967 CET	45494	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:37.849714041 CET	45494	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:37.969202995 CET	3778	45494	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:37.969481945 CET	45494	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:38.089102983 CET	3778	45494	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:38.986783981 CET	3778	45494	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:38.987016916 CET	45494	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:38.987016916 CET	45494	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:38.987710953 CET	45496	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:39.112605095 CET	3778	45496	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:39.112792969 CET	45496	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:39.113728046 CET	45496	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:39.233163118 CET	3778	45496	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:39.233230114 CET	45496	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:39.352721930 CET	3778	45496	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:49.122708082 CET	45496	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:49.242196083 CET	3778	45496	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:49.461684942 CET	3778	45496	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:49.461863041 CET	45496	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:49.671360970 CET	45404	3778	192.168.2.23	195.26.252.19
Dec 23, 2024 03:32:49.790858030 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:50.011420965 CET	3778	45404	195.26.252.19	192.168.2.23
Dec 23, 2024 03:32:50.011637926 CET	45404	3778	192.168.2.23	195.26.252.19

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6260, Parent PID: 6181

General

Start time (UTC):	02:31:12
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6262, Parent PID: 6260

General

Start time (UTC):	02:31:12
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6264, Parent PID: 6262

General

Start time (UTC):	02:31:12
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6265, Parent PID: 6262

General

Start time (UTC):	02:31:12
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6270, Parent PID: 6260

General

Start time (UTC):	02:31:18
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6272, Parent PID: 6260

General

Start time (UTC):	02:31:18
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6260, Parent PID: 6181

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6262, Parent PID: 6260

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6264, Parent PID: 6262

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6265, Parent PID: 6262

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6270, Parent PID: 6260

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.sh4.elf PID: 6272, Parent PID: 6260

General

Chronological Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.sh4.elf