Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.ppc.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.ppc.elf
Analysis ID:	1579593
MD5:	26885e38a79975ffc987f94b40bb0bd3
SHA1:	2f0e3aa1e47ea5ddb89ba409305b68bee9c43848
SHA256:	7dff19d7639718a88558376267278c64bf343c7f06b9d913cfb7aafd424e1b05
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579593
Start date and time:	2024-12-23 03:30:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.ppc.elf
Detection:	MAL
Classification:	mal68.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
PID:	5591
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591, Parent: 5519, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf

ub8ehJSePAfc9FYqZIT6.ppc.elf New Fork (PID: 5593, Parent: 5591)

ub8ehJSePAfc9FYqZIT6.ppc.elf New Fork (PID: 5595, Parent: 5593)

ub8ehJSePAfc9FYqZIT6.ppc.elf New Fork (PID: 5596, Parent: 5593)

ub8ehJSePAfc9FYqZIT6.ppc.elf New Fork (PID: 5601, Parent: 5591)

ub8ehJSePAfc9FYqZIT6.ppc.elf New Fork (PID: 5603, Parent: 5591)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5601.1.00007f19f0014000.00007f19f0017000.rwx.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5593.1.00007f19f0014000.00007f19f0017000.rwx.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5591.1.00007f19f0014000.00007f19f0017000.rwx.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5595.1.00007f19f0014000.00007f19f0017000.rwx.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x404:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5591	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfc4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfda3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdcb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfddf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5593	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9212:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9226:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x923a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x924e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9262:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9276:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x928a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x929e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9302:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9316:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x932a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x933e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9352:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9366:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x937a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x938e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5595	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd50c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd55c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5601	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf06f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf083:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf097:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf10f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf123:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf137:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf14b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf15f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf173:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf187:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf19b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf1af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf1c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf1d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf1eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf1ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ub8ehJSePAfc9FYqZIT6.ppc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.ppc.elf	Virustotal: Detection: 42%			Perma Link
Source: ub8ehJSePAfc9FYqZIT6.ppc.elf	ReversingLabs: Detection: 42%

Source: global traffic

TCP traffic: 192.168.2.15:60260 -> 195.26.252.19:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19
Source: unknown	TCP traffic detected without corresponding DNS query: 195.26.252.19

Source: ub8ehJSePAfc9FYqZIT6.ppc.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5601.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5593.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5591.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5595.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5591, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5593, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5595, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5601, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x100000

Source: 5601.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5593.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5591.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5595.1.00007f19f0014000.00007f19f0017000.rwx.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5591, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5593, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5595, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5601, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1333/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1695/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/911/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/3890/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1591/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1585/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/804/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/3407/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1484/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/133/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1479/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/931/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1595/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/812/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/933/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/3419/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/265/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/145/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/266/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/267/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/268/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/3303/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/269/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1486/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/1806/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/3440/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)	File opened: /proc/270/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.ppc.elf

Submission file: segment LOAD with 7.9634 entropy (max. 8.0)

Source: /tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf (PID: 5591)

Queries kernel information via 'uname':

Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.ppc.elf, 5593.1.000055ebffadd000.000055ebffb8d000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: ub8ehJSePAfc9FYqZIT6.ppc.elf, 5591.1.000055ebffadd000.000055ebffbae000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5595.1.000055ebffadd000.000055ebffb8d000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5601.1.000055ebffadd000.000055ebffbae000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: ub8ehJSePAfc9FYqZIT6.ppc.elf, 5591.1.000055ebffadd000.000055ebffbae000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5593.1.000055ebffadd000.000055ebffb8d000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5595.1.000055ebffadd000.000055ebffb8d000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5601.1.000055ebffadd000.000055ebffbae000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: ub8ehJSePAfc9FYqZIT6.ppc.elf, 5591.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5593.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5595.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5601.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: ub8ehJSePAfc9FYqZIT6.ppc.elf, 5591.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5593.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5595.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.ppc.elf, 5601.1.00007ffd8535f000.00007ffd85380000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.ppc.elf	43%	Virustotal		Browse
ub8ehJSePAfc9FYqZIT6.ppc.elf	42%	ReversingLabs	Linux.Trojan.Mirai
ub8ehJSePAfc9FYqZIT6.ppc.elf	100%	Avira	EXP/ELF.Agent.F.118

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.ppc.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.26.252.19	unknown	United Kingdom		8897	KCOM-SPNService-ProviderNetworkex-MistralGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
195.26.252.19	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.mips.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.arm6.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.i686.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KCOM-SPNService-ProviderNetworkex-MistralGB	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.mips.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm6.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.i686.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	213.254.174.221
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.108.169.23
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	217.154.178.248
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	159.15.89.185

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.961393822835951
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ub8ehJSePAfc9FYqZIT6.ppc.elf
File size:	40'316 bytes
MD5:	26885e38a79975ffc987f94b40bb0bd3
SHA1:	2f0e3aa1e47ea5ddb89ba409305b68bee9c43848
SHA256:	7dff19d7639718a88558376267278c64bf343c7f06b9d913cfb7aafd424e1b05
SHA512:	d02a7b5232f759690d673ec3e9611e305018c805d01548fcbad10d4a8e6a31fff2eadc9f45da6adb13f500b4621c5d07181ea6d18ed089414ef93b758423abe3
SSDEEP:	768:qEIycbQHUBnVYoMcb/BLY+d34eE6H2PUQzSh18rCRk4uVcqgw09X:xI7bQ0BVeA5YYnH25zL4u+qgw09X
TLSH:	B303F176F0E60DB9DAFEC7B50194F7C93FD1B3CE36D689A0A2A1D31072099221652DC6
File Content Preview:	.ELF...........................4.........4. ...(.......................p...p..............k...k...k.................dt.Q................................UPX!..........b...b........V.......?.E.h4...@b........=.a....`..Y...j{.c.HL}.....H..z.q.H.....8ea......

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x108a88
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x9c70	0x9c70	7.9634	0x5	R E	0x10000
LOAD	0x6b90	0x10026b90	0x10026b90	0x0	0x0	0.0000	0x6	RW	0x10000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 03:31:17.139281988 CET	60260	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:17.258915901 CET	3778	60260	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:17.259068966 CET	60260	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:17.286041021 CET	60260	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:17.405555010 CET	3778	60260	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:17.405622959 CET	60260	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:17.525126934 CET	3778	60260	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:18.488749981 CET	3778	60260	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:18.488909960 CET	60260	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:18.489092112 CET	60260	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:18.489763021 CET	60262	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:18.609255075 CET	3778	60262	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:18.609561920 CET	60262	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:18.610830069 CET	60262	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:18.730273008 CET	3778	60262	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:18.730525017 CET	60262	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:18.850069046 CET	3778	60262	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:19.748778105 CET	3778	60262	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:19.749008894 CET	60262	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:19.749064922 CET	60262	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:19.749644995 CET	60264	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:19.869115114 CET	3778	60264	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:19.869219065 CET	60264	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:19.870297909 CET	60264	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:19.989780903 CET	3778	60264	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:19.989882946 CET	60264	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:20.109551907 CET	3778	60264	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:21.020519972 CET	3778	60264	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:21.020692110 CET	60264	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:21.020780087 CET	60264	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:21.021301985 CET	60266	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:21.140738964 CET	3778	60266	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:21.140834093 CET	60266	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:21.141819000 CET	60266	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:21.261207104 CET	3778	60266	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:21.261348963 CET	60266	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:21.380789995 CET	3778	60266	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:22.278942108 CET	3778	60266	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:22.279135942 CET	60266	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:22.279171944 CET	60266	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:22.279704094 CET	60268	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:22.399133921 CET	3778	60268	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:22.399353981 CET	60268	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:22.400373936 CET	60268	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:22.519829988 CET	3778	60268	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:22.520183086 CET	60268	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:22.639704943 CET	3778	60268	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:23.118207932 CET	60270	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.237828970 CET	3778	60270	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:23.237898111 CET	60270	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.254261971 CET	60270	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.373742104 CET	3778	60270	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:23.373794079 CET	60270	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.493266106 CET	3778	60270	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:23.547723055 CET	3778	60268	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:23.547924995 CET	60268	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.547979116 CET	60268	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.548547029 CET	60272	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.668040037 CET	3778	60272	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:23.668121099 CET	60272	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.669246912 CET	60272	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.788675070 CET	3778	60272	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:23.788732052 CET	60272	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:23.908207893 CET	3778	60272	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:24.375847101 CET	3778	60270	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:24.376079082 CET	60270	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.376256943 CET	60270	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.376776934 CET	60274	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.496252060 CET	3778	60274	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:24.496362925 CET	60274	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.497277021 CET	60274	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.616713047 CET	3778	60274	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:24.616894960 CET	60274	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.736323118 CET	3778	60274	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:24.807966948 CET	3778	60272	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:24.808139086 CET	60272	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.808139086 CET	60272	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.808638096 CET	60276	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.928040028 CET	3778	60276	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:24.928304911 CET	60276	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:24.929553032 CET	60276	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:25.049004078 CET	3778	60276	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:25.049161911 CET	60276	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:25.168673992 CET	3778	60276	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:25.910700083 CET	3778	60274	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:25.910932064 CET	60274	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:25.911016941 CET	60274	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:25.911439896 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.030849934 CET	3778	60278	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:26.031054020 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.302970886 CET	3778	60276	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:26.303019047 CET	60276	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.303056002 CET	60276	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.303483009 CET	60280	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.422980070 CET	3778	60280	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:26.423207045 CET	60280	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.424201965 CET	60280	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.543678045 CET	3778	60280	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:26.543786049 CET	60280	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:26.663383007 CET	3778	60280	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:26.919070959 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.038613081 CET	3778	60278	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:27.038801908 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.039912939 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.159364939 CET	3778	60278	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:27.159564972 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.279004097 CET	3778	60278	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:27.609069109 CET	3778	60280	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:27.609405994 CET	60280	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.609405994 CET	60280	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.609975100 CET	60282	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.729403019 CET	3778	60282	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:27.729527950 CET	60282	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.730406046 CET	60282	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.849819899 CET	3778	60282	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:27.849966049 CET	60282	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:27.969369888 CET	3778	60282	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:28.178328037 CET	3778	60278	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:28.178566933 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.178689957 CET	60278	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.179235935 CET	60284	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.298708916 CET	3778	60284	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:28.298953056 CET	60284	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.299890995 CET	60284	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.419374943 CET	3778	60284	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:28.419593096 CET	60284	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.539057970 CET	3778	60284	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:28.882287979 CET	3778	60282	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:28.882488966 CET	60282	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.882530928 CET	60282	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:28.883023024 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.002413988 CET	3778	60286	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:29.002537966 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.448251963 CET	3778	60284	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:29.448448896 CET	60284	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.448519945 CET	60284	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.449181080 CET	60288	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.568861961 CET	3778	60288	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:29.569044113 CET	60288	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.569855928 CET	60288	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.689384937 CET	3778	60288	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:29.689559937 CET	60288	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:29.809005976 CET	3778	60288	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:29.894921064 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.014465094 CET	3778	60286	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:30.014588118 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.015503883 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.134954929 CET	3778	60286	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:30.135056019 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.254515886 CET	3778	60286	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:30.709952116 CET	3778	60288	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:30.710190058 CET	60288	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.710236073 CET	60288	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.710767984 CET	60290	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.830238104 CET	3778	60290	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:30.830351114 CET	60290	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.831392050 CET	60290	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:30.950810909 CET	3778	60290	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:30.950957060 CET	60290	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.070399046 CET	3778	60290	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:31.152996063 CET	3778	60286	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:31.153141975 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.153176069 CET	60286	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.153649092 CET	60292	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.273124933 CET	3778	60292	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:31.273350954 CET	60292	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.274389029 CET	60292	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.393825054 CET	3778	60292	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:31.393965006 CET	60292	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.513447046 CET	3778	60292	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:31.968883038 CET	3778	60290	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:31.969118118 CET	60290	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.969118118 CET	60290	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:31.969470024 CET	60294	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.088931084 CET	3778	60294	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:32.089123964 CET	60294	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.089940071 CET	60294	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.210311890 CET	3778	60294	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:32.210542917 CET	60294	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.330005884 CET	3778	60294	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:32.414366007 CET	3778	60292	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:32.414488077 CET	60292	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.414566994 CET	60292	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.415133953 CET	60296	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.534590006 CET	3778	60296	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:32.534691095 CET	60296	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.535550117 CET	60296	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.655025005 CET	3778	60296	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:32.655117035 CET	60296	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:32.774645090 CET	3778	60296	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.227143049 CET	3778	60294	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.227302074 CET	60294	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.227330923 CET	60294	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.227719069 CET	60298	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.347203016 CET	3778	60298	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.347290993 CET	60298	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.348020077 CET	60298	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.467871904 CET	3778	60298	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.467945099 CET	60298	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.587549925 CET	3778	60298	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.672056913 CET	3778	60296	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.672243118 CET	60296	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.672281027 CET	60296	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.672943115 CET	60300	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.792519093 CET	3778	60300	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.792648077 CET	60300	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.793633938 CET	60300	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:33.913120031 CET	3778	60300	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:33.913364887 CET	60300	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.032906055 CET	3778	60300	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:34.499423027 CET	3778	60298	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:34.499639988 CET	60298	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.499670982 CET	60298	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.500149965 CET	60302	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.619837999 CET	3778	60302	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:34.619995117 CET	60302	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.620841980 CET	60302	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.740346909 CET	3778	60302	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:34.740523100 CET	60302	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.860105991 CET	3778	60302	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:34.930051088 CET	3778	60300	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:34.930207014 CET	60300	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.930283070 CET	60300	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:34.931020021 CET	60304	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.050477028 CET	3778	60304	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:35.050611019 CET	60304	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.051892996 CET	60304	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.171322107 CET	3778	60304	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:35.171411037 CET	60304	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.290893078 CET	3778	60304	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:35.758169889 CET	3778	60302	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:35.758366108 CET	60302	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.758407116 CET	60302	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.758893013 CET	60306	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.879113913 CET	3778	60306	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:35.879296064 CET	60306	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.880110025 CET	60306	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:35.999563932 CET	3778	60306	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:35.999686956 CET	60306	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:36.119472980 CET	3778	60306	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:36.187943935 CET	3778	60304	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:36.188044071 CET	60304	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:36.188158989 CET	60304	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:36.188816071 CET	60308	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:36.308325052 CET	3778	60308	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:36.308506966 CET	60308	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:36.309659958 CET	60308	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:36.429415941 CET	3778	60308	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:36.429531097 CET	60308	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:36.549144983 CET	3778	60308	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.019696951 CET	3778	60306	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.019864082 CET	60306	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.019889116 CET	60306	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.020306110 CET	60310	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.139873028 CET	3778	60310	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.140033007 CET	60310	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.141129017 CET	60310	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.260607004 CET	3778	60310	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.260924101 CET	60310	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.380397081 CET	3778	60310	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.668859959 CET	3778	60308	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.669034958 CET	60308	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.669123888 CET	60308	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.669675112 CET	60312	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.789201021 CET	3778	60312	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.789326906 CET	60312	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.790240049 CET	60312	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:37.909677029 CET	3778	60312	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:37.909879923 CET	60312	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.029387951 CET	3778	60312	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:38.398350000 CET	3778	60310	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:38.398554087 CET	60310	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.398643017 CET	60310	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.399010897 CET	60314	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.518507957 CET	3778	60314	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:38.518665075 CET	60314	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.519459963 CET	60314	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.638905048 CET	3778	60314	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:38.639028072 CET	60314	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.758481979 CET	3778	60314	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:38.926898956 CET	3778	60312	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:38.927371979 CET	60312	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.927371979 CET	60312	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:38.928004980 CET	60316	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.047425032 CET	3778	60316	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:39.047635078 CET	60316	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.048842907 CET	60316	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.168304920 CET	3778	60316	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:39.168504000 CET	60316	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.288034916 CET	3778	60316	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:39.656358957 CET	3778	60314	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:39.656678915 CET	60314	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.656860113 CET	60314	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.657386065 CET	60318	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.776892900 CET	3778	60318	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:39.777174950 CET	60318	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.778419971 CET	60318	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:39.897886992 CET	3778	60318	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:39.898076057 CET	60318	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.017577887 CET	3778	60318	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:40.184592962 CET	3778	60316	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:40.184773922 CET	60316	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.184848070 CET	60316	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.185859919 CET	60320	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.305418015 CET	3778	60320	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:40.305521011 CET	60320	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.306818008 CET	60320	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.426316977 CET	3778	60320	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:40.426542997 CET	60320	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.546117067 CET	3778	60320	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:40.916137934 CET	3778	60318	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:40.916315079 CET	60318	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.916408062 CET	60318	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:40.917144060 CET	60322	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.036566973 CET	3778	60322	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:41.036859035 CET	60322	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.037458897 CET	60322	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.156896114 CET	3778	60322	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:41.157072067 CET	60322	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.276468992 CET	3778	60322	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:41.450464964 CET	3778	60320	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:41.450640917 CET	60320	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.450679064 CET	60320	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.451283932 CET	60324	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.570839882 CET	3778	60324	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:41.571018934 CET	60324	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.572144032 CET	60324	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.692009926 CET	3778	60324	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:41.692142010 CET	60324	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:41.811605930 CET	3778	60324	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.176672935 CET	3778	60322	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.176930904 CET	60322	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.177079916 CET	60322	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.177957058 CET	60326	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.297533035 CET	3778	60326	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.297683001 CET	60326	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.298525095 CET	60326	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.418024063 CET	3778	60326	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.418154001 CET	60326	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.537631035 CET	3778	60326	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.757668972 CET	3778	60324	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.757838964 CET	60324	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.757908106 CET	60324	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.758392096 CET	60328	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.877911091 CET	3778	60328	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.878063917 CET	60328	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.879204988 CET	60328	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:42.998610973 CET	3778	60328	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:42.998712063 CET	60328	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:43.118185997 CET	3778	60328	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:43.435482979 CET	3778	60326	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:43.435683966 CET	60326	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:43.435785055 CET	60326	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:43.436709881 CET	60330	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:43.556284904 CET	3778	60330	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:43.556422949 CET	60330	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:43.558016062 CET	60330	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:43.677505016 CET	3778	60330	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:43.677608013 CET	60330	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:43.797136068 CET	3778	60330	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.015929937 CET	3778	60328	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.016156912 CET	60328	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.016232967 CET	60328	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.016892910 CET	60332	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.136396885 CET	3778	60332	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.136538982 CET	60332	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.137851954 CET	60332	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.257288933 CET	3778	60332	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.257736921 CET	60332	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.377279997 CET	3778	60332	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.719832897 CET	3778	60330	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.720114946 CET	60330	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.720114946 CET	60330	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.720655918 CET	60334	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.840265989 CET	3778	60334	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.840487957 CET	60334	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.841711998 CET	60334	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:44.961275101 CET	3778	60334	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:44.961589098 CET	60334	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.081137896 CET	3778	60334	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:45.293515921 CET	3778	60332	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:45.293834925 CET	60332	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.293834925 CET	60332	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.294332981 CET	60336	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.413815022 CET	3778	60336	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:45.414104939 CET	60336	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.415338993 CET	60336	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.534810066 CET	3778	60336	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:45.535175085 CET	60336	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.654695988 CET	3778	60336	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:45.978281021 CET	3778	60334	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:45.978591919 CET	60334	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.978682041 CET	60334	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:45.979331970 CET	60338	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.098766088 CET	3778	60338	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:46.098897934 CET	60338	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.100058079 CET	60338	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.219486952 CET	3778	60338	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:46.219608068 CET	60338	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.339217901 CET	3778	60338	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:46.552052975 CET	3778	60336	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:46.552386999 CET	60336	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.552484035 CET	60336	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.553463936 CET	60340	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.673007965 CET	3778	60340	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:46.673325062 CET	60340	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.674689054 CET	60340	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.794167995 CET	3778	60340	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:46.794424057 CET	60340	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:46.914014101 CET	3778	60340	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:47.244173050 CET	3778	60338	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:47.244482994 CET	60338	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.244549036 CET	60338	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.245235920 CET	60342	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.364770889 CET	3778	60342	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:47.364865065 CET	60342	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.365592957 CET	60342	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.490461111 CET	3778	60342	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:47.490561962 CET	60342	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.610049009 CET	3778	60342	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:47.811408043 CET	3778	60340	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:47.811585903 CET	60340	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.811662912 CET	60340	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.812387943 CET	60344	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.931904078 CET	3778	60344	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:47.932172060 CET	60344	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:47.933671951 CET	60344	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:48.053273916 CET	3778	60344	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:48.053459883 CET	60344	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:48.172991037 CET	3778	60344	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:48.714762926 CET	3778	60342	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:48.715122938 CET	60342	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:48.715217113 CET	60342	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:48.715925932 CET	60346	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:48.835437059 CET	3778	60346	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:48.835560083 CET	60346	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:48.836623907 CET	60346	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:48.956125975 CET	3778	60346	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:48.956250906 CET	60346	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.075822115 CET	3778	60346	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:49.255063057 CET	3778	60344	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:49.255175114 CET	60344	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.255264044 CET	60344	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.256082058 CET	60348	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.375612974 CET	3778	60348	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:49.375947952 CET	60348	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.377659082 CET	60348	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.498337030 CET	3778	60348	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:49.498560905 CET	60348	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.618197918 CET	3778	60348	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:49.974371910 CET	3778	60346	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:49.974560022 CET	60346	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.974800110 CET	60346	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:49.975497007 CET	60350	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.095032930 CET	3778	60350	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:50.095458984 CET	60350	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.096487999 CET	60350	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.216007948 CET	3778	60350	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:50.216274023 CET	60350	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.335836887 CET	3778	60350	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:50.562254906 CET	3778	60348	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:50.562401056 CET	60348	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.562503099 CET	60348	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.563132048 CET	60352	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.682706118 CET	3778	60352	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:50.682924032 CET	60352	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.684370041 CET	60352	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.803936958 CET	3778	60352	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:50.804233074 CET	60352	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:50.923768997 CET	3778	60352	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:51.823745966 CET	3778	60352	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:51.823936939 CET	60352	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:51.823937893 CET	60352	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:51.824466944 CET	60354	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:51.944025993 CET	3778	60354	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:51.944230080 CET	60354	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:51.945281029 CET	60354	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:52.064744949 CET	3778	60354	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:52.064874887 CET	60354	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:52.184571028 CET	3778	60354	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:53.082000017 CET	3778	60354	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:53.082261086 CET	60354	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:53.082364082 CET	60354	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:53.083108902 CET	60356	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:53.202665091 CET	3778	60356	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:53.202795982 CET	60356	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:53.204255104 CET	60356	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:53.323745966 CET	3778	60356	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:53.323851109 CET	60356	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:53.443506956 CET	3778	60356	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:54.341090918 CET	3778	60356	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:54.341360092 CET	60356	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:54.341423035 CET	60356	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:54.342161894 CET	60358	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:54.461659908 CET	3778	60358	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:54.461812019 CET	60358	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:54.463279009 CET	60358	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:54.582799911 CET	3778	60358	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:54.582931042 CET	60358	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:54.702461004 CET	3778	60358	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:55.609015942 CET	3778	60358	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:55.609247923 CET	60358	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:55.609476089 CET	60358	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:55.610290051 CET	60360	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:55.729795933 CET	3778	60360	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:55.730086088 CET	60360	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:55.731292963 CET	60360	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:55.850805044 CET	3778	60360	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:55.851049900 CET	60360	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:55.970628977 CET	3778	60360	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:56.867921114 CET	3778	60360	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:56.868025064 CET	60360	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:56.868072987 CET	60360	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:56.868792057 CET	60362	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:56.988454103 CET	3778	60362	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:56.988550901 CET	60362	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:56.989793062 CET	60362	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:57.109272003 CET	3778	60362	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:57.109360933 CET	60362	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:57.228969097 CET	3778	60362	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:58.128062010 CET	3778	60362	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:58.128272057 CET	60362	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:58.128310919 CET	60362	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:58.128921986 CET	60364	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:58.248625994 CET	3778	60364	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:58.248723984 CET	60364	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:58.249442101 CET	60364	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:58.369052887 CET	3778	60364	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:58.369147062 CET	60364	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:58.488718987 CET	3778	60364	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:59.386868000 CET	3778	60364	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:59.387015104 CET	60364	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:59.387078047 CET	60364	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:59.387782097 CET	60366	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:59.507384062 CET	3778	60366	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:59.507524014 CET	60366	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:59.509037971 CET	60366	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:59.628563881 CET	3778	60366	195.26.252.19	192.168.2.15
Dec 23, 2024 03:31:59.628663063 CET	60366	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:31:59.748298883 CET	3778	60366	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:00.099857092 CET	60350	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:00.219459057 CET	3778	60350	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:00.462132931 CET	3778	60350	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:00.462255955 CET	60350	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:00.663955927 CET	3778	60366	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:00.664135933 CET	60366	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:00.664242983 CET	60366	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:00.665008068 CET	60368	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:00.784713030 CET	3778	60368	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:00.784889936 CET	60368	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:00.786171913 CET	60368	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:00.905685902 CET	3778	60368	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:00.905814886 CET	60368	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:01.025506020 CET	3778	60368	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:02.467941999 CET	3778	60368	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:02.468138933 CET	60368	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:02.468226910 CET	60368	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:02.469074011 CET	60370	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:02.588762045 CET	3778	60370	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:02.588998079 CET	60370	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:02.590219021 CET	60370	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:02.709779978 CET	3778	60370	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:02.709942102 CET	60370	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:02.829488039 CET	3778	60370	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:03.728252888 CET	3778	60370	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:03.728441954 CET	60370	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:03.728548050 CET	60370	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:03.729353905 CET	60372	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:03.848936081 CET	3778	60372	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:03.849216938 CET	60372	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:03.850565910 CET	60372	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:03.970191002 CET	3778	60372	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:03.970355988 CET	60372	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:04.089914083 CET	3778	60372	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:04.987628937 CET	3778	60372	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:04.987852097 CET	60372	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:04.987976074 CET	60372	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:04.988970041 CET	60374	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:05.109289885 CET	3778	60374	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:05.109460115 CET	60374	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:05.110826969 CET	60374	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:05.230326891 CET	3778	60374	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:05.230633020 CET	60374	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:05.350183010 CET	3778	60374	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:06.257287025 CET	3778	60374	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:06.257411957 CET	60374	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:06.257528067 CET	60374	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:06.258162975 CET	60376	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:06.377796888 CET	3778	60376	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:06.377882004 CET	60376	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:06.379084110 CET	60376	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:06.498841047 CET	3778	60376	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:06.499108076 CET	60376	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:06.618752003 CET	3778	60376	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:07.517169952 CET	3778	60376	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:07.517358065 CET	60376	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:07.517461061 CET	60376	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:07.518459082 CET	60378	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:07.638153076 CET	3778	60378	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:07.638310909 CET	60378	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:07.639873028 CET	60378	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:07.759428024 CET	3778	60378	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:07.759692907 CET	60378	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:07.879350901 CET	3778	60378	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:08.781256914 CET	3778	60378	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:08.781431913 CET	60378	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:08.781466007 CET	60378	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:08.782167912 CET	60380	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:08.901745081 CET	3778	60380	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:08.902045965 CET	60380	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:08.903165102 CET	60380	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:09.022706985 CET	3778	60380	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:09.022865057 CET	60380	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:09.142745972 CET	3778	60380	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:10.043541908 CET	3778	60380	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:10.043901920 CET	60380	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:10.043942928 CET	60380	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:10.044579983 CET	60382	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:10.164068937 CET	3778	60382	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:10.164455891 CET	60382	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:10.165713072 CET	60382	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:10.285192966 CET	3778	60382	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:10.285325050 CET	60382	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:10.405265093 CET	3778	60382	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:11.309478998 CET	3778	60382	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:11.309844017 CET	60382	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:11.309881926 CET	60382	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:11.310564995 CET	60384	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:11.430179119 CET	3778	60384	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:11.430510044 CET	60384	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:11.431695938 CET	60384	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:11.551192999 CET	3778	60384	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:11.551465034 CET	60384	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:11.671180964 CET	3778	60384	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:12.567890882 CET	3778	60384	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:12.568095922 CET	60384	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:12.568177938 CET	60384	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:12.568592072 CET	60386	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:12.688189030 CET	3778	60386	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:12.688380003 CET	60386	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:12.689418077 CET	60386	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:12.808943987 CET	3778	60386	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:12.809292078 CET	60386	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:12.928873062 CET	3778	60386	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:13.827701092 CET	3778	60386	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:13.827826023 CET	60386	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:13.827897072 CET	60386	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:13.828320980 CET	60388	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:13.947897911 CET	3778	60388	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:13.948123932 CET	60388	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:13.949028015 CET	60388	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:14.068733931 CET	3778	60388	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:14.068875074 CET	60388	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:14.188399076 CET	3778	60388	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:15.088505030 CET	3778	60388	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:15.088630915 CET	60388	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:15.088684082 CET	60388	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:15.089251041 CET	60390	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:15.208781958 CET	3778	60390	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:15.208884001 CET	60390	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:15.210206032 CET	60390	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:15.329790115 CET	3778	60390	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:15.329898119 CET	60390	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:15.449558020 CET	3778	60390	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:16.353892088 CET	3778	60390	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:16.354047060 CET	60390	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:16.354152918 CET	60390	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:16.355143070 CET	60392	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:16.474817991 CET	3778	60392	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:16.475099087 CET	60392	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:16.476393938 CET	60392	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:16.595973015 CET	3778	60392	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:16.596240997 CET	60392	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:16.715831041 CET	3778	60392	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:17.613423109 CET	3778	60392	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:17.613714933 CET	60392	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:17.613830090 CET	60392	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:17.614567041 CET	60394	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:17.734143972 CET	3778	60394	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:17.734369993 CET	60394	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:17.735585928 CET	60394	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:17.855056047 CET	3778	60394	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:17.855222940 CET	60394	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:17.974776983 CET	3778	60394	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:18.878166914 CET	3778	60394	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:18.878293991 CET	60394	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:18.878329992 CET	60394	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:18.878830910 CET	60396	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:18.998471022 CET	3778	60396	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:18.998675108 CET	60396	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:18.999516010 CET	60396	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:19.119050026 CET	3778	60396	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:19.119215012 CET	60396	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:19.239332914 CET	3778	60396	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:20.136418104 CET	3778	60396	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:20.136557102 CET	60396	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:20.136585951 CET	60396	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:20.137197971 CET	60398	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:20.256777048 CET	3778	60398	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:20.256899118 CET	60398	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:20.257633924 CET	60398	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:20.377130985 CET	3778	60398	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:20.377286911 CET	60398	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:20.496876955 CET	3778	60398	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:21.398672104 CET	3778	60398	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:21.398827076 CET	60398	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:21.398848057 CET	60398	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:21.399391890 CET	60400	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:21.518923998 CET	3778	60400	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:21.519043922 CET	60400	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:21.519769907 CET	60400	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:21.639204979 CET	3778	60400	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:21.639364004 CET	60400	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:21.758871078 CET	3778	60400	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:22.657793045 CET	3778	60400	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:22.657941103 CET	60400	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:22.657942057 CET	60400	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:22.658621073 CET	60402	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:22.778107882 CET	3778	60402	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:22.778219938 CET	60402	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:22.779330015 CET	60402	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:22.898833036 CET	3778	60402	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:22.898929119 CET	60402	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:23.018413067 CET	3778	60402	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:23.916542053 CET	3778	60402	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:23.916680098 CET	60402	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:23.916681051 CET	60402	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:23.917330027 CET	60404	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:24.036757946 CET	3778	60404	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:24.036870003 CET	60404	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:24.037946939 CET	60404	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:24.157386065 CET	3778	60404	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:24.157624960 CET	60404	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:24.277101040 CET	3778	60404	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:34.045339108 CET	60404	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:32:34.164943933 CET	3778	60404	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:34.386775017 CET	3778	60404	195.26.252.19	192.168.2.15
Dec 23, 2024 03:32:34.387033939 CET	60404	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:33:00.518687010 CET	60350	3778	192.168.2.15	195.26.252.19
Dec 23, 2024 03:33:00.638545990 CET	3778	60350	195.26.252.19	192.168.2.15
Dec 23, 2024 03:33:00.859024048 CET	3778	60350	195.26.252.19	192.168.2.15
Dec 23, 2024 03:33:00.859319925 CET	60350	3778	192.168.2.15	195.26.252.19

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5591, Parent PID: 5519

General

Start time (UTC):	02:31:16
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5593, Parent PID: 5591

General

Start time (UTC):	02:31:16
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5595, Parent PID: 5593

General

Start time (UTC):	02:31:16
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5596, Parent PID: 5593

General

Start time (UTC):	02:31:16
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5601, Parent PID: 5591

General

Start time (UTC):	02:31:22
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5603, Parent PID: 5591

General

Start time (UTC):	02:31:22
Start date (UTC):	23/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5591, Parent PID: 5519

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5593, Parent PID: 5591

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5595, Parent PID: 5593

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5596, Parent PID: 5593

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5601, Parent PID: 5591

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.ppc.elf PID: 5603, Parent PID: 5591

General

Chronological Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.ppc.elf