Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.x86.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.x86.elf
Analysis ID:	1580793
MD5:	cab2fc62b63f28cd95c3fdca9ecec6d0
SHA1:	df33b92944b8436e7310b0a03ca9038b70c65a56
SHA256:	8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580793
Start date and time:	2024-12-26 08:27:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.x86.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
PID:	6215
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215, Parent: 6132, MD5: cab2fc62b63f28cd95c3fdca9ecec6d0) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6216, Parent: 6215)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6217, Parent: 6216)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6218, Parent: 6216)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6221, Parent: 6215)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6222, Parent: 6215)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6221.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6217.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6217.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6217.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6217.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6215.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6215.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6215.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6215.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6216.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6216.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6216.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6216.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6215	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x197e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1992:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6216	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1451:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1465:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1479:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x148d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1505:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1519:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1541:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1555:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1569:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x157d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1591:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6217	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x657:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x66b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x693:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6221	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1740:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1754:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

ReversingLabs: Detection: 42%

Machine Learning detection for sample

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.23:55260 -> 92.118.56.167:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167
Source: unknown	TCP traffic detected without corresponding DNS query: 92.118.56.167

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6215, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6217, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6221, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6221.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6217.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6215.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6216.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6215, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6217, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6221, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/4501/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/1494/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6215)	File opened: /proc/141/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

Submission file: segment LOAD with 7.9618 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.x86.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
ub8ehJSePAfc9FYqZIT6.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
92.118.56.167	unknown	Germany	9009	M247GB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	ngwa5.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	xd.arm5.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	woega6.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	bin.sh.elf	Get hash	malicious	Unknown	Browse
	main_x86_64.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	ngwa5.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	xd.arm5.elf	Get hash	malicious	Mirai	Browse
	telnet.arm7.elf	Get hash	malicious	Unknown	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	woega6.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	bin.sh.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ngwa5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	telnet.arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wlw68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	njvwa4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	ngwa5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	telnet.arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wlw68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	njvwa4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	ngwa5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	telnet.arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	wkb86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	woega6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	njvwa4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bin.sh.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
M247GB	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse	38.132.109.126
	nklppc.elf	Get hash	malicious	Unknown	Browse	193.160.72.174
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	45.10.162.162
	arm.elf	Get hash	malicious	Unknown	Browse	92.249.48.36
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.204.189.65
	hmips.elf	Get hash	malicious	Mirai	Browse	38.207.37.102
	nshppc.elf	Get hash	malicious	Mirai	Browse	185.120.145.21
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	196.18.78.47
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	196.16.89.5
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.37.253.255

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.9599135728877615
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ub8ehJSePAfc9FYqZIT6.x86.elf
File size:	38'716 bytes
MD5:	cab2fc62b63f28cd95c3fdca9ecec6d0
SHA1:	df33b92944b8436e7310b0a03ca9038b70c65a56
SHA256:	8436a21f6e581d533cc9d3f9b292c89aa171b6c8f560f3baf666b00556b60871
SHA512:	dd2bdb170092fc31e19e072f4b637ccff00a26ca59ddb4e02f01ff189d382c8f0b267eafd3b508ee9fffb076ac8204e2453a6769f7bb2a25b40fd043dd7d2224
SSDEEP:	768:dxaYe0syQ8V3uZJYDR+AGJyQlYuOwqakXzEp3Lj7z20z49nbcuyD7UrQRj5:CYgBe3uZgR+zZiw807j7S0wnouy8ry9
TLSH:	2F03F11EC8CC1BCFFE7D03F0197BF54F1A00D506CA55E5EB9682B02A64A8B16F859A17
File Content Preview:	.ELF....................P...4...........4. ...(.....................D...D...........................................Q.td.............................-..UPX!.........2...2......W..........?..k.I/.j....\.R......)..n.4go.\|.>#.....{~o....8.F.^...MFL.f.5 ..I.r

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc09450
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x9644	0x9644	7.9618	0x5	R E	0x1000
LOAD	0xc08	0x805bc08	0x805bc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 08:27:40.382936954 CET	55260	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:40.502713919 CET	3778	55260	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:40.502899885 CET	55260	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:40.502901077 CET	55260	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:40.622683048 CET	3778	55260	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:40.622749090 CET	55260	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:40.742760897 CET	3778	55260	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:41.642209053 CET	3778	55260	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:41.642482042 CET	55260	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:41.642482996 CET	55260	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:41.642577887 CET	55262	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:41.762157917 CET	3778	55262	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:41.762264967 CET	55262	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:41.762363911 CET	55262	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:41.881983995 CET	3778	55262	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:41.882169008 CET	55262	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:42.001717091 CET	3778	55262	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:42.900391102 CET	3778	55262	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:42.900624037 CET	55262	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:42.900693893 CET	55264	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:42.900701046 CET	55262	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:43.020328045 CET	3778	55264	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:43.020395994 CET	55264	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:43.020447969 CET	55264	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:43.141108036 CET	3778	55264	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:43.141181946 CET	55264	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:43.260782957 CET	3778	55264	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:43.267297029 CET	43928	443	192.168.2.23	91.189.91.42
Dec 26, 2024 08:27:44.160370111 CET	3778	55264	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:44.160464048 CET	55264	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:44.160490036 CET	55264	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:44.160505056 CET	55266	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:44.280040979 CET	3778	55266	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:44.280198097 CET	55266	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:44.280198097 CET	55266	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:44.399745941 CET	3778	55266	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:44.399837971 CET	55266	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:44.519439936 CET	3778	55266	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:45.418209076 CET	3778	55266	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:45.418425083 CET	55266	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:45.418425083 CET	55266	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:45.418452024 CET	55268	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:45.537985086 CET	3778	55268	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:45.538157940 CET	55268	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:45.538157940 CET	55268	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:45.657768011 CET	3778	55268	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:45.657933950 CET	55268	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:45.777489901 CET	3778	55268	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:45.914506912 CET	55270	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.034189939 CET	3778	55270	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:46.034351110 CET	55270	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.034352064 CET	55270	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.153945923 CET	3778	55270	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:46.154093027 CET	55270	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.273593903 CET	3778	55270	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:46.676933050 CET	3778	55268	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:46.677109003 CET	55272	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.677123070 CET	55268	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.677123070 CET	55268	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.797431946 CET	3778	55272	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:46.797585964 CET	55272	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.797585964 CET	55272	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:46.917160988 CET	3778	55272	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:46.917327881 CET	55272	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.036971092 CET	3778	55272	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:47.172931910 CET	3778	55270	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:47.173188925 CET	55270	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.173258066 CET	55270	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.173268080 CET	55274	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.292783976 CET	3778	55274	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:47.293071032 CET	55274	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.293085098 CET	55274	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.412576914 CET	3778	55274	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:47.412712097 CET	55274	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.533061981 CET	3778	55274	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:47.938992023 CET	3778	55272	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:47.939166069 CET	55272	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.939166069 CET	55272	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:47.939183950 CET	55276	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.059242010 CET	3778	55276	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:48.059329033 CET	55276	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.059462070 CET	55276	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.178925037 CET	3778	55276	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:48.179092884 CET	55276	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.298630953 CET	3778	55276	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:48.432996988 CET	3778	55274	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:48.433161974 CET	55274	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.433233023 CET	55274	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.433285952 CET	55278	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.552824020 CET	3778	55278	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:48.552925110 CET	55278	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.553117037 CET	55278	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.642656088 CET	42836	443	192.168.2.23	91.189.91.43
Dec 26, 2024 08:27:48.672571898 CET	3778	55278	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:48.672744989 CET	55278	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:48.792212963 CET	3778	55278	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.197853088 CET	3778	55276	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.198162079 CET	55276	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.198232889 CET	55276	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.198236942 CET	55280	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.317925930 CET	3778	55280	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.318203926 CET	55280	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.318203926 CET	55280	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.437722921 CET	3778	55280	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.437968969 CET	55280	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.558192015 CET	3778	55280	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.696744919 CET	3778	55278	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.696999073 CET	55278	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.696999073 CET	55278	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.697052956 CET	55282	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.816623926 CET	3778	55282	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.816924095 CET	55282	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.816924095 CET	55282	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:49.936547041 CET	3778	55282	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:49.936875105 CET	55282	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.056473017 CET	3778	55282	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:50.178401947 CET	42516	80	192.168.2.23	109.202.202.202
Dec 26, 2024 08:27:50.457091093 CET	3778	55280	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:50.457406998 CET	55280	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.457406998 CET	55280	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.457461119 CET	55284	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.577183008 CET	3778	55284	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:50.577404976 CET	55284	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.577589035 CET	55284	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.697099924 CET	3778	55284	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:50.697274923 CET	55284	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.817013025 CET	3778	55284	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:50.954725027 CET	3778	55282	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:50.955080986 CET	55282	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.955080986 CET	55282	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:50.955116987 CET	55286	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.074714899 CET	3778	55286	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:51.074776888 CET	55286	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.074806929 CET	55286	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.194353104 CET	3778	55286	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:51.194624901 CET	55286	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.314162016 CET	3778	55286	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:51.717338085 CET	3778	55284	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:51.717596054 CET	55284	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.717669010 CET	55284	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.717746973 CET	55288	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.837285995 CET	3778	55288	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:51.838403940 CET	55288	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.842331886 CET	55288	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:51.961857080 CET	3778	55288	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:51.962177038 CET	55288	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.081690073 CET	3778	55288	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:52.216001034 CET	3778	55286	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:52.216242075 CET	55286	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.216332912 CET	55286	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.216423035 CET	55290	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.335851908 CET	3778	55290	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:52.335969925 CET	55290	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.336091042 CET	55290	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.457127094 CET	3778	55290	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:52.457354069 CET	55290	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.576900959 CET	3778	55290	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:52.976110935 CET	3778	55288	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:52.976414919 CET	55288	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.976464987 CET	55288	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:52.976552963 CET	55292	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.096352100 CET	3778	55292	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:53.096468925 CET	55292	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.096617937 CET	55292	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.216103077 CET	3778	55292	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:53.216486931 CET	55292	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.336039066 CET	3778	55292	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:53.473885059 CET	3778	55290	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:53.474147081 CET	55290	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.474256039 CET	55290	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.474328041 CET	55294	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.593815088 CET	3778	55294	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:53.594201088 CET	55294	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.594214916 CET	55294	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.713841915 CET	3778	55294	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:53.714167118 CET	55294	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:53.833786011 CET	3778	55294	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.234325886 CET	3778	55292	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.234587908 CET	55292	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.234678030 CET	55292	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.234777927 CET	55296	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.355624914 CET	3778	55296	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.355767965 CET	55296	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.355984926 CET	55296	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.475425005 CET	3778	55296	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.475655079 CET	55296	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.595411062 CET	3778	55296	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.732917070 CET	3778	55294	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.733159065 CET	55294	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.733253002 CET	55294	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.733334064 CET	55298	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.852837086 CET	3778	55298	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.853056908 CET	55298	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.853333950 CET	55298	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:54.972765923 CET	3778	55298	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:54.972893953 CET	55298	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.092600107 CET	3778	55298	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:55.498336077 CET	3778	55296	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:55.498639107 CET	55296	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.498707056 CET	55296	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.498785019 CET	55300	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.618264914 CET	3778	55300	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:55.618402004 CET	55300	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.618614912 CET	55300	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.738193035 CET	3778	55300	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:55.738442898 CET	55300	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.858016014 CET	3778	55300	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:55.989902020 CET	3778	55298	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:55.990169048 CET	55298	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.990263939 CET	55298	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:55.990376949 CET	55302	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.110212088 CET	3778	55302	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:56.110338926 CET	55302	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.110567093 CET	55302	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.230077028 CET	3778	55302	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:56.230304956 CET	55302	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.350119114 CET	3778	55302	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:56.756330967 CET	3778	55300	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:56.756494045 CET	55300	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.756647110 CET	55300	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.756715059 CET	55304	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.876244068 CET	3778	55304	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:56.876461029 CET	55304	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.876555920 CET	55304	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:56.996324062 CET	3778	55304	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:56.996571064 CET	55304	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:57.116250992 CET	3778	55304	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:57.250596046 CET	3778	55302	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:57.250869989 CET	55302	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:57.251019955 CET	55302	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:57.251099110 CET	55306	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:57.370641947 CET	3778	55306	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:57.370781898 CET	55306	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:57.370986938 CET	55306	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:57.490479946 CET	3778	55306	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:57.490677118 CET	55306	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:57.610421896 CET	3778	55306	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.011477947 CET	3778	55304	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.011841059 CET	55304	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.011877060 CET	55304	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.011993885 CET	55308	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.131685019 CET	3778	55308	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.131823063 CET	55308	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.132046938 CET	55308	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.252620935 CET	3778	55308	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.252845049 CET	55308	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.372472048 CET	3778	55308	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.517954111 CET	3778	55306	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.518244028 CET	55306	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.518407106 CET	55306	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.518507004 CET	55310	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.638067007 CET	3778	55310	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.638303041 CET	55310	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.638442993 CET	55310	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.758064985 CET	3778	55310	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:58.758198977 CET	55310	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:58.877810001 CET	3778	55310	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:59.272190094 CET	3778	55308	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:59.272546053 CET	55308	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.272546053 CET	55308	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.272798061 CET	55312	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.392601013 CET	3778	55312	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:59.392853975 CET	55312	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.392934084 CET	55312	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.512522936 CET	3778	55312	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:59.512769938 CET	55312	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.632385015 CET	3778	55312	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:59.777030945 CET	3778	55310	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:59.777128935 CET	55310	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.777333975 CET	55310	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.777431965 CET	55314	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.896996021 CET	3778	55314	92.118.56.167	192.168.2.23
Dec 26, 2024 08:27:59.897273064 CET	55314	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:27:59.897382021 CET	55314	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.016999960 CET	3778	55314	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:00.017261982 CET	55314	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.137053967 CET	3778	55314	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:00.531718016 CET	3778	55312	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:00.531925917 CET	55312	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.532021999 CET	55312	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.532067060 CET	55316	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.651777983 CET	3778	55316	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:00.652034998 CET	55316	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.652086973 CET	55316	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.771744013 CET	3778	55316	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:00.771975040 CET	55316	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:00.891752958 CET	3778	55316	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:01.034976959 CET	3778	55314	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:01.035247087 CET	55314	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.035352945 CET	55314	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.035367012 CET	55318	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.155405998 CET	3778	55318	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:01.155615091 CET	55318	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.155653000 CET	55318	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.275194883 CET	3778	55318	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:01.275285959 CET	55318	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.394937992 CET	3778	55318	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:01.790201902 CET	3778	55316	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:01.790482998 CET	55316	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.790534973 CET	55316	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.790617943 CET	55320	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.910120964 CET	3778	55320	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:01.910281897 CET	55320	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:01.910372972 CET	55320	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.030159950 CET	3778	55320	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:02.030308008 CET	55320	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.150681973 CET	3778	55320	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:02.293631077 CET	3778	55318	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:02.293899059 CET	55318	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.293992996 CET	55318	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.294089079 CET	55322	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.413611889 CET	3778	55322	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:02.413861036 CET	55322	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.413959980 CET	55322	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.533525944 CET	3778	55322	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:02.533750057 CET	55322	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:02.653428078 CET	3778	55322	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.048531055 CET	3778	55320	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.048693895 CET	55320	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.048773050 CET	55320	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.048861027 CET	55324	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.168574095 CET	3778	55324	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.168879986 CET	55324	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.169006109 CET	55324	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.232562065 CET	43928	443	192.168.2.23	91.189.91.42
Dec 26, 2024 08:28:03.288959026 CET	3778	55324	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.289355993 CET	55324	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.409044027 CET	3778	55324	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.554702997 CET	3778	55322	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.554840088 CET	55322	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.554891109 CET	55322	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.554938078 CET	55326	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.835024118 CET	3778	55322	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.835401058 CET	55322	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.835431099 CET	3778	55326	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.837939978 CET	55326	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.837982893 CET	55326	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:03.957453012 CET	3778	55326	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:03.957627058 CET	55326	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.077142954 CET	3778	55326	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:04.305403948 CET	3778	55324	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:04.305500031 CET	55324	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.305517912 CET	55324	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.305583000 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.425124884 CET	3778	55328	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:04.425362110 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.425510883 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.544987917 CET	3778	55328	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:04.545130968 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.664654016 CET	3778	55328	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:04.977164984 CET	3778	55326	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:04.977387905 CET	55326	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.977469921 CET	55326	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:04.977674961 CET	55330	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:05.097266912 CET	3778	55330	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:05.097434998 CET	55330	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:05.097635031 CET	55330	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:05.217725992 CET	3778	55330	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:05.217807055 CET	55330	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:05.337440968 CET	3778	55330	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:06.239763021 CET	3778	55330	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:06.239902020 CET	55330	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:06.240011930 CET	55330	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:06.240135908 CET	55332	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:06.359654903 CET	3778	55332	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:06.359723091 CET	55332	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:06.359766006 CET	55332	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:06.479523897 CET	3778	55332	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:06.479589939 CET	55332	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:06.599253893 CET	3778	55332	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:07.498078108 CET	3778	55332	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:07.498234034 CET	55332	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:07.498270035 CET	55332	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:07.498348951 CET	55334	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:07.617990017 CET	3778	55334	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:07.618068933 CET	55334	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:07.618179083 CET	55334	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:07.737909079 CET	3778	55334	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:07.738008022 CET	55334	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:07.857700109 CET	3778	55334	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:08.753494978 CET	3778	55334	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:08.753597021 CET	55334	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:08.753659964 CET	55334	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:08.753757954 CET	55336	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:08.873372078 CET	3778	55336	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:08.873594999 CET	55336	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:08.873852968 CET	55336	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:08.993405104 CET	3778	55336	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:08.993690014 CET	55336	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:09.113666058 CET	3778	55336	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:10.011158943 CET	3778	55336	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:10.011337042 CET	55336	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:10.011337042 CET	55336	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:10.011423111 CET	55338	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:10.131170034 CET	3778	55338	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:10.131441116 CET	55338	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:10.131441116 CET	55338	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:10.251085997 CET	3778	55338	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:10.251190901 CET	55338	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:10.370811939 CET	3778	55338	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:11.269949913 CET	3778	55338	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:11.270109892 CET	55338	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:11.270155907 CET	55338	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:11.270172119 CET	55340	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:11.389826059 CET	3778	55340	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:11.390053988 CET	55340	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:11.390069962 CET	55340	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:11.509691954 CET	3778	55340	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:11.510001898 CET	55340	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:11.629561901 CET	3778	55340	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:12.525409937 CET	3778	55340	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:12.525702000 CET	55340	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:12.525722980 CET	55340	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:12.525774002 CET	55342	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:12.645418882 CET	3778	55342	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:12.645591974 CET	55342	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:12.645618916 CET	55342	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:12.765222073 CET	3778	55342	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:12.765503883 CET	55342	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:12.885080099 CET	3778	55342	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:13.783082962 CET	3778	55342	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:13.783261061 CET	55342	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:13.783284903 CET	55342	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:13.783328056 CET	55344	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:13.903079987 CET	3778	55344	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:13.903207064 CET	55344	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:13.903228045 CET	55344	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:14.022922993 CET	3778	55344	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:14.023000002 CET	55344	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:14.142596006 CET	3778	55344	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:14.430967093 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:14.550720930 CET	3778	55328	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:14.771222115 CET	3778	55328	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:14.771387100 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:15.042459965 CET	3778	55344	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:15.042593002 CET	55344	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:15.042593002 CET	55344	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:15.042623043 CET	55346	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:15.162472010 CET	3778	55346	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:15.162535906 CET	55346	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:15.162552118 CET	55346	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:15.282325029 CET	3778	55346	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:15.282454014 CET	55346	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:15.402070999 CET	3778	55346	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:15.518899918 CET	42836	443	192.168.2.23	91.189.91.43
Dec 26, 2024 08:28:16.302180052 CET	3778	55346	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:16.302263021 CET	55346	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:16.302287102 CET	55346	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:16.302325010 CET	55348	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:16.421935081 CET	3778	55348	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:16.422027111 CET	55348	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:16.422079086 CET	55348	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:16.541682959 CET	3778	55348	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:16.541796923 CET	55348	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:16.661463022 CET	3778	55348	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:17.560739040 CET	3778	55348	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:17.560849905 CET	55348	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:17.560851097 CET	55348	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:17.560950994 CET	55350	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:17.680604935 CET	3778	55350	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:17.680672884 CET	55350	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:17.680718899 CET	55350	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:17.800365925 CET	3778	55350	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:17.800453901 CET	55350	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:17.923190117 CET	3778	55350	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:18.818783045 CET	3778	55350	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:18.818898916 CET	55350	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:18.818898916 CET	55350	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:18.818921089 CET	55352	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:18.938615084 CET	3778	55352	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:18.938740969 CET	55352	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:18.938903093 CET	55352	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:19.058466911 CET	3778	55352	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:19.058531046 CET	55352	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:19.178225040 CET	3778	55352	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:19.614217997 CET	42516	80	192.168.2.23	109.202.202.202
Dec 26, 2024 08:28:20.079734087 CET	3778	55352	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:20.079869986 CET	55352	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:20.079890966 CET	55352	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:20.079917908 CET	55354	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:20.199996948 CET	3778	55354	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:20.200062990 CET	55354	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:20.200077057 CET	55354	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:20.320048094 CET	3778	55354	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:20.320137024 CET	55354	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:20.439898014 CET	3778	55354	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:21.338056087 CET	3778	55354	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:21.338136911 CET	55354	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:21.338156939 CET	55354	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:21.338196993 CET	55356	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:21.457828045 CET	3778	55356	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:21.457895041 CET	55356	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:21.457945108 CET	55356	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:21.577591896 CET	3778	55356	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:21.577661037 CET	55356	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:21.697340012 CET	3778	55356	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:22.596612930 CET	3778	55356	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:22.596726894 CET	55356	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:22.596728086 CET	55356	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:22.596842051 CET	55358	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:22.716541052 CET	3778	55358	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:22.716619015 CET	55358	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:22.716619015 CET	55358	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:22.836317062 CET	3778	55358	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:22.836401939 CET	55358	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:22.957783937 CET	3778	55358	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:23.855138063 CET	3778	55358	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:23.855257988 CET	55358	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:23.855257988 CET	55358	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:23.855292082 CET	55360	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:23.974912882 CET	3778	55360	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:23.974997044 CET	55360	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:23.975019932 CET	55360	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:24.094748974 CET	3778	55360	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:24.094872952 CET	55360	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:24.214436054 CET	3778	55360	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:25.112937927 CET	3778	55360	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:25.113090992 CET	55360	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:25.113112926 CET	55360	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:25.113143921 CET	55362	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:25.232882977 CET	3778	55362	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:25.233110905 CET	55362	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:25.233124971 CET	55362	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:25.352786064 CET	3778	55362	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:25.353085041 CET	55362	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:25.472620964 CET	3778	55362	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:26.370917082 CET	3778	55362	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:26.371081114 CET	55362	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:26.371081114 CET	55362	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:26.371248007 CET	55364	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:26.490889072 CET	3778	55364	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:26.491228104 CET	55364	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:26.491229057 CET	55364	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:26.610974073 CET	3778	55364	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:26.611341953 CET	55364	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:26.731278896 CET	3778	55364	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:27.630918980 CET	3778	55364	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:27.631057024 CET	55364	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:27.631057024 CET	55364	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:27.631150007 CET	55366	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:27.750830889 CET	3778	55366	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:27.751015902 CET	55366	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:27.751015902 CET	55366	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:27.870798111 CET	3778	55366	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:27.870918989 CET	55366	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:27.990609884 CET	3778	55366	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:28.888582945 CET	3778	55366	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:28.888717890 CET	55366	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:28.888792992 CET	55368	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:28.888813972 CET	55366	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:29.008835077 CET	3778	55368	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:29.008960009 CET	55368	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:29.008985043 CET	55368	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:29.128757954 CET	3778	55368	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:29.128851891 CET	55368	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:29.248523951 CET	3778	55368	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:30.148313999 CET	3778	55368	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:30.148430109 CET	55368	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:30.148430109 CET	55368	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:30.148430109 CET	55370	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:30.268246889 CET	3778	55370	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:30.268311977 CET	55370	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:30.268335104 CET	55370	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:30.387933016 CET	3778	55370	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:30.388005972 CET	55370	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:30.507806063 CET	3778	55370	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:31.406589031 CET	3778	55370	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:31.406680107 CET	55370	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:31.406697035 CET	55370	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:31.406739950 CET	55372	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:31.526341915 CET	3778	55372	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:31.526479006 CET	55372	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:31.526552916 CET	55372	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:31.646295071 CET	3778	55372	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:31.646413088 CET	55372	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:31.766098022 CET	3778	55372	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:32.666600943 CET	3778	55372	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:32.666825056 CET	55372	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:32.666826010 CET	55372	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:32.666913986 CET	55374	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:32.786569118 CET	3778	55374	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:32.786796093 CET	55374	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:32.786843061 CET	55374	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:32.906646967 CET	3778	55374	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:32.906861067 CET	55374	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:33.026429892 CET	3778	55374	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:33.925771952 CET	3778	55374	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:33.925945997 CET	55374	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:33.926161051 CET	55374	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:33.926254034 CET	55376	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:34.045886040 CET	3778	55376	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:34.046017885 CET	55376	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:34.046132088 CET	55376	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:34.166173935 CET	3778	55376	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:34.166322947 CET	55376	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:34.286037922 CET	3778	55376	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:35.187746048 CET	3778	55376	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:35.187923908 CET	55376	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:35.187925100 CET	55376	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:35.188008070 CET	55378	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:35.307893038 CET	3778	55378	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:35.308062077 CET	55378	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:35.308130980 CET	55378	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:35.427917004 CET	3778	55378	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:35.428091049 CET	55378	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:35.547995090 CET	3778	55378	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:36.446798086 CET	3778	55378	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:36.446913958 CET	55378	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:36.446913958 CET	55378	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:36.446947098 CET	55380	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:36.566639900 CET	3778	55380	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:36.566704035 CET	55380	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:36.566725969 CET	55380	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:36.686625957 CET	3778	55380	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:36.686727047 CET	55380	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:36.806327105 CET	3778	55380	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:37.704976082 CET	3778	55380	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:37.705080032 CET	55380	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:37.705105066 CET	55380	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:37.705137014 CET	55382	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:37.824965954 CET	3778	55382	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:37.825162888 CET	55382	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:37.825179100 CET	55382	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:37.944964886 CET	3778	55382	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:37.945162058 CET	55382	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:38.065068007 CET	3778	55382	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:38.962383032 CET	3778	55382	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:38.962502956 CET	55382	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:38.962527037 CET	55382	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:38.962686062 CET	55384	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:39.082365036 CET	3778	55384	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:39.082509041 CET	55384	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:39.082587004 CET	55384	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:39.202260971 CET	3778	55384	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:39.202348948 CET	55384	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:39.322190046 CET	3778	55384	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:40.224045038 CET	3778	55384	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:40.224172115 CET	55384	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:40.224172115 CET	55384	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:40.224251032 CET	55386	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:40.344460011 CET	3778	55386	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:40.344563961 CET	55386	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:40.344563961 CET	55386	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:40.464433908 CET	3778	55386	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:40.464546919 CET	55386	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:40.584252119 CET	3778	55386	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:41.484111071 CET	3778	55386	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:41.484249115 CET	55386	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:41.484250069 CET	55386	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:41.484262943 CET	55388	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:41.604118109 CET	3778	55388	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:41.604188919 CET	55388	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:41.604208946 CET	55388	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:41.724226952 CET	3778	55388	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:41.724374056 CET	55388	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:41.844101906 CET	3778	55388	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:42.742002964 CET	3778	55388	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:42.742094994 CET	55388	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:42.742111921 CET	55388	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:42.742127895 CET	55390	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:42.861932039 CET	3778	55390	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:42.861998081 CET	55390	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:42.862016916 CET	55390	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:42.981723070 CET	3778	55390	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:42.981790066 CET	55390	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:43.101546049 CET	3778	55390	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:44.001370907 CET	3778	55390	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:44.001471996 CET	55390	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:44.001497984 CET	55390	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:44.001672983 CET	55392	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:44.121623993 CET	3778	55392	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:44.121807098 CET	55392	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:44.121807098 CET	55392	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:44.186968088 CET	43928	443	192.168.2.23	91.189.91.42
Dec 26, 2024 08:28:44.241560936 CET	3778	55392	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:44.241897106 CET	55392	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:44.362128019 CET	3778	55392	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:45.259412050 CET	3778	55392	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:45.259598017 CET	55392	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:45.259598017 CET	55392	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:45.259680986 CET	55394	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:45.379275084 CET	3778	55394	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:45.379442930 CET	55394	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:45.379442930 CET	55394	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:45.499018908 CET	3778	55394	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:45.499102116 CET	55394	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:45.618707895 CET	3778	55394	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:46.521878004 CET	3778	55394	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:46.521960020 CET	55394	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:46.522001028 CET	55394	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:46.522001982 CET	55396	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:46.641597033 CET	3778	55396	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:46.641660929 CET	55396	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:46.641683102 CET	55396	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:46.761253119 CET	3778	55396	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:46.761342049 CET	55396	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:46.880991936 CET	3778	55396	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:47.778764009 CET	3778	55396	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:47.778858900 CET	55396	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:47.778908014 CET	55396	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:47.778908968 CET	55398	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:47.898719072 CET	3778	55398	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:47.898895979 CET	55398	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:47.898932934 CET	55398	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:48.018548012 CET	3778	55398	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:48.018613100 CET	55398	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:48.138338089 CET	3778	55398	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:49.037327051 CET	3778	55398	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:49.037504911 CET	55398	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:49.037620068 CET	55398	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:49.037667990 CET	55400	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:49.157152891 CET	3778	55400	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:49.157249928 CET	55400	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:49.157428980 CET	55400	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:49.277017117 CET	3778	55400	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:49.277102947 CET	55400	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:49.396681070 CET	3778	55400	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:50.294187069 CET	3778	55400	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:50.294306040 CET	55400	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:50.294466972 CET	55400	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:50.294538021 CET	55402	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:50.414235115 CET	3778	55402	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:50.414369106 CET	55402	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:50.414618969 CET	55402	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:50.534248114 CET	3778	55402	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:50.534322977 CET	55402	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:50.654129028 CET	3778	55402	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:51.552314997 CET	3778	55402	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:51.552417040 CET	55402	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:51.552491903 CET	55402	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:51.552557945 CET	55404	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:51.672106981 CET	3778	55404	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:51.672192097 CET	55404	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:51.672476053 CET	55404	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:51.792566061 CET	3778	55404	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:51.792627096 CET	55404	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:51.912395954 CET	3778	55404	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:52.811799049 CET	3778	55404	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:52.811909914 CET	55404	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:52.812143087 CET	55404	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:52.812246084 CET	55406	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:52.931965113 CET	3778	55406	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:52.932048082 CET	55406	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:52.932261944 CET	55406	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:53.052016020 CET	3778	55406	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:53.052139044 CET	55406	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:53.172214985 CET	3778	55406	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:54.069401979 CET	3778	55406	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:54.069510937 CET	55406	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:54.069569111 CET	55406	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:54.069653988 CET	55408	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:54.189162016 CET	3778	55408	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:54.189409971 CET	55408	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:54.189512968 CET	55408	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:54.309091091 CET	3778	55408	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:54.309339046 CET	55408	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:54.430556059 CET	3778	55408	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:55.328454971 CET	3778	55408	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:55.328757048 CET	55408	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:55.328815937 CET	55408	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:55.328892946 CET	55410	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:55.448652983 CET	3778	55410	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:55.449026108 CET	55410	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:55.449168921 CET	55410	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:55.568900108 CET	3778	55410	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:55.569165945 CET	55410	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:55.689142942 CET	3778	55410	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:56.591480017 CET	3778	55410	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:56.591770887 CET	55410	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:56.591823101 CET	55410	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:56.591938019 CET	55412	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:56.711529016 CET	3778	55412	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:56.711885929 CET	55412	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:56.711966038 CET	55412	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:56.831566095 CET	3778	55412	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:56.831866026 CET	55412	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:56.951467037 CET	3778	55412	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:57.850284100 CET	3778	55412	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:57.850533009 CET	55412	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:57.850533009 CET	55412	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:57.850624084 CET	55414	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:57.970156908 CET	3778	55414	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:57.970426083 CET	55414	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:57.970506907 CET	55414	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:58.090114117 CET	3778	55414	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:58.090404034 CET	55414	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:58.210047960 CET	3778	55414	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:59.108098984 CET	3778	55414	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:59.108403921 CET	55414	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:59.108486891 CET	55414	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:59.108547926 CET	55416	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:59.228038073 CET	3778	55416	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:59.228578091 CET	55416	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:59.228578091 CET	55416	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:59.348335981 CET	3778	55416	92.118.56.167	192.168.2.23
Dec 26, 2024 08:28:59.348659992 CET	55416	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:28:59.468178034 CET	3778	55416	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:00.368249893 CET	3778	55416	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:00.368545055 CET	55416	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:00.368627071 CET	55416	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:00.368720055 CET	55418	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:00.488313913 CET	3778	55418	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:00.488712072 CET	55418	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:00.488806009 CET	55418	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:00.608328104 CET	3778	55418	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:00.608577013 CET	55418	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:00.728240967 CET	3778	55418	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:01.627738953 CET	3778	55418	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:01.627912045 CET	55418	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:01.627971888 CET	55418	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:01.628072977 CET	55420	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:01.750343084 CET	3778	55420	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:01.750593901 CET	55420	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:01.750714064 CET	55420	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:01.870618105 CET	3778	55420	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:01.870832920 CET	55420	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:01.990453005 CET	3778	55420	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:02.888869047 CET	3778	55420	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:02.889029980 CET	55420	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:02.889029980 CET	55420	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:02.889113903 CET	55422	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:03.008707047 CET	3778	55422	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:03.008927107 CET	55422	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:03.008927107 CET	55422	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:03.128684998 CET	3778	55422	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:03.128789902 CET	55422	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:03.248648882 CET	3778	55422	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:04.147164106 CET	3778	55422	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:04.147284985 CET	55422	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:04.147284985 CET	55422	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:04.147317886 CET	55424	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:04.266947031 CET	3778	55424	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:04.267040014 CET	55424	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:04.267071009 CET	55424	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:04.387378931 CET	3778	55424	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:04.387506008 CET	55424	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:04.507215977 CET	3778	55424	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:05.406944036 CET	3778	55424	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:05.407067060 CET	55424	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:05.407068014 CET	55424	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:05.407116890 CET	55426	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:05.526737928 CET	3778	55426	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:05.526797056 CET	55426	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:05.526823997 CET	55426	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:05.649931908 CET	3778	55426	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:05.650000095 CET	55426	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:05.769583941 CET	3778	55426	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:06.669318914 CET	3778	55426	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:06.669414043 CET	55426	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:06.669414043 CET	55426	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:06.669469118 CET	55428	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:06.789145947 CET	3778	55428	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:06.789217949 CET	55428	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:06.789263010 CET	55428	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:06.908818007 CET	3778	55428	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:06.908888102 CET	55428	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:07.028405905 CET	3778	55428	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:07.927048922 CET	3778	55428	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:07.927166939 CET	55428	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:07.927166939 CET	55428	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:07.927274942 CET	55430	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:08.047068119 CET	3778	55430	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:08.047182083 CET	55430	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:08.047231913 CET	55430	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:08.166966915 CET	3778	55430	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:08.167062998 CET	55430	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:08.286752939 CET	3778	55430	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:09.185885906 CET	3778	55430	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:09.186011076 CET	55430	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:09.186011076 CET	55430	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:09.186050892 CET	55432	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:09.305799007 CET	3778	55432	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:09.305875063 CET	55432	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:09.305912018 CET	55432	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:09.425740004 CET	3778	55432	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:09.425833941 CET	55432	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:09.545430899 CET	3778	55432	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:10.443624973 CET	3778	55432	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:10.443737030 CET	55432	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:10.443782091 CET	55432	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:10.443823099 CET	55434	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:10.563369036 CET	3778	55434	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:10.563425064 CET	55434	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:10.563443899 CET	55434	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:10.683011055 CET	3778	55434	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:10.683105946 CET	55434	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:10.802649975 CET	3778	55434	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:11.701733112 CET	3778	55434	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:11.701837063 CET	55434	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:11.701869011 CET	55434	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:11.701905012 CET	55436	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:11.821527958 CET	3778	55436	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:11.821599007 CET	55436	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:11.821650982 CET	55436	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:11.941310883 CET	3778	55436	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:11.941387892 CET	55436	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:12.061683893 CET	3778	55436	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:12.959352970 CET	3778	55436	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:12.959450960 CET	55436	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:12.959484100 CET	55436	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:12.959496021 CET	55438	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:13.079116106 CET	3778	55438	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:13.079265118 CET	55438	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:13.079305887 CET	55438	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:13.199064016 CET	3778	55438	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:13.199243069 CET	55438	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:13.318927050 CET	3778	55438	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:14.218174934 CET	3778	55438	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:14.218328953 CET	55438	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:14.218328953 CET	55438	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:14.218384027 CET	55440	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:14.338888884 CET	3778	55440	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:14.338975906 CET	55440	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:14.339021921 CET	55440	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:14.458650112 CET	3778	55440	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:14.458861113 CET	55440	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:14.578475952 CET	3778	55440	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:14.823381901 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:14.943229914 CET	3778	55328	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:15.165115118 CET	3778	55328	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:15.165339947 CET	55328	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:15.477257967 CET	3778	55440	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:15.477427959 CET	55440	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:15.477428913 CET	55440	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:15.477525949 CET	55442	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:15.597071886 CET	3778	55442	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:15.597167015 CET	55442	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:15.597213984 CET	55442	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:15.716783047 CET	3778	55442	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:15.716902018 CET	55442	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:15.836541891 CET	3778	55442	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:16.734359980 CET	3778	55442	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:16.734460115 CET	55442	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:16.734460115 CET	55442	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:16.734493017 CET	55444	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:16.854188919 CET	3778	55444	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:16.854273081 CET	55444	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:16.854288101 CET	55444	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:16.973860979 CET	3778	55444	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:16.973922968 CET	55444	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:17.093730927 CET	3778	55444	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:17.993768930 CET	3778	55444	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:17.993871927 CET	55444	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:17.993906975 CET	55444	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:17.993906975 CET	55446	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:18.113497019 CET	3778	55446	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:18.113569021 CET	55446	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:18.113588095 CET	55446	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:18.233283997 CET	3778	55446	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:18.233352900 CET	55446	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:18.352896929 CET	3778	55446	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:19.252156973 CET	3778	55446	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:19.252293110 CET	55446	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:19.252330065 CET	55446	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:19.252341986 CET	55448	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:19.371910095 CET	3778	55448	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:19.371987104 CET	55448	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:19.372037888 CET	55448	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:19.491708994 CET	3778	55448	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:19.491786957 CET	55448	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:19.611588955 CET	3778	55448	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:20.511986971 CET	3778	55448	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:20.512121916 CET	55448	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:20.512123108 CET	55448	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:20.512238979 CET	55450	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:20.631881952 CET	3778	55450	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:20.632005930 CET	55450	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:20.632066011 CET	55450	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:20.751724005 CET	3778	55450	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:20.751779079 CET	55450	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:20.871541977 CET	3778	55450	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:21.775702000 CET	3778	55450	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:21.775819063 CET	55450	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:21.775881052 CET	55450	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:21.775901079 CET	55452	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:21.895567894 CET	3778	55452	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:21.895749092 CET	55452	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:21.895770073 CET	55452	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:22.015403032 CET	3778	55452	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:22.015566111 CET	55452	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:22.135636091 CET	3778	55452	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:23.035813093 CET	3778	55452	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:23.035901070 CET	55452	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:23.036045074 CET	55452	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:23.036134005 CET	55454	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:23.155997992 CET	3778	55454	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:23.156061888 CET	55454	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:23.156225920 CET	55454	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:23.275856018 CET	3778	55454	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:23.275943995 CET	55454	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:23.395533085 CET	3778	55454	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:24.294154882 CET	3778	55454	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:24.294260025 CET	55454	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:24.294281960 CET	55454	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:24.294325113 CET	55456	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:24.413953066 CET	3778	55456	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:24.414040089 CET	55456	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:24.414086103 CET	55456	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:24.533761024 CET	3778	55456	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:24.533843040 CET	55456	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:24.653500080 CET	3778	55456	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:25.555969954 CET	3778	55456	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:25.556190968 CET	55456	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:25.556190968 CET	55456	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:25.556191921 CET	55458	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:25.675934076 CET	3778	55458	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:25.676037073 CET	55458	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:25.676038027 CET	55458	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:25.795779943 CET	3778	55458	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:25.795881987 CET	55458	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:25.915443897 CET	3778	55458	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:35.684963942 CET	55458	3778	192.168.2.23	92.118.56.167
Dec 26, 2024 08:29:35.804604053 CET	3778	55458	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:36.026731968 CET	3778	55458	92.118.56.167	192.168.2.23
Dec 26, 2024 08:29:36.026843071 CET	55458	3778	192.168.2.23	92.118.56.167

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6215, Parent PID: 6132

General

Start time (UTC):	07:27:39
Start date (UTC):	26/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
File size:	38716 bytes
MD5 hash:	cab2fc62b63f28cd95c3fdca9ecec6d0

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6216, Parent PID: 6215

General

Start time (UTC):	07:27:39
Start date (UTC):	26/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38716 bytes
MD5 hash:	cab2fc62b63f28cd95c3fdca9ecec6d0

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6217, Parent PID: 6216

General

Start time (UTC):	07:27:39
Start date (UTC):	26/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38716 bytes
MD5 hash:	cab2fc62b63f28cd95c3fdca9ecec6d0

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6218, Parent PID: 6216

General

Start time (UTC):	07:27:39
Start date (UTC):	26/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38716 bytes
MD5 hash:	cab2fc62b63f28cd95c3fdca9ecec6d0

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6221, Parent PID: 6215

General

Start time (UTC):	07:27:44
Start date (UTC):	26/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38716 bytes
MD5 hash:	cab2fc62b63f28cd95c3fdca9ecec6d0

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6222, Parent PID: 6215

General

Start time (UTC):	07:27:44
Start date (UTC):	26/12/2024
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38716 bytes
MD5 hash:	cab2fc62b63f28cd95c3fdca9ecec6d0

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6215, Parent PID: 6132

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6216, Parent PID: 6215

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6217, Parent PID: 6216

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6218, Parent PID: 6216

General

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6221, Parent PID: 6215

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6222, Parent PID: 6215

General

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.x86.elf