Edit tour

Linux Analysis Report
x86_64.elf

Overview

General Information

Sample name:	x86_64.elf
Analysis ID:	1583600
MD5:	5a70560118507a346818d0bface833a8
SHA1:	5e25e0ffe8a07e6aede280fb68048b61466f7d09
SHA256:	720f05980490b758b0051ad5ab5170f902863b9658534c3a9a099be6a9828f4a
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Sample listens on a socket

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583600
Start date and time:	2025-01-03 07:27:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86_64.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/x86_64.elf
PID:	6234
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	RebirthLTD
Standard Error:

Process Tree

system is lnxubuntu20

x86_64.elf (PID: 6234, Parent: 6151, MD5: 5a70560118507a346818d0bface833a8) Arguments: /tmp/x86_64.elf

x86_64.elf New Fork (PID: 6235, Parent: 6234)

x86_64.elf New Fork (PID: 6236, Parent: 6235)

x86_64.elf New Fork (PID: 6237, Parent: 6235)

dash New Fork (PID: 6238, Parent: 4331)

rm (PID: 6238, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8wIgBRh8v8 /tmp/tmp.XzWNnFnzNA /tmp/tmp.2NhG8Q19p9

dash New Fork (PID: 6239, Parent: 4331)

rm (PID: 6239, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8wIgBRh8v8 /tmp/tmp.XzWNnFnzNA /tmp/tmp.2NhG8Q19p9

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86_64.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
x86_64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xd208:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
x86_64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xda7f:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
x86_64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xc0b6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xc2d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
x86_64.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x15de6:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
x86_64.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x16a06:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
x86_64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xd63f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
x86_64.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x137a2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
x86_64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xd90a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
x86_64.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1399b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
x86_64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x4aa:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
x86_64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x5ad:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
x86_64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4c02:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6234.1.0000000000400000.000000000041a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xd208:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xda7f:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xc0b6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xc2d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x15de6:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x16a06:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xd63f:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x137a2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xd90a:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1399b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x4aa:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x5ad:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6234.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4c02:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 8 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86_64.elf

ReversingLabs: Detection: 23%

Machine Learning detection for sample

Source: x86_64.elf

Joe Sandbox ML: detected

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 83.222.191.90 ports 38241,1,2,3,4,8

Source: global traffic

TCP traffic: 192.168.2.23:39778 -> 83.222.191.90:38241

Source: /tmp/x86_64.elf (PID: 6234)

Socket: 127.0.0.1:39148

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6252/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6274/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6274/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6251/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6273/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6273/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6254/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6276/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6276/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6253/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6275/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6275/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6256/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6278/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6255/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6277/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6277/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6258/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6257/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6279/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6279/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6290/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6290/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6250/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6272/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6272/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6271/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6271/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6249/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6248/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6248/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6241/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6285/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6285/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6240/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6284/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6284/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6243/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6287/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6287/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6242/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6286/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6286/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6245/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6289/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6289/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6244/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6288/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6288/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6247/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6246/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6281/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6281/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6280/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6280/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6283/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6283/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6282/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6282/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6259/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6259/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6239/maps	Jump to behavior
Source: /tmp/x86_64.elf (PID: 6236)	File opened: /proc/6239/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6238)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8wIgBRh8v8 /tmp/tmp.XzWNnFnzNA /tmp/tmp.2NhG8Q19p9			Jump to behavior
Source: /usr/bin/dash (PID: 6239)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8wIgBRh8v8 /tmp/tmp.XzWNnFnzNA /tmp/tmp.2NhG8Q19p9			Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: x86_64.elf, type: SAMPLE
Source: Yara match	File source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: x86_64.elf, type: SAMPLE
Source: Yara match	File source: 6234.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86_64.elf	24%	ReversingLabs	Linux.Backdoor.Mirai
x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
83.222.191.90	unknown	Bulgaria	43561	NET1-ASBG	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	MIPS.elf	Get hash	malicious	Unknown	Browse
	MIPSEL.elf	Get hash	malicious	Unknown	Browse
	I686.elf	Get hash	malicious	Unknown	Browse
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse
	ZohoAssistURS	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Unknown	Browse
	socat.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
83.222.191.90	arm5.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	arm5.elf	Get hash	malicious	Unknown	Browse
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
	ARMV6L.elf	Get hash	malicious	Unknown	Browse
	MIPS.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	MIPSEL.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ARMV6L.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	MIPS.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
AMAZON-02US	MIPS.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	MIPSEL.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	52.217.199.81
	I686.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	157.175.218.211
	1.elf	Get hash	malicious	Unknown	Browse	52.221.18.147
	http://4.nscqn.dashboradcortx.xyz/4hbVgI3060FFjU163rczgakrldw288HJUBSXEIQRWLNTA425583MYLP8076x12	Get hash	malicious	Unknown	Browse	35.161.242.225
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://myburbank-uat.3didemo.com	Get hash	malicious	HTMLPhisher	Browse	52.40.130.243
	http://hotelyetipokhara.com	Get hash	malicious	Unknown	Browse	13.33.187.21
INIT7CH	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	ARMV6L.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	MIPS.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	MIPSEL.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
NET1-ASBG	arm5.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	mips.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	mpsl.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	ZsRFRjkt9q.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	93.123.76.18
	i686.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	sh4.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	i486.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	83.222.191.146-mips-2024-12-28T00_37_43.elf	Get hash	malicious	Gafgyt	Browse	83.222.191.146
	ppc.elf	Get hash	malicious	Unknown	Browse	83.222.191.146

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.246319649637394
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	x86_64.elf
File size:	143'000 bytes
MD5:	5a70560118507a346818d0bface833a8
SHA1:	5e25e0ffe8a07e6aede280fb68048b61466f7d09
SHA256:	720f05980490b758b0051ad5ab5170f902863b9658534c3a9a099be6a9828f4a
SHA512:	63a46fc0f10b8f7ae64751661859f6b97f71b42e416efb0f8afc3aa1320d08f5976dae198e3e289dd12a64be69192e98050bf45d6eb439372a51ae32849fcd8d
SSDEEP:	3072:2kzafeC3lRz9KObWpkGxwFjC37Gs0GRdc/Bj59lHWN:vafeC3b9KWFChRA9c
TLSH:	FFD34C07B48190FDC4D9C6B84FABF13AD972B47D1238B26E27D4AF261E49E305E1DA14
File Content Preview:	.ELF..............>.......@.....@........,..........@.8...@.......................@.......@.....`.......`.................................Q.......Q.............@...............Q.td....................................................H...._.....w..H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	142360
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x177e6	0x0	0x6	AX	16
.fini	PROGBITS	0x4178e6	0x178e6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x417900	0x17900	0x2660	0x0	0x2	A	32
.ctors	PROGBITS	0x51a000	0x1a000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x51a018	0x1a018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x51a040	0x1a040	0x8b98	0x0	0x3	WA	32
.bss	NOBITS	0x522be0	0x22bd8	0x6f60	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x22bd8	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x19f60	0x19f60	6.3801	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x1a000	0x51a000	0x51a000	0x8bd8	0xfb40	0.1165	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 07:27:45.576297998 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:45.581217051 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:45.581257105 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:45.581950903 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:45.586703062 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:45.586741924 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:45.591584921 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:46.244981050 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:46.245033026 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:46.245060921 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:47.179821014 CET	443	33606	54.171.230.55	192.168.2.23
Jan 3, 2025 07:27:47.179939032 CET	33606	443	192.168.2.23	54.171.230.55
Jan 3, 2025 07:27:47.185718060 CET	443	33606	54.171.230.55	192.168.2.23
Jan 3, 2025 07:27:47.245816946 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:47.250616074 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:47.250672102 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:47.251245975 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:47.256023884 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:47.256067038 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:47.260811090 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:47.936163902 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:47.936212063 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:47.936234951 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:48.334774971 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 07:27:48.937182903 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:48.942056894 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:48.942111969 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:48.942826986 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:48.947611094 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:48.947663069 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:48.953506947 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:49.601896048 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:49.601943016 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:49.602071047 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:50.603346109 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:50.608277082 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:50.608342886 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:50.609415054 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:50.614157915 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:50.614224911 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:50.619046926 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:51.290137053 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:51.290241957 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:51.290241957 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:52.291224957 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:52.296061993 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:52.296129942 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:52.296690941 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:52.301470995 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:52.301518917 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:52.306346893 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:52.971724033 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:52.971776009 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:52.972008944 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:53.710032940 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 07:27:53.972882986 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:53.977786064 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:53.977838993 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:53.978641033 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:53.983390093 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:53.983434916 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:53.988167048 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:54.651731968 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:54.651791096 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:54.651791096 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:55.245954990 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 07:27:55.652966976 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:55.657870054 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:55.657932997 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:55.658571005 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:55.663427114 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:55.663471937 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:55.668332100 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:56.338191032 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:56.338258028 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:56.338526011 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:57.339375019 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:57.344306946 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:57.344368935 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:57.344974995 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:57.349714041 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:57.349776030 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:57.354595900 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:58.007378101 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:58.007421970 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:58.007436991 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:59.008162975 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:59.013031960 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:59.013083935 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:59.013639927 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:59.018448114 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:59.018501997 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:59.023263931 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:59.672635078 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 07:27:59.672683001 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:27:59.672697067 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:00.673672915 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:00.679970980 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:00.680028915 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:00.680635929 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:00.687371016 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:00.687414885 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:00.693593979 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:01.355765104 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:01.355820894 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:01.355850935 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:02.356792927 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:02.361646891 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:02.361702919 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:02.362252951 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:02.367059946 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:02.367114067 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:02.371967077 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:03.057632923 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:03.057823896 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:03.057823896 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:04.058664083 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:04.063563108 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:04.063613892 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:04.064202070 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:04.068932056 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:04.068969965 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:04.073779106 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:04.735713959 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:04.735755920 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:04.735776901 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:05.736649036 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:05.741481066 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:05.741530895 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:05.742130041 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:05.746937990 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:05.747004032 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:05.751714945 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:06.417038918 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:06.417083979 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:06.417102098 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:07.417987108 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:07.422885895 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:07.422938108 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:07.423551083 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:07.428292036 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:07.428350925 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:07.433156013 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:08.102154016 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:08.102200031 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:08.102222919 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:09.103920937 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:09.108745098 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:09.108807087 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:09.110218048 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:09.115032911 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:09.115075111 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:09.119868040 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:09.323900938 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 07:28:09.795711994 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:09.795764923 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:09.795766115 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:10.797076941 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:10.802067995 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:10.802118063 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:10.802809954 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:10.807601929 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:10.807637930 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:10.812556982 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:11.480951071 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:11.481108904 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:11.481173992 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:12.482336998 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:12.511833906 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:12.511915922 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:12.512717962 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:12.517529011 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:12.517590046 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:12.522357941 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:13.190092087 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:13.190289974 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:13.190315962 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:14.191523075 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:14.196436882 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:14.196490049 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:14.197057962 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:14.201864958 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:14.201908112 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:14.206650019 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:14.884417057 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:14.884635925 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:14.884680986 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:15.885631084 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:15.890461922 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:15.890512943 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:15.891103029 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:15.895994902 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:15.896054983 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:15.900794029 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:16.560905933 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:16.560966969 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:16.560993910 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:17.561887026 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:17.566963911 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:17.567023039 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:17.567583084 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:17.572406054 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:17.572448015 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:17.577219009 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:18.227889061 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:18.227938890 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:18.227967024 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:19.228912115 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:19.233751059 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:19.233798981 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:19.234505892 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:19.239330053 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:19.239368916 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:19.244142056 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:19.562506914 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 07:28:19.908751965 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:19.908797026 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:19.908988953 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:20.909894943 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:20.914813995 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:20.914863110 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:20.915469885 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:20.920243979 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:20.920284033 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:20.925060034 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:21.584538937 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:21.584732056 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:21.584789038 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:22.586601019 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:22.591521025 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:22.591603994 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:22.592974901 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:22.597785950 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:22.597845078 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:22.602684975 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:23.271174908 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:23.271388054 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:23.271471024 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:24.273401022 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:24.278299093 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:24.278388023 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:24.279409885 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:24.284131050 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:24.284194946 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:24.288922071 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:24.962078094 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:24.962340117 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:24.962373972 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:25.705696106 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 07:28:25.963804960 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:25.968626022 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:25.968712091 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:25.969710112 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:25.974554062 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:25.974615097 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:25.979428053 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:26.647707939 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:26.647814989 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:26.647898912 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:27.649449110 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:27.654369116 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:27.654452085 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:27.655237913 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:27.659993887 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:27.660053968 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:27.664885998 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:28.334534883 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:28.334594011 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:28.334620953 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:29.335819006 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:29.340715885 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:29.340791941 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:29.341754913 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:29.346487999 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:29.346544027 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:29.351303101 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:30.001909018 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:30.002017021 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:30.002084017 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:31.003458977 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:31.008285999 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:31.008359909 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:31.009219885 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:31.014060974 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:31.014121056 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:31.018944979 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:31.676840067 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:31.677154064 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:31.677243948 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:32.678574085 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:32.683465004 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:32.683536053 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:32.684420109 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:32.689213037 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:32.689270973 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:32.694238901 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:33.343229055 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:33.343365908 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:33.343444109 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:34.344950914 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:34.349842072 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:34.349912882 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:34.350694895 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:34.355520010 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:34.355621099 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:34.360450029 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:35.049940109 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:35.050064087 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:35.050103903 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:36.051345110 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:36.056209087 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:36.056291103 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:36.057087898 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:36.061851978 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:36.061944962 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:36.066684961 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:36.751012087 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:36.751090050 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:36.751121998 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:37.752372026 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:37.757199049 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:37.757299900 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:37.758161068 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:37.762974024 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:37.763081074 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:37.767827034 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:38.451195955 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:38.451337099 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:38.451411009 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:39.453174114 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:39.458081007 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:39.458158970 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:39.459225893 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:39.464010000 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:39.464070082 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:39.468910933 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:40.141972065 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:40.142045975 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:40.142077923 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:41.143779039 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:41.148663998 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:41.148739100 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:41.149660110 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:41.154402018 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:41.154460907 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:41.159219980 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:41.838125944 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:41.838216066 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:41.838268042 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:42.840003014 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:42.844846010 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:42.844924927 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:42.845895052 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:42.850647926 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:42.850703955 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:42.855416059 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:43.532732964 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:43.532830000 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:43.532880068 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:44.534677982 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:44.540491104 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:44.540566921 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:44.541631937 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:44.546382904 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:44.546442032 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:44.551178932 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:45.248517990 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:45.248596907 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:45.248661041 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:46.250483036 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:46.255472898 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:46.255547047 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:46.256441116 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:46.263848066 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:46.263906956 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:46.268652916 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:46.919260979 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:46.919469118 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:46.919522047 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:47.921452045 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:47.926310062 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:47.926384926 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:47.927371025 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:47.932168961 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:47.932223082 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:47.937072039 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:48.589509010 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:48.589574099 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:48.589629889 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:49.591444969 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:49.596323013 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:49.596375942 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:49.597222090 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:49.601974964 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:49.602021933 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:49.606801987 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:50.274542093 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:50.274760962 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:50.274821997 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:50.278328896 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 07:28:51.276506901 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:51.281382084 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:51.281466007 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:51.282497883 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:51.287237883 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:51.287296057 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:51.292115927 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:51.955867052 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:51.955945015 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:51.955991030 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:52.957551003 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:52.962379932 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:52.962461948 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:52.963509083 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:52.968313932 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:52.968379021 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:52.973205090 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:53.653558016 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:53.653637886 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:53.653700113 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:54.655114889 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:54.660092115 CET	38241	39860	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:54.660177946 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:54.661165953 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:54.665982962 CET	38241	39860	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:54.666038036 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:54.670938969 CET	38241	39860	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:55.329035997 CET	38241	39860	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:55.329092979 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:55.329123020 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:56.330204010 CET	39862	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:56.335072994 CET	38241	39862	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:56.335185051 CET	39862	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:56.335973024 CET	39862	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:56.340749025 CET	38241	39862	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:56.340811014 CET	39862	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:56.345627069 CET	38241	39862	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:57.013941050 CET	38241	39862	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:57.013993025 CET	39862	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:57.014029980 CET	39862	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:58.015256882 CET	39864	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:58.020242929 CET	38241	39864	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:58.020314932 CET	39864	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:58.021210909 CET	39864	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:58.026052952 CET	38241	39864	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:58.026145935 CET	39864	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:58.030877113 CET	38241	39864	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:58.679866076 CET	38241	39864	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:58.679965973 CET	39864	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:58.680033922 CET	39864	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:59.681930065 CET	39866	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:59.686856031 CET	38241	39866	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:59.686923981 CET	39866	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:59.687922001 CET	39866	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:59.692662001 CET	38241	39866	83.222.191.90	192.168.2.23
Jan 3, 2025 07:28:59.692756891 CET	39866	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:28:59.697559118 CET	38241	39866	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:00.356199026 CET	38241	39866	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:00.356443882 CET	39866	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:00.356529951 CET	39866	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:01.358202934 CET	39868	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:01.363085032 CET	38241	39868	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:01.363159895 CET	39868	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:01.364079952 CET	39868	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:01.368864059 CET	38241	39868	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:01.368958950 CET	39868	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:01.373807907 CET	38241	39868	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:02.041641951 CET	38241	39868	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:02.041780949 CET	39868	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:02.041860104 CET	39868	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:03.043787003 CET	39870	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:03.048649073 CET	38241	39870	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:03.048721075 CET	39870	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:03.049922943 CET	39870	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:03.054691076 CET	38241	39870	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:03.054749966 CET	39870	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:03.059541941 CET	38241	39870	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:03.708332062 CET	38241	39870	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:03.708389997 CET	39870	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:03.708422899 CET	39870	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:04.709551096 CET	39872	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:04.715818882 CET	38241	39872	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:04.715909004 CET	39872	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:04.716865063 CET	39872	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:04.722780943 CET	38241	39872	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:04.722841024 CET	39872	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:04.728399992 CET	38241	39872	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:05.375499964 CET	38241	39872	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:05.375601053 CET	39872	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:05.375601053 CET	39872	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:06.377007961 CET	39874	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:06.381910086 CET	38241	39874	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:06.382000923 CET	39874	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:06.382961035 CET	39874	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:06.387757063 CET	38241	39874	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:06.387815952 CET	39874	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:06.392637968 CET	38241	39874	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:07.043903112 CET	38241	39874	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:07.043983936 CET	39874	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:07.043999910 CET	39874	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:08.045438051 CET	39876	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:08.050340891 CET	38241	39876	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:08.050404072 CET	39876	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:08.051350117 CET	39876	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:08.056092978 CET	38241	39876	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:08.056147099 CET	39876	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:08.060899973 CET	38241	39876	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:08.707509995 CET	38241	39876	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:08.707591057 CET	39876	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:08.707834959 CET	39876	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:09.709762096 CET	39878	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:09.714554071 CET	38241	39878	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:09.714641094 CET	39878	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:09.715893984 CET	39878	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:09.720624924 CET	38241	39878	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:09.720685959 CET	39878	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:09.726183891 CET	38241	39878	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:10.393587112 CET	38241	39878	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:10.393645048 CET	39878	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:10.393742085 CET	39878	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:10.755588055 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 07:29:11.395737886 CET	39880	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:11.400563002 CET	38241	39880	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:11.400652885 CET	39880	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:11.401515961 CET	39880	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:11.406256914 CET	38241	39880	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:11.406318903 CET	39880	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:11.411043882 CET	38241	39880	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:12.082264900 CET	38241	39880	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:12.082526922 CET	39880	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:12.082547903 CET	39880	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:13.084377050 CET	39882	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:13.089251995 CET	38241	39882	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:13.089343071 CET	39882	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:13.090423107 CET	39882	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:13.095243931 CET	38241	39882	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:13.095352888 CET	39882	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:13.100176096 CET	38241	39882	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:13.823220968 CET	38241	39882	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:13.823487043 CET	39882	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:13.823594093 CET	39882	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:14.825320005 CET	39884	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:14.830236912 CET	38241	39884	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:14.830302000 CET	39884	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:14.830899954 CET	39884	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:14.835669994 CET	38241	39884	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:14.835720062 CET	39884	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:14.840575933 CET	38241	39884	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:15.489986897 CET	38241	39884	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:15.490149021 CET	39884	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:15.490149021 CET	39884	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:16.491446972 CET	39886	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:16.496311903 CET	38241	39886	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:16.496401072 CET	39886	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:16.497335911 CET	39886	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:16.502100945 CET	38241	39886	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:16.502166986 CET	39886	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:16.506951094 CET	38241	39886	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:17.183655977 CET	38241	39886	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:17.183743954 CET	39886	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:17.183773041 CET	39886	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:18.185261011 CET	39888	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:18.190124989 CET	38241	39888	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:18.190203905 CET	39888	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:18.191153049 CET	39888	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:18.196501017 CET	38241	39888	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:18.196542025 CET	39888	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:18.201420069 CET	38241	39888	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:18.859982967 CET	38241	39888	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:18.860044956 CET	39888	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:18.860044956 CET	39888	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:19.861494064 CET	39890	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:19.866342068 CET	38241	39890	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:19.866400003 CET	39890	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:19.867348909 CET	39890	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:19.872133017 CET	38241	39890	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:19.872176886 CET	39890	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:19.876975060 CET	38241	39890	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:20.545672894 CET	38241	39890	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:20.545723915 CET	39890	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:20.545751095 CET	39890	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:21.547147989 CET	39892	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:21.551966906 CET	38241	39892	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:21.552016020 CET	39892	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:21.552927971 CET	39892	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:21.557686090 CET	38241	39892	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:21.557728052 CET	39892	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:21.562555075 CET	38241	39892	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:22.232517958 CET	38241	39892	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:22.232563019 CET	39892	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:22.232597113 CET	39892	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:23.234455109 CET	39894	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:23.239351988 CET	38241	39894	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:23.239423037 CET	39894	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:23.240680933 CET	39894	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:23.245495081 CET	38241	39894	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:23.245548964 CET	39894	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:23.250400066 CET	38241	39894	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:23.914081097 CET	38241	39894	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:23.914305925 CET	39894	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:23.914371014 CET	39894	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:24.916009903 CET	39896	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:24.920845985 CET	38241	39896	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:24.920900106 CET	39896	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:24.921875954 CET	39896	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:24.926666975 CET	38241	39896	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:24.926718950 CET	39896	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:24.931576014 CET	38241	39896	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:25.598886967 CET	38241	39896	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:25.598988056 CET	39896	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:25.599061012 CET	39896	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:26.600951910 CET	39898	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:26.610387087 CET	38241	39898	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:26.610464096 CET	39898	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:26.611722946 CET	39898	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:26.616511106 CET	38241	39898	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:26.616569996 CET	39898	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:26.621284962 CET	38241	39898	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:27.276181936 CET	38241	39898	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:27.276390076 CET	39898	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:27.276448011 CET	39898	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:28.278367996 CET	39900	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:28.283222914 CET	38241	39900	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:28.283282042 CET	39900	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:28.284272909 CET	39900	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:28.289030075 CET	38241	39900	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:28.289073944 CET	39900	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:28.293868065 CET	38241	39900	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:28.943339109 CET	38241	39900	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:28.943399906 CET	39900	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:28.943432093 CET	39900	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:29.945152998 CET	39902	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:29.951539040 CET	38241	39902	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:29.951651096 CET	39902	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:29.952913046 CET	39902	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:29.959249973 CET	38241	39902	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:29.959306002 CET	39902	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:29.965634108 CET	38241	39902	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:30.631628036 CET	38241	39902	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:30.631803989 CET	39902	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:30.631844044 CET	39902	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:31.633394003 CET	39904	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:31.638573885 CET	38241	39904	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:31.638674974 CET	39904	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:31.639998913 CET	39904	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:31.644834042 CET	38241	39904	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:31.644898891 CET	39904	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:31.649743080 CET	38241	39904	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:32.303112030 CET	38241	39904	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:32.303234100 CET	39904	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:32.303390980 CET	39904	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:33.304886103 CET	39906	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:33.309899092 CET	38241	39906	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:33.309977055 CET	39906	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:33.310956955 CET	39906	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:33.315723896 CET	38241	39906	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:33.315824032 CET	39906	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:33.321290016 CET	38241	39906	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:33.978509903 CET	38241	39906	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:33.978724957 CET	39906	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:33.978832960 CET	39906	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:34.980077028 CET	39908	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:34.985053062 CET	38241	39908	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:34.985100031 CET	39908	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:34.985805988 CET	39908	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:34.991396904 CET	38241	39908	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:34.991437912 CET	39908	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:34.996711969 CET	38241	39908	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:35.669379950 CET	38241	39908	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:35.669511080 CET	39908	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:35.669552088 CET	39908	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:36.670732975 CET	39910	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:36.675868988 CET	38241	39910	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:36.675920963 CET	39910	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:36.676655054 CET	39910	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:36.681564093 CET	38241	39910	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:36.681622982 CET	39910	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:36.686701059 CET	38241	39910	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:37.344211102 CET	38241	39910	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:37.344501019 CET	39910	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:37.344706059 CET	39910	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:38.346637964 CET	39912	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:38.351572990 CET	38241	39912	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:38.351623058 CET	39912	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:38.352253914 CET	39912	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:38.356961012 CET	38241	39912	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:38.357022047 CET	39912	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:38.361818075 CET	38241	39912	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:39.035640955 CET	38241	39912	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:39.035717964 CET	39912	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:39.035754919 CET	39912	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:40.037199020 CET	39914	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:40.042349100 CET	38241	39914	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:40.042443991 CET	39914	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:40.043554068 CET	39914	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:40.048314095 CET	38241	39914	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:40.048401117 CET	39914	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:40.053196907 CET	38241	39914	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:40.737093925 CET	38241	39914	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:40.737313986 CET	39914	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:40.737395048 CET	39914	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:41.738817930 CET	39916	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:41.743746042 CET	38241	39916	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:41.743824959 CET	39916	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:41.744983912 CET	39916	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:41.749795914 CET	38241	39916	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:41.749857903 CET	39916	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:41.754663944 CET	38241	39916	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:42.403490067 CET	38241	39916	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:42.403613091 CET	39916	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:42.403772116 CET	39916	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:43.405469894 CET	39918	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:43.410442114 CET	38241	39918	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:43.410516977 CET	39918	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:43.411560059 CET	39918	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:43.416341066 CET	38241	39918	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:43.416413069 CET	39918	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:43.421153069 CET	38241	39918	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:44.069869041 CET	38241	39918	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:44.069936037 CET	39918	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:44.069967031 CET	39918	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:45.071538925 CET	39920	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:45.076406002 CET	38241	39920	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:45.076493025 CET	39920	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:45.077173948 CET	39920	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:45.081938982 CET	38241	39920	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:45.082012892 CET	39920	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:45.086864948 CET	38241	39920	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:45.736994028 CET	38241	39920	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:45.737123013 CET	39920	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:45.737149954 CET	39920	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:46.739053965 CET	39922	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:46.743942976 CET	38241	39922	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:46.744007111 CET	39922	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:46.745117903 CET	39922	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:46.749931097 CET	38241	39922	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:46.750022888 CET	39922	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:46.754805088 CET	38241	39922	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:47.407571077 CET	38241	39922	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:47.407648087 CET	39922	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:47.407839060 CET	39922	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:48.409662962 CET	39924	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:48.414571047 CET	38241	39924	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:48.414678097 CET	39924	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:48.415777922 CET	39924	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:48.420581102 CET	38241	39924	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:48.420701027 CET	39924	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:48.426496029 CET	38241	39924	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:49.093255043 CET	38241	39924	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:49.093602896 CET	39924	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:49.093648911 CET	39924	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:50.095323086 CET	39926	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:50.100198984 CET	38241	39926	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:50.100286961 CET	39926	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:50.101387978 CET	39926	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:50.106241941 CET	38241	39926	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:50.106421947 CET	39926	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:50.111263990 CET	38241	39926	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:50.759740114 CET	38241	39926	83.222.191.90	192.168.2.23
Jan 3, 2025 07:29:50.759865046 CET	39926	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 07:29:50.759891987 CET	39926	38241	192.168.2.23	83.222.191.90

System Behavior

Analysis Process: x86_64.elf PID: 6234, Parent PID: 6151

General

Start time (UTC):	06:27:44
Start date (UTC):	03/01/2025
Path:	/tmp/x86_64.elf
Arguments:	/tmp/x86_64.elf
File size:	143000 bytes
MD5 hash:	5a70560118507a346818d0bface833a8

Chronological Activities

Analysis Process: x86_64.elf PID: 6235, Parent PID: 6234

General

Start time (UTC):	06:27:44
Start date (UTC):	03/01/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	143000 bytes
MD5 hash:	5a70560118507a346818d0bface833a8

Chronological Activities

Analysis Process: x86_64.elf PID: 6236, Parent PID: 6235

General

Start time (UTC):	06:27:44
Start date (UTC):	03/01/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	143000 bytes
MD5 hash:	5a70560118507a346818d0bface833a8

Chronological Activities

Analysis Process: x86_64.elf PID: 6237, Parent PID: 6235

General

Start time (UTC):	06:27:44
Start date (UTC):	03/01/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	143000 bytes
MD5 hash:	5a70560118507a346818d0bface833a8

Chronological Activities

Analysis Process: dash PID: 6238, Parent PID: 4331

General

Start time (UTC):	06:27:46
Start date (UTC):	03/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6238, Parent PID: 4331

General

Start time (UTC):	06:27:46
Start date (UTC):	03/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.8wIgBRh8v8 /tmp/tmp.XzWNnFnzNA /tmp/tmp.2NhG8Q19p9
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6239, Parent PID: 4331

General

Start time (UTC):	06:27:46
Start date (UTC):	03/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6239, Parent PID: 4331

General

Start time (UTC):	06:27:46
Start date (UTC):	03/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.8wIgBRh8v8 /tmp/tmp.XzWNnFnzNA /tmp/tmp.2NhG8Q19p9
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: x86_64.elf PID: 6234, Parent PID: 6151

General

Chronological Activities

Analysis Process: x86_64.elf PID: 6235, Parent PID: 6234

General

Chronological Activities

Analysis Process: x86_64.elf PID: 6236, Parent PID: 6235

General

Chronological Activities

Analysis Process: x86_64.elf PID: 6237, Parent PID: 6235

General

Chronological Activities

Analysis Process: dash PID: 6238, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6238, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6239, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6239, Parent PID: 4331

General

Linux Analysis Report
x86_64.elf