Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:	x86.elf
Analysis ID:	1583634
MD5:	c641ba9f0ac6a0489667a4c699188e25
SHA1:	09a7c046e08c4d8dd61677bf12a447a6f3db92fa
SHA256:	4cdd1b90d5020d7ae46a89a450f9226f164bf9d7947e87e14e879db3b4bd8bd8
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583634
Start date and time:	2025-01-03 08:13:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/x86.elf
PID:	5456
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	RebirthLTD
Standard Error:

Process Tree

system is lnxubuntu20

x86.elf (PID: 5456, Parent: 5377, MD5: c641ba9f0ac6a0489667a4c699188e25) Arguments: /tmp/x86.elf

x86.elf New Fork (PID: 5457, Parent: 5456)

x86.elf New Fork (PID: 5458, Parent: 5457)

x86.elf New Fork (PID: 5459, Parent: 5457)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4730:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
x86.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x95a8:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x69f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9998:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x69c2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5456.1.0000000008048000.0000000008059000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5456.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4730:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5456.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x95a8:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5456.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x69f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5456.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9998:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5456.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x69c2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86.elf

ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: x86.elf

Joe Sandbox ML: detected

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 83.222.191.90 ports 38241,1,2,3,4,8

Source: global traffic

TCP traffic: 192.168.2.13:35534 -> 83.222.191.90:38241

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5481/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5481/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5482/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5482/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5483/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5483/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5497/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5497/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5520/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5520/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5477/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5477/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5532/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5532/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5480/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5480/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5480/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5480/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5478/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5478/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5478/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5478/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5479/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5479/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5479/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5458)	File opened: /proc/5479/cmdline	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: x86.elf, type: SAMPLE
Source: Yara match	File source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: x86.elf, type: SAMPLE
Source: Yara match	File source: 5456.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86.elf	39%	ReversingLabs	Linux.Backdoor.Mirai
x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
83.222.191.90	unknown	Bulgaria		43561	NET1-ASBG	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
83.222.191.90	arm7.elf	Get hash	malicious	Mirai	Browse
	x86_64.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
185.125.190.26	armv6l.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	wind.sh4.elf	Get hash	malicious	Mirai	Browse
	wind.arc.elf	Get hash	malicious	Mirai	Browse
	DEMONS.arm5.elf	Get hash	malicious	Unknown	Browse
	DEMONS.arm7.elf	Get hash	malicious	Mirai	Browse
	powerpc.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	armv6l.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	powerpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
NET1-ASBG	arm7.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	x86_64.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	arm5.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	mips.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	mpsl.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	ZsRFRjkt9q.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	93.123.76.18
	i686.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	sh4.elf	Get hash	malicious	Unknown	Browse	83.222.191.146
	i486.elf	Get hash	malicious	Unknown	Browse	83.222.191.146

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.673008485981137
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86.elf
File size:	88'008 bytes
MD5:	c641ba9f0ac6a0489667a4c699188e25
SHA1:	09a7c046e08c4d8dd61677bf12a447a6f3db92fa
SHA256:	4cdd1b90d5020d7ae46a89a450f9226f164bf9d7947e87e14e879db3b4bd8bd8
SHA512:	55d7994e657d91acfb750c0e483f957a8c5cc0ce997e337298d7038eaa4eeb6ad1af2fe7a0b2dd3d6b73da790d73c02ad874fdfb1f47c4e90364e98a379e8543
SSDEEP:	1536:AQSNEI5YrmpMwpPDFUfCn5JSpPBeKDMGmrS/R17SOg:AQOh5YrsMCyfCnrSWKYVm/R1dg
TLSH:	AF836CC4E943E4F2E85319715933E7374B32E579102AEB43D359EB32AC92A11D61B39C
File Content Preview:	.ELF....................d...4...8V......4. ...(.....................\|...\|............................E..............Q.td............................U..S.......{....h........[]...$.............U......=.....t..5....D......D.......u........t....h\|...........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	87608
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xf516	0x0	0x6	AX	16
.fini	PROGBITS	0x80575c6	0xf5c6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80575e0	0xf5e0	0x199c	0x0	0x2	A	32
.ctors	PROGBITS	0x8059000	0x11000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805900c	0x1100c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8059040	0x11040	0x45b8	0x0	0x3	WA	32
.bss	NOBITS	0x805d600	0x155f8	0x488c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x155f8	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x10f7c	0x10f7c	6.5725	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11000	0x8059000	0x8059000	0x45f8	0x8e8c	0.1385	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 08:14:20.598557949 CET	35534	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:20.603816986 CET	38241	35534	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:20.603892088 CET	35534	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:20.603925943 CET	35534	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:20.608779907 CET	38241	35534	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:20.608830929 CET	35534	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:20.613733053 CET	38241	35534	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:21.272641897 CET	38241	35534	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:21.272763968 CET	35534	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:21.272824049 CET	35534	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:22.274399042 CET	35536	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:22.279294014 CET	38241	35536	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:22.279419899 CET	35536	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:22.279447079 CET	35536	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:22.284204960 CET	38241	35536	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:22.284245014 CET	35536	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:22.288966894 CET	38241	35536	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:22.948788881 CET	38241	35536	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:22.948853016 CET	35536	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:22.948879957 CET	35536	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:23.950037956 CET	35538	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:23.955024958 CET	38241	35538	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:23.955085039 CET	35538	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:23.955113888 CET	35538	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:23.959920883 CET	38241	35538	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:23.959990025 CET	35538	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:23.964808941 CET	38241	35538	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:24.617706060 CET	38241	35538	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:24.617789984 CET	35538	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:24.617837906 CET	35538	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:25.618926048 CET	35540	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:25.623950005 CET	38241	35540	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:25.624033928 CET	35540	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:25.624144077 CET	35540	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:25.628983021 CET	38241	35540	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:25.629069090 CET	35540	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:25.633981943 CET	38241	35540	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:26.298975945 CET	38241	35540	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:26.299133062 CET	35540	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:26.299218893 CET	35540	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:27.300476074 CET	35542	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:27.305602074 CET	38241	35542	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:27.305675030 CET	35542	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:27.305725098 CET	35542	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:27.310744047 CET	38241	35542	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:27.310801029 CET	35542	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:27.315938950 CET	38241	35542	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:27.984462976 CET	38241	35542	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:27.984611988 CET	35542	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:27.984611988 CET	35542	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:28.985513926 CET	35544	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:28.990650892 CET	38241	35544	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:28.990731001 CET	35544	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:28.990758896 CET	35544	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:28.995560884 CET	38241	35544	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:28.995605946 CET	35544	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:29.000428915 CET	38241	35544	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:29.669656038 CET	38241	35544	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:29.669725895 CET	35544	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:29.669743061 CET	35544	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:30.670445919 CET	35546	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:30.675415993 CET	38241	35546	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:30.675482988 CET	35546	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:30.675514936 CET	35546	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:30.680309057 CET	38241	35546	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:30.680357933 CET	35546	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:30.685224056 CET	38241	35546	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:31.363414049 CET	38241	35546	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:31.363473892 CET	35546	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:31.363526106 CET	35546	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:31.624172926 CET	48202	443	192.168.2.13	185.125.190.26
Jan 3, 2025 08:14:32.364197016 CET	35548	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:32.368995905 CET	38241	35548	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:32.369049072 CET	35548	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:32.369076014 CET	35548	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:32.373827934 CET	38241	35548	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:32.373868942 CET	35548	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:32.378695965 CET	38241	35548	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:33.043697119 CET	38241	35548	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:33.043775082 CET	35548	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:33.043797970 CET	35548	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:34.044631958 CET	35550	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:34.049532890 CET	38241	35550	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:34.049613953 CET	35550	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:34.049634933 CET	35550	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:34.054421902 CET	38241	35550	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:34.054502964 CET	35550	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:34.059250116 CET	38241	35550	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:34.761548042 CET	38241	35550	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:34.761641026 CET	35550	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:34.761809111 CET	35550	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:35.762449026 CET	35552	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:35.767364979 CET	38241	35552	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:35.767441034 CET	35552	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:35.767462969 CET	35552	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:35.772269011 CET	38241	35552	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:35.772310019 CET	35552	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:35.777132034 CET	38241	35552	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:36.450845957 CET	38241	35552	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:36.451005936 CET	35552	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:36.451005936 CET	35552	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:37.451782942 CET	35554	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:37.457429886 CET	38241	35554	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:37.457493067 CET	35554	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:37.457530022 CET	35554	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:37.463325024 CET	38241	35554	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:37.463387966 CET	35554	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:37.469722986 CET	38241	35554	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:38.136651039 CET	38241	35554	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:38.136718988 CET	35554	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:38.136743069 CET	35554	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:39.137475967 CET	35556	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:39.142571926 CET	38241	35556	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:39.142704010 CET	35556	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:39.142751932 CET	35556	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:39.147587061 CET	38241	35556	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:39.147659063 CET	35556	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:39.152486086 CET	38241	35556	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:39.802561045 CET	38241	35556	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:39.802762032 CET	35556	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:39.802813053 CET	35556	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:40.804055929 CET	35558	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:40.809083939 CET	38241	35558	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:40.809137106 CET	35558	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:40.809175968 CET	35558	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:40.813982010 CET	38241	35558	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:40.814033031 CET	35558	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:40.818918943 CET	38241	35558	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:41.489151001 CET	38241	35558	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:41.489324093 CET	35558	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:41.489376068 CET	35558	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:42.490168095 CET	35560	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:42.495400906 CET	38241	35560	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:42.495457888 CET	35560	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:42.495493889 CET	35560	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:42.500297070 CET	38241	35560	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:42.500346899 CET	35560	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:42.505287886 CET	38241	35560	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:43.173706055 CET	38241	35560	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:43.173758030 CET	35560	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:43.173805952 CET	35560	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:44.174772024 CET	35562	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:44.179800034 CET	38241	35562	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:44.179871082 CET	35562	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:44.179908991 CET	35562	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:44.184658051 CET	38241	35562	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:44.184708118 CET	35562	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:44.189538956 CET	38241	35562	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:44.838741064 CET	38241	35562	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:44.838972092 CET	35562	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:44.839008093 CET	35562	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:45.840482950 CET	35564	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:45.845544100 CET	38241	35564	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:45.845613003 CET	35564	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:45.845654011 CET	35564	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:45.850493908 CET	38241	35564	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:45.850545883 CET	35564	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:45.855441093 CET	38241	35564	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:46.515228987 CET	38241	35564	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:46.515301943 CET	35564	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:46.515342951 CET	35564	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:47.516547918 CET	35566	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:47.521578074 CET	38241	35566	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:47.521663904 CET	35566	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:47.521707058 CET	35566	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:47.526478052 CET	38241	35566	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:47.526530027 CET	35566	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:47.531385899 CET	38241	35566	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:48.186501026 CET	38241	35566	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:48.186619997 CET	35566	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:48.186676979 CET	35566	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:49.188093901 CET	35568	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:49.193221092 CET	38241	35568	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:49.193346024 CET	35568	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:49.193408966 CET	35568	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:49.198256969 CET	38241	35568	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:49.198357105 CET	35568	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:49.203207970 CET	38241	35568	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:49.880893946 CET	38241	35568	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:49.881127119 CET	35568	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:49.881127119 CET	35568	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:50.882302999 CET	35570	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:50.887320042 CET	38241	35570	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:50.887377024 CET	35570	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:50.887413979 CET	35570	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:50.892225027 CET	38241	35570	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:50.892262936 CET	35570	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:50.897049904 CET	38241	35570	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:51.567970991 CET	38241	35570	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:51.568043947 CET	35570	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:51.568089962 CET	35570	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:52.569037914 CET	35572	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:52.573915005 CET	38241	35572	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:52.574168921 CET	35572	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:52.574188948 CET	35572	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:52.578953028 CET	38241	35572	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:52.579026937 CET	35572	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:52.583903074 CET	38241	35572	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:53.233767986 CET	38241	35572	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:53.233872890 CET	35572	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:53.234071970 CET	35572	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:54.235310078 CET	35574	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:54.240320921 CET	38241	35574	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:54.240398884 CET	35574	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:54.240434885 CET	35574	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:54.245254040 CET	38241	35574	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:54.245315075 CET	35574	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:54.250124931 CET	38241	35574	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:54.900310993 CET	38241	35574	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:54.900387049 CET	35574	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:54.900584936 CET	35574	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:55.901803970 CET	35576	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:55.906780005 CET	38241	35576	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:55.906831026 CET	35576	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:55.906864882 CET	35576	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:55.911659002 CET	38241	35576	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:55.911693096 CET	35576	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:55.916532040 CET	38241	35576	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:56.566196918 CET	38241	35576	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:56.566304922 CET	35576	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:56.566426039 CET	35576	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:57.567369938 CET	35578	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:57.572345018 CET	38241	35578	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:57.572447062 CET	35578	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:57.572465897 CET	35578	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:57.577318907 CET	38241	35578	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:57.577385902 CET	35578	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:57.582124949 CET	38241	35578	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:58.345900059 CET	38241	35578	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:58.346010923 CET	35578	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:58.346127033 CET	35578	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:59.347011089 CET	35580	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:59.351835966 CET	38241	35580	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:59.351886988 CET	35580	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:59.351921082 CET	35580	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:59.356750965 CET	38241	35580	83.222.191.90	192.168.2.13
Jan 3, 2025 08:14:59.356791973 CET	35580	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:14:59.361623049 CET	38241	35580	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:00.013766050 CET	38241	35580	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:00.013824940 CET	35580	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:00.013824940 CET	35580	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:01.014792919 CET	35582	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:01.019653082 CET	38241	35582	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:01.019721985 CET	35582	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:01.019746065 CET	35582	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:01.024605989 CET	38241	35582	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:01.024703979 CET	35582	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:01.029510975 CET	38241	35582	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:01.698710918 CET	38241	35582	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:01.698873997 CET	35582	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:01.698911905 CET	35582	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:02.600441933 CET	48202	443	192.168.2.13	185.125.190.26
Jan 3, 2025 08:15:02.699708939 CET	35584	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:02.704545021 CET	38241	35584	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:02.704610109 CET	35584	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:02.704659939 CET	35584	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:02.709453106 CET	38241	35584	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:02.709512949 CET	35584	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:02.714350939 CET	38241	35584	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:03.383359909 CET	38241	35584	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:03.383405924 CET	35584	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:03.383430004 CET	35584	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:04.384332895 CET	35586	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:04.392625093 CET	38241	35586	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:04.392786026 CET	35586	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:04.392797947 CET	35586	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:04.398916006 CET	38241	35586	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:04.398996115 CET	35586	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:04.404918909 CET	38241	35586	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:05.055340052 CET	38241	35586	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:05.055447102 CET	35586	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:05.055558920 CET	35586	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:06.057065010 CET	35588	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:06.062021971 CET	38241	35588	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:06.062098980 CET	35588	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:06.062192917 CET	35588	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:06.066970110 CET	38241	35588	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:06.067028046 CET	35588	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:06.071810007 CET	38241	35588	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:06.749468088 CET	38241	35588	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:06.749689102 CET	35588	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:06.749778032 CET	35588	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:07.751245975 CET	35590	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:07.756128073 CET	38241	35590	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:07.756275892 CET	35590	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:07.756340981 CET	35590	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:07.761109114 CET	38241	35590	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:07.761181116 CET	35590	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:07.765964985 CET	38241	35590	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:08.433243036 CET	38241	35590	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:08.433470011 CET	35590	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:08.433470011 CET	35590	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:09.434437037 CET	35592	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:09.439407110 CET	38241	35592	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:09.439557076 CET	35592	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:09.439579964 CET	35592	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:09.444339991 CET	38241	35592	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:09.444386005 CET	35592	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:09.449177027 CET	38241	35592	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:10.109138966 CET	38241	35592	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:10.109225035 CET	35592	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:10.109225988 CET	35592	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:11.109847069 CET	35594	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:11.114758015 CET	38241	35594	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:11.114813089 CET	35594	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:11.114835978 CET	35594	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:11.119604111 CET	38241	35594	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:11.119645119 CET	35594	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:11.124455929 CET	38241	35594	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:11.798382998 CET	38241	35594	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:11.798439980 CET	35594	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:11.798513889 CET	35594	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:12.799113035 CET	35596	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:12.804013014 CET	38241	35596	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:12.804086924 CET	35596	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:12.804161072 CET	35596	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:12.809431076 CET	38241	35596	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:12.809485912 CET	35596	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:12.814327002 CET	38241	35596	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:13.473525047 CET	38241	35596	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:13.473629951 CET	35596	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:13.473629951 CET	35596	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:14.474215031 CET	35598	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:14.479197025 CET	38241	35598	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:14.479250908 CET	35598	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:14.479270935 CET	35598	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:14.483999968 CET	38241	35598	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:14.484035969 CET	35598	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:14.494985104 CET	38241	35598	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:15.138762951 CET	38241	35598	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:15.138875008 CET	35598	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:15.144989014 CET	35598	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:16.146128893 CET	35600	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:16.151041031 CET	38241	35600	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:16.151123047 CET	35600	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:16.151210070 CET	35600	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:16.155949116 CET	38241	35600	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:16.156007051 CET	35600	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:16.160871029 CET	38241	35600	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:16.810781002 CET	38241	35600	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:16.810847998 CET	35600	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:16.810906887 CET	35600	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:17.812200069 CET	35602	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:17.817183018 CET	38241	35602	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:17.817297935 CET	35602	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:17.817353964 CET	35602	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:17.822133064 CET	38241	35602	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:17.822197914 CET	35602	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:17.827064037 CET	38241	35602	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:18.485100031 CET	38241	35602	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:18.485162973 CET	35602	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:18.485251904 CET	35602	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:19.486234903 CET	35604	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:19.491254091 CET	38241	35604	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:19.491339922 CET	35604	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:19.491410017 CET	35604	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:19.496241093 CET	38241	35604	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:19.496300936 CET	35604	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:19.501077890 CET	38241	35604	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:20.150479078 CET	38241	35604	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:20.150597095 CET	35604	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:20.150799990 CET	35604	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:21.151814938 CET	35606	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:21.168550968 CET	38241	35606	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:21.168715954 CET	35606	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:21.168735027 CET	35606	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:21.176510096 CET	38241	35606	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:21.176574945 CET	35606	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:21.181420088 CET	38241	35606	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:21.831626892 CET	38241	35606	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:21.831746101 CET	35606	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:21.831779003 CET	35606	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:22.832617998 CET	35608	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:22.837438107 CET	38241	35608	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:22.837508917 CET	35608	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:22.837526083 CET	35608	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:22.842304945 CET	38241	35608	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:22.842350006 CET	35608	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:22.847125053 CET	38241	35608	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:23.500382900 CET	38241	35608	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:23.500452042 CET	35608	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:23.500485897 CET	35608	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:24.501409054 CET	35610	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:24.506278992 CET	38241	35610	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:24.506345987 CET	35610	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:24.506478071 CET	35610	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:24.511221886 CET	38241	35610	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:24.511280060 CET	35610	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:24.516072035 CET	38241	35610	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:25.186348915 CET	38241	35610	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:25.186551094 CET	35610	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:25.186584949 CET	35610	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:26.187472105 CET	35612	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:26.192404032 CET	38241	35612	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:26.192524910 CET	35612	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:26.192558050 CET	35612	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:26.197408915 CET	38241	35612	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:26.197478056 CET	35612	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:26.202260971 CET	38241	35612	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:26.868542910 CET	38241	35612	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:26.868639946 CET	35612	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:26.868660927 CET	35612	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:27.869411945 CET	35614	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:27.874207973 CET	38241	35614	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:27.874258995 CET	35614	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:27.874275923 CET	35614	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:27.879051924 CET	38241	35614	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:27.879098892 CET	35614	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:27.883919001 CET	38241	35614	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:28.543771982 CET	38241	35614	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:28.543845892 CET	35614	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:28.544075012 CET	35614	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:29.545353889 CET	35616	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:29.550215960 CET	38241	35616	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:29.550302982 CET	35616	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:29.550406933 CET	35616	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:29.555250883 CET	38241	35616	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:29.555340052 CET	35616	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:29.560096979 CET	38241	35616	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:30.209357023 CET	38241	35616	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:30.209534883 CET	35616	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:30.209619045 CET	35616	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:31.210583925 CET	35618	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:31.215430021 CET	38241	35618	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:31.215531111 CET	35618	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:31.215544939 CET	35618	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:31.220319986 CET	38241	35618	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:31.220383883 CET	35618	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:31.225159883 CET	38241	35618	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:31.882925987 CET	38241	35618	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:31.883028984 CET	35618	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:31.883061886 CET	35618	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:32.884037971 CET	35620	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:32.889008045 CET	38241	35620	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:32.889056921 CET	35620	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:32.889075041 CET	35620	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:32.893835068 CET	38241	35620	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:32.893871069 CET	35620	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:32.898693085 CET	38241	35620	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:33.568852901 CET	38241	35620	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:33.569108009 CET	35620	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:33.569166899 CET	35620	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:34.570440054 CET	35622	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:34.575319052 CET	38241	35622	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:34.575448036 CET	35622	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:34.575512886 CET	35622	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:34.580281019 CET	38241	35622	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:34.580347061 CET	35622	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:34.585175037 CET	38241	35622	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:35.245290995 CET	38241	35622	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:35.245395899 CET	35622	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:35.245537996 CET	35622	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:36.247109890 CET	35624	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:36.251924992 CET	38241	35624	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:36.252039909 CET	35624	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:36.252096891 CET	35624	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:36.256848097 CET	38241	35624	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:36.256917953 CET	35624	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:36.261682987 CET	38241	35624	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:36.911552906 CET	38241	35624	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:36.911652088 CET	35624	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:36.911688089 CET	35624	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:37.912877083 CET	35626	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:37.917959929 CET	38241	35626	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:37.918039083 CET	35626	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:37.918118000 CET	35626	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:37.922844887 CET	38241	35626	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:37.922935963 CET	35626	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:37.927725077 CET	38241	35626	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:38.597644091 CET	38241	35626	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:38.597739935 CET	35626	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:38.597795010 CET	35626	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:39.599013090 CET	35628	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:39.603904009 CET	38241	35628	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:39.604052067 CET	35628	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:39.604111910 CET	35628	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:39.608911991 CET	38241	35628	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:39.609026909 CET	35628	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:39.613785982 CET	38241	35628	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:40.291867971 CET	38241	35628	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:40.292162895 CET	35628	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:40.292397976 CET	35628	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:41.293884993 CET	35630	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:41.298860073 CET	38241	35630	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:41.298939943 CET	35630	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:41.299047947 CET	35630	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:41.303823948 CET	38241	35630	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:41.303915977 CET	35630	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:41.308703899 CET	38241	35630	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:41.958158970 CET	38241	35630	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:41.958220005 CET	35630	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:41.958250046 CET	35630	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:42.958992004 CET	35632	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:42.963896990 CET	38241	35632	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:42.964004993 CET	35632	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:42.964103937 CET	35632	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:42.968839884 CET	38241	35632	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:42.968903065 CET	35632	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:42.973659992 CET	38241	35632	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:43.623348951 CET	38241	35632	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:43.623405933 CET	35632	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:43.623426914 CET	35632	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:44.624413013 CET	35634	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:44.629313946 CET	38241	35634	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:44.629426956 CET	35634	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:44.629482985 CET	35634	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:44.634301901 CET	38241	35634	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:44.634388924 CET	35634	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:44.639211893 CET	38241	35634	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:45.308182001 CET	38241	35634	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:45.308315039 CET	35634	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:45.308548927 CET	35634	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:46.309804916 CET	35636	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:46.314773083 CET	38241	35636	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:46.314851999 CET	35636	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:46.314872026 CET	35636	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:46.319704056 CET	38241	35636	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:46.319787979 CET	35636	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:46.324652910 CET	38241	35636	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:46.986116886 CET	38241	35636	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:46.986191988 CET	35636	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:46.986282110 CET	35636	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:47.987571001 CET	35638	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:47.992482901 CET	38241	35638	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:47.992733002 CET	35638	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:47.992800951 CET	35638	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:47.997543097 CET	38241	35638	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:47.997637033 CET	35638	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:48.002760887 CET	38241	35638	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:48.655581951 CET	38241	35638	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:48.655800104 CET	35638	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:48.655890942 CET	35638	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:49.656809092 CET	35640	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:49.661725044 CET	38241	35640	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:49.661794901 CET	35640	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:49.661815882 CET	35640	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:49.666630030 CET	38241	35640	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:49.666678905 CET	35640	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:49.671499968 CET	38241	35640	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:50.320980072 CET	38241	35640	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:50.321095943 CET	35640	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:50.321121931 CET	35640	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:51.322053909 CET	35642	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:51.326899052 CET	38241	35642	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:51.326977968 CET	35642	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:51.327060938 CET	35642	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:51.331887960 CET	38241	35642	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:51.331952095 CET	35642	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:51.336806059 CET	38241	35642	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:52.006262064 CET	38241	35642	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:52.006381035 CET	35642	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:52.006426096 CET	35642	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:53.007760048 CET	35644	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:53.012686968 CET	38241	35644	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:53.012772083 CET	35644	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:53.012839079 CET	35644	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:53.017580986 CET	38241	35644	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:53.017664909 CET	35644	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:53.022552013 CET	38241	35644	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:53.691093922 CET	38241	35644	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:53.691258907 CET	35644	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:53.691301107 CET	35644	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:54.692147970 CET	35646	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:54.696996927 CET	38241	35646	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:54.697052002 CET	35646	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:54.697084904 CET	35646	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:54.701843023 CET	38241	35646	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:54.701904058 CET	35646	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:54.706700087 CET	38241	35646	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:55.378314972 CET	38241	35646	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:55.378386021 CET	35646	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:55.378446102 CET	35646	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:56.379467964 CET	35648	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:56.384299040 CET	38241	35648	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:56.384356022 CET	35648	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:56.384392977 CET	35648	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:56.389244080 CET	38241	35648	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:56.389292002 CET	35648	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:56.394150019 CET	38241	35648	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:57.059684038 CET	38241	35648	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:57.059803009 CET	35648	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:57.059839964 CET	35648	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:58.060671091 CET	35650	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:58.065526009 CET	38241	35650	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:58.065624952 CET	35650	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:58.065654039 CET	35650	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:58.070456028 CET	38241	35650	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:58.070509911 CET	35650	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:58.075303078 CET	38241	35650	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:58.739005089 CET	38241	35650	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:58.739094973 CET	35650	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:58.739113092 CET	35650	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:59.739892006 CET	35652	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:59.744833946 CET	38241	35652	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:59.744913101 CET	35652	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:59.745007992 CET	35652	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:59.749752998 CET	38241	35652	83.222.191.90	192.168.2.13
Jan 3, 2025 08:15:59.749799013 CET	35652	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:15:59.754582882 CET	38241	35652	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:00.423283100 CET	38241	35652	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:00.423362017 CET	35652	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:00.423362017 CET	35652	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:01.424195051 CET	35654	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:01.429172993 CET	38241	35654	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:01.429440975 CET	35654	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:01.429511070 CET	35654	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:01.434289932 CET	38241	35654	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:01.434449911 CET	35654	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:01.439279079 CET	38241	35654	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:02.094535112 CET	38241	35654	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:02.094728947 CET	35654	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:02.094728947 CET	35654	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:03.096262932 CET	35656	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:03.101186037 CET	38241	35656	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:03.101300001 CET	35656	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:03.101351976 CET	35656	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:03.106189966 CET	38241	35656	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:03.106300116 CET	35656	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:03.111095905 CET	38241	35656	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:03.793766975 CET	38241	35656	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:03.793848038 CET	35656	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:03.793872118 CET	35656	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:04.794568062 CET	35658	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:04.799447060 CET	38241	35658	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:04.799504042 CET	35658	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:04.799530029 CET	35658	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:04.804313898 CET	38241	35658	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:04.804387093 CET	35658	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:04.809160948 CET	38241	35658	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:05.487998962 CET	38241	35658	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:05.488231897 CET	35658	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:05.488266945 CET	35658	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:06.488966942 CET	35660	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:06.493865967 CET	38241	35660	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:06.493998051 CET	35660	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:06.494010925 CET	35660	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:06.498836040 CET	38241	35660	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:06.498903990 CET	35660	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:06.503771067 CET	38241	35660	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:07.261652946 CET	38241	35660	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:07.261770010 CET	35660	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:07.261914968 CET	35660	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:08.262615919 CET	35662	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:08.267591953 CET	38241	35662	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:08.267642021 CET	35662	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:08.267663956 CET	35662	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:08.272442102 CET	38241	35662	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:08.272495985 CET	35662	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:08.277287960 CET	38241	35662	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:09.031419992 CET	38241	35662	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:09.031572104 CET	35662	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:09.031616926 CET	35662	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:10.032593012 CET	35664	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:10.037497044 CET	38241	35664	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:10.037553072 CET	35664	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:10.037586927 CET	35664	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:10.042392969 CET	38241	35664	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:10.042465925 CET	35664	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:10.047281981 CET	38241	35664	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:10.705447912 CET	38241	35664	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:10.705495119 CET	35664	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:10.705518007 CET	35664	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:11.706687927 CET	35666	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:11.711646080 CET	38241	35666	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:11.711893082 CET	35666	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:11.711909056 CET	35666	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:11.716720104 CET	38241	35666	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:11.716805935 CET	35666	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:11.721606016 CET	38241	35666	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:12.374309063 CET	38241	35666	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:12.374634027 CET	35666	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:12.374634027 CET	35666	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:13.375344038 CET	35668	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:13.380307913 CET	38241	35668	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:13.380378962 CET	35668	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:13.380414009 CET	35668	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:13.385196924 CET	38241	35668	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:13.385263920 CET	35668	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:13.390007019 CET	38241	35668	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:14.093887091 CET	38241	35668	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:14.093951941 CET	35668	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:14.093966961 CET	35668	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:15.094618082 CET	35670	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:15.099565983 CET	38241	35670	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:15.099661112 CET	35670	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:15.099695921 CET	35670	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:15.104497910 CET	38241	35670	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:15.104568958 CET	35670	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:15.109354973 CET	38241	35670	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:15.762675047 CET	38241	35670	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:15.762914896 CET	35670	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:15.762914896 CET	35670	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:16.763638020 CET	35672	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:16.768505096 CET	38241	35672	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:16.768596888 CET	35672	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:16.768682957 CET	35672	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:16.773464918 CET	38241	35672	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:16.773554087 CET	35672	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:16.778361082 CET	38241	35672	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:17.521193981 CET	38241	35672	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:17.521431923 CET	35672	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:17.521431923 CET	35672	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:18.522322893 CET	35674	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:18.527329922 CET	38241	35674	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:18.527414083 CET	35674	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:18.527487040 CET	35674	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:18.532234907 CET	38241	35674	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:18.532397032 CET	35674	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:18.537163973 CET	38241	35674	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:19.205275059 CET	38241	35674	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:19.205347061 CET	35674	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:19.205518961 CET	35674	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:20.206454992 CET	35676	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:20.211365938 CET	38241	35676	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:20.211473942 CET	35676	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:20.211488008 CET	35676	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:20.216283083 CET	38241	35676	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:20.216353893 CET	35676	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:20.221115112 CET	38241	35676	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:20.871048927 CET	38241	35676	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:20.871155977 CET	35676	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:20.871155977 CET	35676	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:21.872021914 CET	35678	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:21.876880884 CET	38241	35678	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:21.876957893 CET	35678	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:21.877048016 CET	35678	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:21.881872892 CET	38241	35678	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:21.881934881 CET	35678	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:21.886689901 CET	38241	35678	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:22.543836117 CET	38241	35678	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:22.543888092 CET	35678	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:22.543916941 CET	35678	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:23.544684887 CET	35680	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:23.549587011 CET	38241	35680	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:23.549664974 CET	35680	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:23.549762011 CET	35680	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:23.554583073 CET	38241	35680	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:23.554644108 CET	35680	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:23.559480906 CET	38241	35680	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:24.218200922 CET	38241	35680	83.222.191.90	192.168.2.13
Jan 3, 2025 08:16:24.218302011 CET	35680	38241	192.168.2.13	83.222.191.90
Jan 3, 2025 08:16:24.218368053 CET	35680	38241	192.168.2.13	83.222.191.90

System Behavior

Analysis Process: x86.elf PID: 5456, Parent PID: 5377

General

Start time (UTC):	07:14:20
Start date (UTC):	03/01/2025
Path:	/tmp/x86.elf
Arguments:	/tmp/x86.elf
File size:	88008 bytes
MD5 hash:	c641ba9f0ac6a0489667a4c699188e25

Chronological Activities

Analysis Process: x86.elf PID: 5457, Parent PID: 5456

General

Start time (UTC):	07:14:20
Start date (UTC):	03/01/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	88008 bytes
MD5 hash:	c641ba9f0ac6a0489667a4c699188e25

Chronological Activities

Analysis Process: x86.elf PID: 5458, Parent PID: 5457

General

Start time (UTC):	07:14:20
Start date (UTC):	03/01/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	88008 bytes
MD5 hash:	c641ba9f0ac6a0489667a4c699188e25

Chronological Activities

Analysis Process: x86.elf PID: 5459, Parent PID: 5457

General

Start time (UTC):	07:14:20
Start date (UTC):	03/01/2025
Path:	/tmp/x86.elf
Arguments:	-
File size:	88008 bytes
MD5 hash:	c641ba9f0ac6a0489667a4c699188e25

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: x86.elf PID: 5456, Parent PID: 5377

General

Chronological Activities

Analysis Process: x86.elf PID: 5457, Parent PID: 5456

General

Chronological Activities

Analysis Process: x86.elf PID: 5458, Parent PID: 5457

General

Chronological Activities

Analysis Process: x86.elf PID: 5459, Parent PID: 5457

General

Chronological Activities

Linux Analysis Report
x86.elf