Edit tour

Linux Analysis Report
mips.elf

Overview

General Information

Sample name:	mips.elf
Analysis ID:	1583970
MD5:	9597adc64e11bd41fc94b4d8f60b4541
SHA1:	959c5339df93e2c1a6c7744e20054777eef0221e
SHA256:	a2ebf0a7abbe158e061619ba17170119925b8fd420b0c0ff76cb30c3cd5bb6fc
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583970
Start date and time:	2025-01-03 23:47:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mips.elf
Detection:	MAL
Classification:	mal52.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: mips.elf

Runtime Messages

Command:	/tmp/mips.elf
PID:	6235
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	RebirthLTD
Standard Error:

Process Tree

system is lnxubuntu20

mips.elf (PID: 6235, Parent: 6161, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.elf

mips.elf New Fork (PID: 6238, Parent: 6235)

mips.elf New Fork (PID: 6240, Parent: 6238)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mips.elf

ReversingLabs: Detection: 28%

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 83.222.191.90 ports 38241,1,2,3,4,8

Source: global traffic

TCP traffic: 192.168.2.23:39770 -> 83.222.191.90:38241

Source: /tmp/mips.elf (PID: 6235)

Socket: 127.0.0.1:39148

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.222.191.90

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal52.troj.linELF@0/0@0/0

Source: /tmp/mips.elf (PID: 6235)

Queries kernel information via 'uname':

Jump to behavior

Source: mips.elf, 6235.1.000055ed3f073000.000055ed3f0fa000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: mips.elf, 6235.1.000055ed3f073000.000055ed3f0fa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 6235.1.00007ffc2cb94000.00007ffc2cbb5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 6235.1.00007ffc2cb94000.00007ffc2cbb5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mips.elf	29%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
83.222.191.90	unknown	Bulgaria	43561	NET1-ASBG	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
83.222.191.90	ppc.elf	Get hash	malicious	Unknown	Browse
	spc.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	arm4.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	Mozi.m.elf	Get hash	malicious	Mirai	Browse
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm4.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	Mozi.m.elf	Get hash	malicious	Mirai	Browse
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm4.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Mozi.m.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	Mozi.m.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	Mozi.m.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
NET1-ASBG	ppc.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	spc.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	arm5.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	x86.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	arm7.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	arm4.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	m68k.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	mips.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	mpsl.elf	Get hash	malicious	Unknown	Browse	83.222.191.90

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.2375410997770375
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mips.elf
File size:	34'740 bytes
MD5:	9597adc64e11bd41fc94b4d8f60b4541
SHA1:	959c5339df93e2c1a6c7744e20054777eef0221e
SHA256:	a2ebf0a7abbe158e061619ba17170119925b8fd420b0c0ff76cb30c3cd5bb6fc
SHA512:	9bd89edfb47edd2378eae189e6dcfb5b81ef3de816668f2c3b363d649d1e104457dacdde015018fd0b251f9c08d77670f0a418211fb9adbac87018bcf98e301f
SSDEEP:	768:YfRUSKTV2VMXGYRHgPMczMZvSzM8SHpKuTLj/cCggraatrnTq7:EGgPMczMZKzM8SHooUjguatrnTq7
TLSH:	3FF2735E2F328FEDF67E823553738A21979863D522E09644D66CF9011FB024D709FBA8
File Content Preview:	.ELF.....................@.`...4.........4. ...(.............@...@....\|...\|..................D...D.....T............dt.Q............................<...'......!'.......................<...'......!........'9... ......................<...'......!........'9s

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	34220
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x72c0	0x0	0x6	AX	16
.fini	PROGBITS	0x4073e0	0x73e0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x407440	0x7440	0x8a0	0x0	0x2	A	16
.ctors	PROGBITS	0x448000	0x8000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x448008	0x8008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x448020	0x8020	0x180	0x0	0x3	WA	16
.got	PROGBITS	0x4481a0	0x81a0	0x3b4	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x448554	0x8554	0x18	0x0	0x10000003	WAp	4
.bss	NOBITS	0x448570	0x8554	0x198	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x71a	0x8554	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x8554	0x57	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x7ce0	0x7ce0	5.4085	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x8000	0x448000	0x448000	0x554	0x708	2.6744	0x6	RW	0x10000	.ctors .dtors .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 23:47:47.199944973 CET	39770	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:47.204840899 CET	38241	39770	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:47.204926014 CET	39770	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:47.235928059 CET	39770	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:47.240731955 CET	38241	39770	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:47.240772009 CET	39770	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:47.245522976 CET	38241	39770	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:48.937797070 CET	38241	39770	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:48.938117027 CET	39770	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:48.944252014 CET	38241	39770	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:49.391613960 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 23:47:49.939583063 CET	39772	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:49.944405079 CET	38241	39772	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:49.944453001 CET	39772	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:49.945226908 CET	39772	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:49.949987888 CET	38241	39772	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:49.950025082 CET	39772	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:49.954766989 CET	38241	39772	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:51.707346916 CET	38241	39772	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:51.707566023 CET	39772	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:51.712320089 CET	38241	39772	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:52.709268093 CET	39774	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:52.714291096 CET	38241	39774	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:52.714339972 CET	39774	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:52.715131044 CET	39774	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:52.720068932 CET	38241	39774	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:52.720108032 CET	39774	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:52.726269960 CET	38241	39774	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:54.450560093 CET	38241	39774	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:54.450783968 CET	39774	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:54.457006931 CET	38241	39774	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:54.766848087 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 23:47:55.451941967 CET	39776	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:55.456779003 CET	38241	39776	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:55.456864119 CET	39776	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:55.457617998 CET	39776	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:55.462388039 CET	38241	39776	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:55.462441921 CET	39776	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:55.467202902 CET	38241	39776	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:56.558515072 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 23:47:57.173175097 CET	38241	39776	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:57.173460960 CET	39776	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:57.178306103 CET	38241	39776	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:58.174962997 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:58.179805994 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:58.179874897 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:58.180597067 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:58.185349941 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:58.185398102 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:58.190144062 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:59.900316954 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 23:47:59.900593996 CET	39778	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:47:59.907418966 CET	38241	39778	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:00.902072906 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:00.906933069 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:00.907038927 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:00.907828093 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:00.912550926 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:00.912607908 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:00.917362928 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:02.627007961 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:02.627228022 CET	39780	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:02.631989002 CET	38241	39780	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:03.628976107 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:03.633853912 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:03.633945942 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:03.634831905 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:03.639535904 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:03.639643908 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:03.644464016 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:05.343446970 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:05.343597889 CET	39782	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:05.348381042 CET	38241	39782	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:06.345169067 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:06.357081890 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:06.357207060 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:06.358150959 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:06.362873077 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:06.362915993 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:06.367794991 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:08.064419031 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:08.064651966 CET	39784	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:08.069560051 CET	38241	39784	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:09.066658974 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:09.071516991 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:09.071608067 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:09.072540998 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:09.077342033 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:09.077403069 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:09.082205057 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:09.612766027 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 23:48:10.784919977 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:10.785187960 CET	39786	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:10.789987087 CET	38241	39786	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:11.786679029 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:11.791521072 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:11.791619062 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:11.792525053 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:11.798280001 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:11.798338890 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:11.803395987 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:13.523431063 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:13.523626089 CET	39788	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:13.531075001 CET	38241	39788	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:14.525219917 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:14.530056000 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:14.530153036 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:14.531033039 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:14.535794020 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:14.535871029 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:14.540606022 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:16.262233019 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:16.262406111 CET	39790	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:16.267195940 CET	38241	39790	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:17.264154911 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:17.271444082 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:17.271492004 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:17.272270918 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:17.279460907 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:17.279500008 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:17.286575079 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:18.982652903 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:18.982786894 CET	39792	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:18.987592936 CET	38241	39792	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:19.984504938 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:19.989367962 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:19.989411116 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:19.990289927 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:19.995049000 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:19.995090008 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:20.000025988 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:21.698386908 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:21.698503971 CET	39794	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:21.703360081 CET	38241	39794	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:21.899122953 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 23:48:22.700501919 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:22.705319881 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:22.705369949 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:22.706403971 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:22.711219072 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:22.711260080 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:22.716021061 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:24.438961029 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:24.439055920 CET	39796	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:24.443928957 CET	38241	39796	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:25.440604925 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:25.445497990 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:25.445559025 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:25.446456909 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:25.451169968 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:25.451212883 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:25.455933094 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:25.994496107 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 23:48:27.152491093 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:27.152637959 CET	39798	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:27.157453060 CET	38241	39798	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:28.154974937 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:28.159813881 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:28.159888983 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:28.161153078 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:28.165914059 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:28.165971041 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:28.170763969 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:29.873991013 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:29.874209881 CET	39800	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:29.879014969 CET	38241	39800	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:30.876420975 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:30.881247997 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:30.881320000 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:30.882643938 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:30.887415886 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:30.887487888 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:30.892232895 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:32.610740900 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:32.611119986 CET	39802	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:32.615889072 CET	38241	39802	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:33.612853050 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:33.617760897 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:33.617809057 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:33.618717909 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:33.623518944 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:33.623557091 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:33.628289938 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:35.322805882 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:35.322906971 CET	39804	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:35.328085899 CET	38241	39804	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:36.324641943 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:36.334294081 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:36.334367990 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:36.335470915 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:36.345105886 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:36.345171928 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:36.354759932 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:38.043015003 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:38.043276072 CET	39806	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:38.048060894 CET	38241	39806	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:39.045454979 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:39.050306082 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:39.050352097 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:39.051270008 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:39.056077957 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:39.056113005 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:39.060905933 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:40.765566111 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:40.765916109 CET	39808	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:40.770746946 CET	38241	39808	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:41.768153906 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:41.773102999 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:41.773173094 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:41.774462938 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:41.786319971 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:41.786375999 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:41.791151047 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:43.479773998 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:43.480133057 CET	39810	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:43.484904051 CET	38241	39810	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:44.482311010 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:44.487335920 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:44.487406969 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:44.488425016 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:44.493133068 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:44.493197918 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:44.497942924 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:46.201863050 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:46.202112913 CET	39812	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:46.206975937 CET	38241	39812	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:47.204121113 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:47.209029913 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:47.209106922 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:47.210190058 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:47.215044022 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:47.215106010 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:47.219891071 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:48.925333977 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:48.925688982 CET	39814	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:48.930512905 CET	38241	39814	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:49.927759886 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:49.932586908 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:49.932661057 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:49.933790922 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:49.938564062 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:49.938623905 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:49.943464041 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:50.567059994 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 23:48:51.660471916 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:51.660806894 CET	39816	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:51.665642023 CET	38241	39816	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:52.662761927 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:52.667606115 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:52.667659044 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:52.668549061 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:52.673280954 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:52.673341990 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:52.678122997 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:54.387464046 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:54.387633085 CET	39818	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:54.394793034 CET	38241	39818	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:55.389492989 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:55.394417048 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:55.394520998 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:55.395714045 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:55.400485039 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:55.400554895 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:55.405329943 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:57.090909004 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:57.091253996 CET	39820	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:57.096046925 CET	38241	39820	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:58.092966080 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:58.097834110 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:58.097886086 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:58.098779917 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:58.103530884 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:58.103585005 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:58.108342886 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:59.807710886 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 23:48:59.807817936 CET	39822	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:48:59.815118074 CET	38241	39822	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:00.809343100 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:00.814223051 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:00.814332962 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:00.815234900 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:00.820086956 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:00.820151091 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:00.825018883 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:02.514255047 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:02.514408112 CET	39824	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:02.519236088 CET	38241	39824	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:03.515764952 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:03.520685911 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:03.520821095 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:03.521712065 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:03.526521921 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:03.526586056 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:03.531339884 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:05.230524063 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:05.230653048 CET	39826	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:05.236502886 CET	38241	39826	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:06.231872082 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:06.236675024 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:06.236743927 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:06.237566948 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:06.242785931 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:06.242830038 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:06.248413086 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:07.937411070 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:07.937546015 CET	39828	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:07.945236921 CET	38241	39828	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:08.939011097 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:08.943902969 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:08.943970919 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:08.944757938 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:08.949548006 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:08.949594975 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:08.954361916 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:10.693298101 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:10.693423986 CET	39830	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:10.698225021 CET	38241	39830	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:11.695231915 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:11.700164080 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:11.700222969 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:11.701328039 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:11.706142902 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:11.706187010 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:11.710992098 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:13.402095079 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:13.402313948 CET	39832	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:13.407131910 CET	38241	39832	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:14.404467106 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:14.409461021 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:14.409528971 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:14.410619974 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:14.415354967 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:14.415405035 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:14.426001072 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:16.105354071 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:16.105593920 CET	39834	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:16.115643978 CET	38241	39834	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:17.108396053 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:17.113246918 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:17.113326073 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:17.114813089 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:17.119607925 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:17.119649887 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:17.124412060 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:18.828248024 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:18.828479052 CET	39836	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:18.840958118 CET	38241	39836	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:19.830796003 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:19.843066931 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:19.843158960 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:19.844336033 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:19.855915070 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:19.855964899 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:19.868020058 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:21.543734074 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:21.543880939 CET	39838	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:21.556243896 CET	38241	39838	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:22.545286894 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:22.558093071 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:22.558154106 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:22.558903933 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:22.571542978 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:22.571597099 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:22.584335089 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:24.278167963 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:24.278332949 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:24.278366089 CET	39840	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:24.294390917 CET	38241	39840	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:25.279841900 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:25.292709112 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:25.292762041 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:25.293534040 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:25.306073904 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:25.306118011 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:25.318283081 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:27.034509897 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:27.034651995 CET	39842	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:27.048096895 CET	38241	39842	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:28.036122084 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:28.049297094 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:28.049354076 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:28.050120115 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:28.062813997 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:28.062858105 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:28.075078964 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:29.781991959 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:29.782119989 CET	39844	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:29.794277906 CET	38241	39844	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:30.783639908 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:30.798319101 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:30.798378944 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:30.799277067 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:30.812733889 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:30.812787056 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:30.825922966 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:32.511162043 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:32.511291981 CET	39846	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:32.521279097 CET	38241	39846	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:33.512533903 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:33.519655943 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:33.519710064 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:33.520483017 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:33.525222063 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:33.525273085 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:33.530766964 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:35.221798897 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:35.221998930 CET	39848	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:35.226797104 CET	38241	39848	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:36.223439932 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:36.228306055 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:36.228353024 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:36.229208946 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:36.233958006 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:36.233994961 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:36.238769054 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:37.933651924 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:37.933845997 CET	39850	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:37.938613892 CET	38241	39850	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:38.935882092 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:38.940717936 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:38.940790892 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:38.942054987 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:38.946885109 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:38.946938992 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:38.951687098 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:40.639549971 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:40.639745951 CET	39852	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:40.644531012 CET	38241	39852	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:41.641658068 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:41.646457911 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:41.646507978 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:41.647458076 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:41.652165890 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:41.652219057 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:41.656960964 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:43.360375881 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:43.360716105 CET	39854	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:43.365495920 CET	38241	39854	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:44.363044977 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:44.367988110 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:44.368061066 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:44.369362116 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:44.374126911 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:44.374191046 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:44.378974915 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:46.074546099 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:46.075026035 CET	39856	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:46.079998016 CET	38241	39856	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:47.077457905 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:47.082354069 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:47.082472086 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:47.083777905 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:47.090331078 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:47.090398073 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:47.095743895 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:48.796441078 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:48.796766996 CET	39858	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:48.803117037 CET	38241	39858	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:49.799165964 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:49.804141045 CET	38241	39860	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:49.804249048 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:49.805422068 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:49.810159922 CET	38241	39860	83.222.191.90	192.168.2.23
Jan 3, 2025 23:49:49.810223103 CET	39860	38241	192.168.2.23	83.222.191.90
Jan 3, 2025 23:49:49.815047026 CET	38241	39860	83.222.191.90	192.168.2.23

System Behavior

Analysis Process: mips.elf PID: 6235, Parent PID: 6161

General

Start time (UTC):	22:47:45
Start date (UTC):	03/01/2025
Path:	/tmp/mips.elf
Arguments:	/tmp/mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6238, Parent PID: 6235

General

Start time (UTC):	22:47:46
Start date (UTC):	03/01/2025
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6240, Parent PID: 6238

General

Start time (UTC):	22:47:46
Start date (UTC):	03/01/2025
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: mips.elf PID: 6235, Parent PID: 6161

General

Chronological Activities

Analysis Process: mips.elf PID: 6238, Parent PID: 6235

General

Chronological Activities

Analysis Process: mips.elf PID: 6240, Parent PID: 6238

General

Chronological Activities

Linux Analysis Report
mips.elf