Edit tour

Linux Analysis Report
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf

Overview

General Information

Sample name:	185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Analysis ID:	1584005
MD5:	9194187e76ace1dac25c4318198203ad
SHA1:	8f06ed5c065882b712d4e23dbe1d4765c7d0820d
SHA256:	44852bdabedd87b80e55b23f50caaecd78ed4b266bdc878a9c81c80696185eab
Tags:	elfuser-threatquery
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Suricata IDS alerts with low severity for network traffic

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584005
Start date and time:	2025-01-04 02:48:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
PID:	5429
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5429, Parent: 5354, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf New Fork (PID: 5431, Parent: 5429)

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf New Fork (PID: 5432, Parent: 5429)

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf New Fork (PID: 5434, Parent: 5429)

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf New Fork (PID: 5502, Parent: 5434)

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf New Fork (PID: 5504, Parent: 5502)

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf New Fork (PID: 5545, Parent: 5434)

185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf New Fork (PID: 5547, Parent: 5545)

xfce4-panel New Fork (PID: 5439, Parent: 3147)

wrapper-2.0 (PID: 5439, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5440, Parent: 3147)

wrapper-2.0 (PID: 5440, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5441, Parent: 3147)

wrapper-2.0 (PID: 5441, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5442, Parent: 3147)

wrapper-2.0 (PID: 5442, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 5443, Parent: 3147)

wrapper-2.0 (PID: 5443, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5444, Parent: 3147)

wrapper-2.0 (PID: 5444, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5454, Parent: 5453)

xfconfd (PID: 5454, Parent: 5453, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

dbus-daemon New Fork (PID: 5456, Parent: 5455)

xfconfd (PID: 5456, Parent: 5455, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5460, Parent: 2935)

xfce4-notifyd (PID: 5460, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x30f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x323:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x337:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x373:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x387:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x413:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x427:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x463:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x477:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x7cd:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x548c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x552c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x557c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x55f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5922:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x641:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x655:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x669:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x691:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x709:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x731:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x745:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x759:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x781:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xaff:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x182:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x196:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x222:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x236:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x272:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x286:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5c8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5545	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5d0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5dae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5dc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5dd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5dea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5dfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x526:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 29 entries

Suricata Signatures

ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T02:49:39.381092+0100	2009208	1	A Network Trojan was detected	192.168.2.13	10494	91.196.125.252	52144	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T02:49:39.381035+0100	2009205	1	A Network Trojan was detected	192.168.2.13	10494	91.196.125.252	52144	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T02:49:39.381585+0100	2009206	1	A Network Trojan was detected	192.168.2.13	10494	91.196.125.252	52144	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T02:49:39.379330+0100	2009207	1	A Network Trojan was detected	192.168.2.13	10494	91.196.125.252	52144	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	Virustotal: Detection: 66%			Perma Link
Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	ReversingLabs: Detection: 65%

Source: global traffic	TCP traffic: 192.168.2.13:49282 -> 185.232.205.45:3778
Source: global traffic	UDP traffic: 192.168.2.13:10494 -> 91.196.125.252:52144

Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.13:10494 -> 91.196.125.252:52144
Source: Network traffic	Suricata IDS: 2009205 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1) : 192.168.2.13:10494 -> 91.196.125.252:52144
Source: Network traffic	Suricata IDS: 2009208 - Severity 1 - ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16) : 192.168.2.13:10494 -> 91.196.125.252:52144
Source: Network traffic	Suricata IDS: 2009206 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4) : 192.168.2.13:10494 -> 91.196.125.252:52144

Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45
Source: unknown	TCP traffic detected without corresponding DNS query: 185.232.205.45

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5442, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5443, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5454, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5504)	SIGKILL sent: pid: 5502, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5547)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5442, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5443, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5454, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5504)	SIGKILL sent: pid: 5502, result: successful	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5547)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior

Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5545, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/0@2/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5439)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5456)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5456)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5456)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5456)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3122/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3117/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3114/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5413/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3633/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5415/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/518/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3771/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3375/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3132/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5271/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1745/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1866/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1982/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/765/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1748/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5440/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5441/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5442/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5443/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5444/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1755/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/2964/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1751/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/2961/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/778/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5434/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5439/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1879/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5453/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5454/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5455/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1891/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3153/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1921/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/783/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1765/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/2974/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1400/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1884/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3424/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3708/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/2972/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3709/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/2970/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1881/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3146/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3300/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1805/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1925/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1804/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1922/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3429/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3442/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3165/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3164/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3163/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3162/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/790/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3161/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/792/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/672/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1930/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/3315/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/1411/cmdline	Jump to behavior
Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5431)	File opened: /proc/2984/cmdline	Jump to behavior

Source: /tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf (PID: 5429)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5439)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5444)	Queries kernel information via 'uname':	Jump to behavior

Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5429.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5432.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5502.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5504.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5545.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5547.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp	Binary or memory string: &x86_64/usr/bin/qemu-sparc/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5429.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5432.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5502.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5504.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5545.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5547.1.000055b999001000.000055b999086000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5429.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5432.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5502.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5504.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5545.1.000055b999001000.000055b999086000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5547.1.000055b999001000.000055b999086000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5429.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5432.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5502.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5504.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5545.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp, 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, 5547.1.00007ffc0119d000.00007ffc011be000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, type: SAMPLE
Source: Yara match	File source: 5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf, type: SAMPLE
Source: Yara match	File source: 5504.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5429.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5547.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5502.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5545.1.00007fa158011000.00007fa15801f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	66%	Virustotal		Browse
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	66%	ReversingLabs	Linux.Backdoor.Mirai
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	100%	Avira	EXP/ELF.Gafgyt.D

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.196.125.252	unknown	Bulgaria		201200	SUPERHOSTING_ASBG	false
185.232.205.45	unknown	Spain		201942	SOLTIAES	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.232.205.45	185.232.205.45-boatnet.arm-2025-01-03T23_59_46.elf	Get hash	malicious	Mirai	Browse
	185.232.205.45-boatnet.x86-2025-01-03T23_59_45.elf	Get hash	malicious	Mirai	Browse
	185.232.205.45-boatnet.mips-2025-01-03T23_59_45.elf	Get hash	malicious	Mirai	Browse
	185.232.205.45-boatnet.mpsl-2025-01-03T23_59_46.elf	Get hash	malicious	Mirai	Browse
	185.232.205.45-boatnet.arm7-2025-01-03T23_59_47.elf	Get hash	malicious	Mirai	Browse
	185.232.205.45-boatnet.m68k-2025-01-03T23_59_48.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	185.232.205.45-boatnet.arm6-2025-01-03T23_59_47.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	185.232.205.45-boatnet.x86-2025-01-03T23_59_45.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	185.232.205.45-boatnet.mips-2025-01-03T23_59_45.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	185.232.205.45-boatnet.arm7-2025-01-03T23_59_47.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	185.232.205.45-boatnet.m68k-2025-01-03T23_59_48.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	154.216.18.23-boatnet.arm-2025-01-03T11_40_59.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	3.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	1.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SOLTIAES	185.232.205.45-boatnet.arm-2025-01-03T23_59_46.elf	Get hash	malicious	Mirai	Browse	185.232.205.45
	185.232.205.45-boatnet.x86-2025-01-03T23_59_45.elf	Get hash	malicious	Mirai	Browse	185.232.205.45
	185.232.205.45-boatnet.mips-2025-01-03T23_59_45.elf	Get hash	malicious	Mirai	Browse	185.232.205.45
	185.232.205.45-boatnet.mpsl-2025-01-03T23_59_46.elf	Get hash	malicious	Mirai	Browse	185.232.205.45
	185.232.205.45-boatnet.arm7-2025-01-03T23_59_47.elf	Get hash	malicious	Mirai	Browse	185.232.205.45
	185.232.205.45-boatnet.m68k-2025-01-03T23_59_48.elf	Get hash	malicious	Mirai	Browse	185.232.205.45
	armv5l.elf	Get hash	malicious	Mirai	Browse	185.91.108.81
	Hilix.x86.elf	Get hash	malicious	Mirai	Browse	185.75.12.232
	Hilix.arm7.elf	Get hash	malicious	Mirai	Browse	185.232.205.144
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.232.205.48
SUPERHOSTING_ASBG	Hilix.sh4.elf	Get hash	malicious	Mirai	Browse	185.45.66.60
	armv4l.elf	Get hash	malicious	Mirai	Browse	185.45.66.57
	IMG635673567357735773573757875883587935775753Bjlkeloftet.exe	Get hash	malicious	Remcos, GuLoader	Browse	91.196.125.125
	0GuwV0t2UU.exe	Get hash	malicious	FormBook, GuLoader	Browse	193.107.36.30
	0GuwV0t2UU.exe	Get hash	malicious	FormBook, GuLoader	Browse	193.107.36.30
	Rob.Kuster@stonhard.com.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	185.45.66.155
	zip file.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	185.45.66.155
	450707124374000811.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	450707124374000811.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.06653308315536
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
File size:	58'376 bytes
MD5:	9194187e76ace1dac25c4318198203ad
SHA1:	8f06ed5c065882b712d4e23dbe1d4765c7d0820d
SHA256:	44852bdabedd87b80e55b23f50caaecd78ed4b266bdc878a9c81c80696185eab
SHA512:	f2c534a2ae853a5a53d129a2fbe3876520f1b7031fac9b3f732c63c4a32caf5d51103973e9a89dbde11ff440e7bb61b4083863e993c9d42580198ca3d45b4c38
SSDEEP:	768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw3:RqtmZPuutfbltZFBSJsBcfDSTFI+BE3
TLSH:	7D431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8
File Content Preview:	.ELF...........................4...x.....4. ...(.......................................................8...P........dt.Q................................@..(....@.2.................#.....b8..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	57976
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xc888	0x0	0x6	AX	4
.fini	PROGBITS	0x1c938	0xc938	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1c950	0xc950	0x11b0	0x0	0x2	A	8
.ctors	PROGBITS	0x2e000	0xe000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2e008	0xe008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2e018	0xe018	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x2e238	0xe238	0x318	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xe238	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0xdb00	0xdb00	6.1730	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xe000	0x2e000	0x2e000	0x238	0x550	2.9229	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-04T02:49:39.379330+0100	2009207	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)	1	192.168.2.13	10494	91.196.125.252	52144	UDP
2025-01-04T02:49:39.381035+0100	2009205	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)	1	192.168.2.13	10494	91.196.125.252	52144	UDP
2025-01-04T02:49:39.381092+0100	2009208	ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)	1	192.168.2.13	10494	91.196.125.252	52144	UDP
2025-01-04T02:49:39.381585+0100	2009206	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)	1	192.168.2.13	10494	91.196.125.252	52144	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 02:48:52.009243011 CET	49282	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.014235973 CET	3778	49282	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:52.014292955 CET	49282	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.063868046 CET	49282	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.068797112 CET	3778	49282	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:52.068836927 CET	49282	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.073734045 CET	3778	49282	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:52.769301891 CET	3778	49282	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:52.769371986 CET	49282	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.769552946 CET	49282	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.771982908 CET	49284	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.776767015 CET	3778	49284	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:52.776822090 CET	49284	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.784271955 CET	49284	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.789068937 CET	3778	49284	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:52.789201021 CET	49284	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:52.793936014 CET	3778	49284	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:53.411055088 CET	3778	49284	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:53.411111116 CET	49284	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:53.411149025 CET	49284	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:53.412092924 CET	49286	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:53.416882038 CET	3778	49286	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:53.416956902 CET	49286	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:53.420691967 CET	49286	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:53.425539970 CET	3778	49286	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:53.425595045 CET	49286	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:53.430438042 CET	3778	49286	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.048805952 CET	3778	49286	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.048871994 CET	49286	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.048918962 CET	49286	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.125312090 CET	49288	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.130196095 CET	3778	49288	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.130264997 CET	49288	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.148691893 CET	49288	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.153493881 CET	3778	49288	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.153542995 CET	49288	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.158344030 CET	3778	49288	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.779834032 CET	3778	49288	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.779921055 CET	49288	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.779921055 CET	49288	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.781847954 CET	49290	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.786742926 CET	3778	49290	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.786802053 CET	49290	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.792154074 CET	49290	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.796932936 CET	3778	49290	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:54.796987057 CET	49290	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:54.801778078 CET	3778	49290	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:55.436292887 CET	3778	49290	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:55.436374903 CET	49290	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:55.436408043 CET	49290	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:55.439874887 CET	49292	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:55.444713116 CET	3778	49292	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:55.444802046 CET	49292	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:55.450536013 CET	49292	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:55.455346107 CET	3778	49292	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:55.455421925 CET	49292	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:55.460345030 CET	3778	49292	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.096273899 CET	3778	49292	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.096401930 CET	49292	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.096401930 CET	49292	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.097598076 CET	49294	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.102408886 CET	3778	49294	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.102574110 CET	49294	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.106941938 CET	49294	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.111697912 CET	3778	49294	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.111761093 CET	49294	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.116527081 CET	3778	49294	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.756982088 CET	3778	49294	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.757076025 CET	49294	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.757076025 CET	49294	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.758641005 CET	49296	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.763531923 CET	3778	49296	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.763582945 CET	49296	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.767043114 CET	49296	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.771866083 CET	3778	49296	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:56.771919012 CET	49296	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:56.776767969 CET	3778	49296	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:57.419023991 CET	3778	49296	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:57.419083118 CET	49296	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:57.419111013 CET	49296	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:57.420923948 CET	49298	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:57.425787926 CET	3778	49298	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:57.425849915 CET	49298	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:57.429514885 CET	49298	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:57.434314013 CET	3778	49298	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:57.434401989 CET	49298	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:57.439230919 CET	3778	49298	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.093000889 CET	3778	49298	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.093058109 CET	49298	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.093081951 CET	49298	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.094244957 CET	49300	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.099060059 CET	3778	49300	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.099148989 CET	49300	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.101571083 CET	49300	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.106338024 CET	3778	49300	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.106389046 CET	49300	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.111232996 CET	3778	49300	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.732934952 CET	3778	49300	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.733211994 CET	49300	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.733211994 CET	49300	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.734225988 CET	49302	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.739059925 CET	3778	49302	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.739110947 CET	49302	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.741789103 CET	49302	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.746541977 CET	3778	49302	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:58.746582985 CET	49302	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:58.751367092 CET	3778	49302	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:59.398147106 CET	3778	49302	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:59.398212910 CET	49302	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:59.398227930 CET	49302	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:59.399275064 CET	49304	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:59.404184103 CET	3778	49304	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:59.404234886 CET	49304	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:59.407191038 CET	49304	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:59.412061930 CET	3778	49304	185.232.205.45	192.168.2.13
Jan 4, 2025 02:48:59.412136078 CET	49304	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:48:59.417036057 CET	3778	49304	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.063658953 CET	3778	49304	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.063736916 CET	49304	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.063771009 CET	49304	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.064491034 CET	49306	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.071266890 CET	3778	49306	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.071331024 CET	49306	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.073117971 CET	49306	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.078592062 CET	3778	49306	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.078919888 CET	49306	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.083698034 CET	3778	49306	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.704482079 CET	3778	49306	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.704722881 CET	49306	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.704722881 CET	49306	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.705688000 CET	49308	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.710587978 CET	3778	49308	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.710656881 CET	49308	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.712219954 CET	49308	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.716988087 CET	3778	49308	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:00.717092037 CET	49308	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:00.721878052 CET	3778	49308	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:01.353455067 CET	3778	49308	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:01.355247974 CET	49308	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:01.355247974 CET	49308	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:01.367196083 CET	49310	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:01.372004032 CET	3778	49310	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:01.372092962 CET	49310	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:01.451303959 CET	49310	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:01.456135035 CET	3778	49310	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:01.459399939 CET	49310	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:01.464154959 CET	3778	49310	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.026518106 CET	3778	49310	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.026715040 CET	49310	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.026715040 CET	49310	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.027081013 CET	49312	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.031946898 CET	3778	49312	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.032008886 CET	49312	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.032968044 CET	49312	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.037728071 CET	3778	49312	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.037789106 CET	49312	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.042598963 CET	3778	49312	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.706360102 CET	3778	49312	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.706435919 CET	49312	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.706464052 CET	49312	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.706867933 CET	49314	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.711699963 CET	3778	49314	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.711869001 CET	49314	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.712665081 CET	49314	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.717489958 CET	3778	49314	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:02.717586040 CET	49314	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:02.722379923 CET	3778	49314	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.344851017 CET	3778	49314	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.345057964 CET	49314	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.345057964 CET	49314	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.345541954 CET	49316	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.353037119 CET	3778	49316	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.353101015 CET	49316	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.353796005 CET	49316	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.359709024 CET	3778	49316	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.359745979 CET	49316	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.364584923 CET	3778	49316	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.983565092 CET	3778	49316	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.983678102 CET	49316	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.983701944 CET	49316	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.984131098 CET	49318	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.988948107 CET	3778	49318	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.989006996 CET	49318	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.989697933 CET	49318	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.994555950 CET	3778	49318	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:03.994599104 CET	49318	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:03.999356031 CET	3778	49318	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:04.633651972 CET	3778	49318	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:04.633759975 CET	49318	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:04.633810997 CET	49318	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:04.634284973 CET	49320	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:04.639170885 CET	3778	49320	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:04.639219046 CET	49320	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:04.639889956 CET	49320	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:04.644715071 CET	3778	49320	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:04.644774914 CET	49320	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:04.649600983 CET	3778	49320	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.285672903 CET	3778	49320	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.285770893 CET	49320	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.285806894 CET	49320	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.286252022 CET	49322	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.291026115 CET	3778	49322	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.291078091 CET	49322	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.291726112 CET	49322	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.296519995 CET	3778	49322	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.296564102 CET	49322	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.301374912 CET	3778	49322	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.927603006 CET	3778	49322	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.927679062 CET	49322	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.927700996 CET	49322	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.928069115 CET	49324	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.932919979 CET	3778	49324	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.932970047 CET	49324	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.933593035 CET	49324	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.938393116 CET	3778	49324	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:05.938433886 CET	49324	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:05.943278074 CET	3778	49324	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:06.572380066 CET	3778	49324	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:06.572453976 CET	49324	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:06.572453976 CET	49324	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:06.572809935 CET	49326	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:06.577611923 CET	3778	49326	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:06.577660084 CET	49326	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:06.578301907 CET	49326	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:06.583062887 CET	3778	49326	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:06.583102942 CET	49326	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:06.587937117 CET	3778	49326	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.217402935 CET	3778	49326	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.217488050 CET	49326	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.217505932 CET	49326	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.217864990 CET	49328	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.223373890 CET	3778	49328	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.223423958 CET	49328	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.224056959 CET	49328	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.229588985 CET	3778	49328	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.229676962 CET	49328	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.235202074 CET	3778	49328	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.853291988 CET	3778	49328	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.853360891 CET	49328	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.853360891 CET	49328	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.853713989 CET	49330	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.858549118 CET	3778	49330	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.858608007 CET	49330	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.859272003 CET	49330	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.864079952 CET	3778	49330	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:07.864123106 CET	49330	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:07.868963003 CET	3778	49330	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:08.509660959 CET	3778	49330	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:08.509732962 CET	49330	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:08.509767056 CET	49330	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:08.510163069 CET	49332	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:08.515132904 CET	3778	49332	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:08.515180111 CET	49332	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:08.515907049 CET	49332	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:08.521037102 CET	3778	49332	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:08.521080017 CET	49332	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:08.526391983 CET	3778	49332	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.146224976 CET	3778	49332	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.146351099 CET	49332	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.146351099 CET	49332	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.146724939 CET	49334	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.151585102 CET	3778	49334	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.151632071 CET	49334	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.152273893 CET	49334	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.157073021 CET	3778	49334	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.157119036 CET	49334	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.161969900 CET	3778	49334	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.781122923 CET	3778	49334	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.781387091 CET	49334	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.781387091 CET	49334	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.781842947 CET	49336	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.787178040 CET	3778	49336	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.787230015 CET	49336	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.787902117 CET	49336	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.792707920 CET	3778	49336	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:09.792776108 CET	49336	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:09.797604084 CET	3778	49336	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:10.439546108 CET	3778	49336	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:10.439817905 CET	49336	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:10.439817905 CET	49336	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:10.440222025 CET	49338	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:10.444976091 CET	3778	49338	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:10.445029020 CET	49338	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:10.445683002 CET	49338	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:10.450476885 CET	3778	49338	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:10.450536013 CET	49338	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:10.455332994 CET	3778	49338	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.083961010 CET	3778	49338	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.084130049 CET	49338	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.084130049 CET	49338	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.084439039 CET	49340	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.089315891 CET	3778	49340	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.089417934 CET	49340	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.090027094 CET	49340	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.094851017 CET	3778	49340	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.094913006 CET	49340	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.099733114 CET	3778	49340	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.720519066 CET	3778	49340	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.720756054 CET	49340	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.720839977 CET	49340	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.721379042 CET	49342	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.726259947 CET	3778	49342	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.726314068 CET	49342	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.727003098 CET	49342	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.731770992 CET	3778	49342	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:11.731837988 CET	49342	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:11.736697912 CET	3778	49342	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:12.357403040 CET	3778	49342	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:12.357608080 CET	49342	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:12.357608080 CET	49342	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:12.358170033 CET	49344	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:12.363014936 CET	3778	49344	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:12.363065958 CET	49344	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:12.363993883 CET	49344	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:12.368891954 CET	3778	49344	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:12.368935108 CET	49344	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:12.373761892 CET	3778	49344	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.021612883 CET	3778	49344	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.021707058 CET	49344	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.021764994 CET	49344	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.022324085 CET	49346	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.027163029 CET	3778	49346	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.027255058 CET	49346	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.028228045 CET	49346	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.032994986 CET	3778	49346	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.033041954 CET	49346	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.037883997 CET	3778	49346	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.677011013 CET	3778	49346	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.677217007 CET	49346	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.677217007 CET	49346	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.677687883 CET	49348	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.682504892 CET	3778	49348	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.682559967 CET	49348	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.683428049 CET	49348	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.688242912 CET	3778	49348	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:13.688287020 CET	49348	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:13.693100929 CET	3778	49348	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.324012041 CET	3778	49348	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.324183941 CET	49348	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.324183941 CET	49348	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.324490070 CET	49350	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.329340935 CET	3778	49350	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.329394102 CET	49350	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.330240965 CET	49350	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.335016012 CET	3778	49350	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.335066080 CET	49350	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.339833021 CET	3778	49350	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.962254047 CET	3778	49350	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.962455034 CET	49350	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.962455034 CET	49350	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.962816000 CET	49352	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.967631102 CET	3778	49352	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.967684031 CET	49352	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.968513012 CET	49352	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.973253012 CET	3778	49352	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:14.973298073 CET	49352	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:14.978159904 CET	3778	49352	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:15.623883009 CET	3778	49352	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:15.623985052 CET	49352	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:15.623985052 CET	49352	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:15.624350071 CET	49354	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:15.629154921 CET	3778	49354	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:15.629213095 CET	49354	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:15.629887104 CET	49354	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:15.634648085 CET	3778	49354	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:15.634691954 CET	49354	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:15.639480114 CET	3778	49354	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.257085085 CET	3778	49354	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.257164955 CET	49354	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.257210016 CET	49354	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.257671118 CET	49356	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.262569904 CET	3778	49356	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.262670040 CET	49356	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.263523102 CET	49356	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.268306017 CET	3778	49356	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.268384933 CET	49356	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.273242950 CET	3778	49356	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.893968105 CET	3778	49356	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.894098043 CET	49356	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.894206047 CET	49356	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.894732952 CET	49358	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.899581909 CET	3778	49358	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.899640083 CET	49358	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.900537968 CET	49358	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.905287981 CET	3778	49358	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:16.905334949 CET	49358	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:16.910134077 CET	3778	49358	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:17.539056063 CET	3778	49358	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:17.539115906 CET	49358	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:17.539256096 CET	49358	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:17.539752960 CET	49360	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:17.544609070 CET	3778	49360	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:17.544672012 CET	49360	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:17.545561075 CET	49360	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:17.550388098 CET	3778	49360	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:17.550436974 CET	49360	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:17.555232048 CET	3778	49360	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.200258017 CET	3778	49360	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.200391054 CET	49360	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.200480938 CET	49360	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.201040030 CET	49362	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.205863953 CET	3778	49362	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.205965996 CET	49362	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.206872940 CET	49362	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.211678028 CET	3778	49362	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.211780071 CET	49362	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.216617107 CET	3778	49362	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.836842060 CET	3778	49362	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.836956024 CET	49362	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.837024927 CET	49362	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.837438107 CET	49364	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.842257977 CET	3778	49364	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.842313051 CET	49364	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.842932940 CET	49364	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.847742081 CET	3778	49364	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:18.847783089 CET	49364	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:18.852632046 CET	3778	49364	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:19.488452911 CET	3778	49364	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:19.488569975 CET	49364	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:19.488596916 CET	49364	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:19.488984108 CET	49366	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:19.493793964 CET	3778	49366	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:19.493855953 CET	49366	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:19.494503021 CET	49366	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:19.499428034 CET	3778	49366	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:19.499484062 CET	49366	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:19.504260063 CET	3778	49366	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.152560949 CET	3778	49366	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.152760983 CET	49366	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.152760983 CET	49366	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.153187037 CET	49368	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.158044100 CET	3778	49368	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.158094883 CET	49368	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.158796072 CET	49368	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.163624048 CET	3778	49368	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.163692951 CET	49368	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.168533087 CET	3778	49368	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.792572021 CET	3778	49368	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.792701960 CET	49368	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.792761087 CET	49368	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.793265104 CET	49370	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.798111916 CET	3778	49370	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.798175097 CET	49370	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.799011946 CET	49370	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.803832054 CET	3778	49370	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:20.803877115 CET	49370	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:20.808693886 CET	3778	49370	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:21.447475910 CET	3778	49370	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:21.447566032 CET	49370	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:21.447654963 CET	49370	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:21.448184013 CET	49372	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:21.453008890 CET	3778	49372	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:21.453087091 CET	49372	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:21.453972101 CET	49372	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:21.458734035 CET	3778	49372	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:21.458791018 CET	49372	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:21.463640928 CET	3778	49372	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.099526882 CET	3778	49372	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.099787951 CET	49372	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.099787951 CET	49372	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.100119114 CET	49374	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.104933977 CET	3778	49374	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.104980946 CET	49374	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.105673075 CET	49374	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.110390902 CET	3778	49374	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.110433102 CET	49374	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.115338087 CET	3778	49374	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.748949051 CET	3778	49374	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.748995066 CET	49374	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.749320984 CET	49374	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.749738932 CET	49376	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.754569054 CET	3778	49376	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.754616976 CET	49376	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.755482912 CET	49376	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.760293961 CET	3778	49376	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:22.760330915 CET	49376	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:22.765156031 CET	3778	49376	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:23.409482956 CET	3778	49376	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:23.409535885 CET	49376	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:23.409574986 CET	49376	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:23.410058022 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:23.414829016 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:23.414879084 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:23.416150093 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:23.420916080 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:23.420958042 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:23.425703049 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:33.426487923 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:33.431390047 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:33.613008976 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:33.613276958 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:49:39.355896950 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:49:39.356162071 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:50:39.406548977 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:50:39.411441088 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:50:39.593481064 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:50:39.593697071 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:50:59.576464891 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:50:59.576687098 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:51:49.614542961 CET	49378	3778	192.168.2.13	185.232.205.45
Jan 4, 2025 02:51:49.619406939 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:51:49.801044941 CET	3778	49378	185.232.205.45	192.168.2.13
Jan 4, 2025 02:51:49.801248074 CET	49378	3778	192.168.2.13	185.232.205.45

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 02:49:39.375510931 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375602007 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375638008 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375663042 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375689983 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375719070 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375746965 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375776052 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375804901 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375834942 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375860929 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375890970 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375916958 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375945091 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.375972986 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376003027 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376029015 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376058102 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376085997 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376116991 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376137972 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376171112 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376199007 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376229048 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376260042 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376283884 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376313925 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376341105 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376368999 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376396894 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376429081 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376449108 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376480103 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376507998 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376535892 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376563072 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376590014 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376620054 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376646996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376674891 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376703024 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376729965 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376758099 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376785040 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376808882 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376840115 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376868963 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376897097 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376924992 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376954079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.376981020 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377008915 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377037048 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377063036 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377093077 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377121925 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377150059 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377177000 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377207041 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377233028 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377264023 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377291918 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377319098 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377341986 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377376080 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377403021 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377429962 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377458096 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377484083 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377513885 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377545118 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377571106 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377599001 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377625942 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377652884 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377681971 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377711058 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377739906 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377765894 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377796888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377821922 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377849102 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377878904 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377908945 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377935886 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377962112 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.377990961 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378025055 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378048897 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378076077 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378104925 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378134966 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378155947 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378190041 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378216982 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378249884 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378273010 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378302097 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378331900 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378400087 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378427982 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378457069 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378484964 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378511906 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378540039 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378568888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378597021 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378623962 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378654003 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378679991 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378709078 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378736973 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378766060 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378793001 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378820896 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378848076 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378875971 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378905058 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378932953 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378961086 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.378983974 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379019976 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379030943 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379070997 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379100084 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379127979 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379158020 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379184008 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379209995 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379241943 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379270077 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379297018 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379329920 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379353046 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379381895 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379407883 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379437923 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379470110 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379496098 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379522085 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379548073 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379578114 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379605055 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379635096 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379662991 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379688025 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379717112 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379744053 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379772902 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379801035 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379828930 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379858017 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379887104 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379914045 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379944086 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.379972935 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380001068 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380028009 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380055904 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380083084 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380111933 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380146027 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380170107 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380201101 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380229950 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380248070 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380280972 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380305052 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380337954 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380363941 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380395889 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380419016 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380453110 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380476952 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380506039 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380536079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380563974 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380589962 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380618095 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380650997 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380670071 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380711079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380723000 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380754948 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380784035 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380810976 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380839109 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380868912 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380896091 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380927086 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380953074 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.380979061 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381007910 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381035089 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381063938 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381092072 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381135941 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381165981 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381194115 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381220102 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381248951 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381277084 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381308079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381326914 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381360054 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381390095 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381422997 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381444931 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381473064 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381501913 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381527901 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381556034 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381584883 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381608009 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381639957 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381669044 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381697893 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381726027 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381755114 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381779909 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381808996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381836891 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381865978 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381896019 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381922007 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381949902 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.381975889 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382004023 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382033110 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382061005 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382088900 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382117987 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382147074 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382175922 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382204056 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382231951 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382261038 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382288933 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382314920 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382343054 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382386923 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382414103 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382443905 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382471085 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382498980 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382525921 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382555962 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382581949 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382610083 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382638931 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382664919 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382692099 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382721901 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382751942 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382777929 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382802010 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382833004 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382867098 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382889032 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382916927 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382946014 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.382972956 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383002043 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383030891 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383058071 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383085966 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383112907 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383147955 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383166075 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383202076 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383229971 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383255959 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383285046 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383316994 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383346081 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383371115 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383399010 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383428097 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383459091 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383479118 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383511066 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383538008 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383567095 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383598089 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383622885 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383651018 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383677959 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383677959 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383703947 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383703947 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383730888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383730888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383749962 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383749962 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383774996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383774996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383794069 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383795023 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383819103 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383819103 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383846998 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383846998 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383846998 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383846998 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383846998 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383846998 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383871078 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383871078 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383871078 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383871078 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383871078 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383888960 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383888960 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383888960 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383903980 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383922100 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383922100 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383922100 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383938074 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383938074 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383938074 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383938074 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383960009 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383960009 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383960009 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383986950 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383986950 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383986950 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383986950 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.383986950 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384004116 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384011030 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384011030 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384011030 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384035110 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384035110 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384035110 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384048939 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384048939 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384048939 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384069920 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384069920 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384069920 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384083033 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384083033 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384083033 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384100914 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384100914 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384100914 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384119034 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384119034 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384119034 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384140968 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384140968 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384140968 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384154081 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384154081 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384154081 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384186029 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384186029 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384186029 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384186029 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384186029 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384186029 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384207964 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384207964 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384207964 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384207964 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384217024 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384237051 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384237051 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384237051 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384237051 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384249926 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384249926 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384249926 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384279013 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384279013 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384279013 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384279013 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384279013 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384279013 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384298086 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384298086 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384298086 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384314060 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384315014 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384315014 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384335995 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384335995 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384335995 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384335995 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384351969 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384351969 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384351969 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384371996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384371996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384371996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384371996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384385109 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384385109 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384407043 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384407043 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384407043 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384418011 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384429932 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384429932 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384429932 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384443045 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384443045 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384463072 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384464025 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384464025 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384464025 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384478092 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384478092 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384486914 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384502888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384502888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384502888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384502888 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384517908 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384517908 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384526014 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384526014 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384560108 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384560108 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384560108 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384560108 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384560108 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384560108 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384582996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384582996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384582996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384582996 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384594917 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384637117 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384637117 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384637117 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384637117 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384637117 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384661913 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384661913 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384661913 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384661913 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384679079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384679079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384679079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384679079 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384720087 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384721041 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384721041 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384721041 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384721041 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384738922 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384738922 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384746075 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384754896 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:49:39.384754896 CET	10494	52144	192.168.2.13	91.196.125.252
Jan 4, 2025 02:51:39.428561926 CET	52699	53	192.168.2.13	1.1.1.1
Jan 4, 2025 02:51:39.428610086 CET	49761	53	192.168.2.13	1.1.1.1
Jan 4, 2025 02:51:39.435683966 CET	53	49761	1.1.1.1	192.168.2.13
Jan 4, 2025 02:51:39.435784101 CET	53	52699	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 02:51:39.428561926 CET	192.168.2.13	1.1.1.1	0x1109	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 02:51:39.428610086 CET	192.168.2.13	1.1.1.1	0x8bfd	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 02:51:39.435784101 CET	1.1.1.1	192.168.2.13	0x1109	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 4, 2025 02:51:39.435784101 CET	1.1.1.1	192.168.2.13	0x1109	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, Parent PID: 5354

General

Start time (UTC):	01:48:50
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5431, Parent PID: 5429

General

Start time (UTC):	01:48:50
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, Parent PID: 5429

General

Start time (UTC):	01:48:50
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5434, Parent PID: 5429

General

Start time (UTC):	01:48:50
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, Parent PID: 5434

General

Start time (UTC):	01:49:38
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, Parent PID: 5502

General

Start time (UTC):	01:49:38
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5545, Parent PID: 5434

General

Start time (UTC):	01:50:58
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5547, Parent PID: 5545

General

Start time (UTC):	01:50:58
Start date (UTC):	04/01/2025
Path:	/tmp/185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: xfce4-panel PID: 5439, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5439, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5440, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5440, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5441, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5441, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5442, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5442, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5443, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5443, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5444, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5444, Parent PID: 3147

General

Start time (UTC):	01:48:51
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: dbus-daemon PID: 5454, Parent PID: 5453

General

Start time (UTC):	01:48:54
Start date (UTC):	04/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 5454, Parent PID: 5453

General

Start time (UTC):	01:48:54
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: dbus-daemon PID: 5456, Parent PID: 5455

General

Start time (UTC):	01:48:54
Start date (UTC):	04/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 5456, Parent PID: 5455

General

Start time (UTC):	01:48:54
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: systemd PID: 5460, Parent PID: 2935

General

Start time (UTC):	01:48:56
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: xfce4-notifyd PID: 5460, Parent PID: 2935

General

Start time (UTC):	01:48:56
Start date (UTC):	04/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5429, Parent PID: 5354

General

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5431, Parent PID: 5429

General

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5432, Parent PID: 5429

General

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5434, Parent PID: 5429

General

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5502, Parent PID: 5434

General

Chronological Activities

Analysis Process: 185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf PID: 5504, Parent PID: 5502

Linux Analysis Report
185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf