Edit tour

Linux Analysis Report
Space.ppc.elf

Overview

General Information

Sample name:	Space.ppc.elf
Analysis ID:	1584218
MD5:	de88799d1ab49f7164548fd63e38dc26
SHA1:	490ec5aa292c9a1a9964e36a8d29eeb8b5ee35b5
SHA256:	962ee21c4e79d3941e0e09608b670972fa0df51bea976a9e4e0348eea5446c26
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584218
Start date and time:	2025-01-04 21:22:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.ppc.elf
Detection:	MAL
Classification:	mal76.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.ppc.elf
PID:	6234
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.ppc.elf (PID: 6234, Parent: 6152, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/Space.ppc.elf

Space.ppc.elf New Fork (PID: 6236, Parent: 6234)

Space.ppc.elf New Fork (PID: 6238, Parent: 6236)

Space.ppc.elf New Fork (PID: 6239, Parent: 6236)

Space.ppc.elf New Fork (PID: 6249, Parent: 6234)

Space.ppc.elf New Fork (PID: 6251, Parent: 6234)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6249.1.00007f20a4005000.00007f20a4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb54c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb59c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb63c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb68c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6236.1.00007f20a400f000.00007f20a4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.00007f20a400f000.00007f20a4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6234.1.00007f20a4005000.00007f20a4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb54c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb59c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb63c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb68c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.ppc.elf PID: 6236	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.ppc.elf PID: 6236	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x396b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x397f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3993:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3aab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3abf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ad3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ae7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3afb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.ppc.elf PID: 6238	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.ppc.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfa44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfabc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.ppc.elf PID: 6249	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Space.ppc.elf PID: 6249	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xade:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Space.ppc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Space.ppc.elf	Virustotal: Detection: 46%			Perma Link
Source: Space.ppc.elf	ReversingLabs: Detection: 42%

Source: global traffic

TCP traffic: 192.168.2.23:47580 -> 79.133.46.252:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252
Source: unknown	TCP traffic detected without corresponding DNS query: 79.133.46.252

Source: Space.ppc.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6249.1.00007f20a4005000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.00007f20a400f000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.00007f20a400f000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6234.1.00007f20a4005000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.ppc.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.ppc.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.ppc.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x100000

Source: 6249.1.00007f20a4005000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.00007f20a400f000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.00007f20a400f000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6234.1.00007f20a4005000.00007f20a4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.ppc.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.ppc.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.ppc.elf PID: 6249, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/6234/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/6246/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/6239/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/4507/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/Space.ppc.elf (PID: 6234)	File opened: /proc/1494/status	Jump to behavior

Source: Space.ppc.elf

Submission file: segment LOAD with 7.9566 entropy (max. 8.0)

Source: /tmp/Space.ppc.elf (PID: 6234)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.ppc.elf, 6236.1.000055a85f678000.000055a85f728000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: Space.ppc.elf, 6234.1.000055a85f678000.000055a85f749000.rw-.sdmp, Space.ppc.elf, 6238.1.000055a85f678000.000055a85f728000.rw-.sdmp, Space.ppc.elf, 6249.1.000055a85f678000.000055a85f749000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: Space.ppc.elf, 6234.1.000055a85f678000.000055a85f749000.rw-.sdmp, Space.ppc.elf, 6236.1.000055a85f678000.000055a85f728000.rw-.sdmp, Space.ppc.elf, 6238.1.000055a85f678000.000055a85f728000.rw-.sdmp, Space.ppc.elf, 6249.1.000055a85f678000.000055a85f749000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: Space.ppc.elf, 6234.1.00007fff28d96000.00007fff28db7000.rw-.sdmp, Space.ppc.elf, 6236.1.00007fff28d96000.00007fff28db7000.rw-.sdmp, Space.ppc.elf, 6238.1.00007fff28d96000.00007fff28db7000.rw-.sdmp, Space.ppc.elf, 6249.1.00007fff28d96000.00007fff28db7000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: Space.ppc.elf, 6234.1.00007fff28d96000.00007fff28db7000.rw-.sdmp, Space.ppc.elf, 6236.1.00007fff28d96000.00007fff28db7000.rw-.sdmp, Space.ppc.elf, 6238.1.00007fff28d96000.00007fff28db7000.rw-.sdmp, Space.ppc.elf, 6249.1.00007fff28d96000.00007fff28db7000.rw-.sdmp	Binary or memory string: zox86_64/usr/bin/qemu-ppc/tmp/Space.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.ppc.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: Space.ppc.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.ppc.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.ppc.elf PID: 6249, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: Space.ppc.elf PID: 6236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.ppc.elf PID: 6238, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Space.ppc.elf PID: 6249, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.ppc.elf	46%	Virustotal		Browse
Space.ppc.elf	42%	ReversingLabs	Linux.Trojan.Mirai
Space.ppc.elf	100%	Avira	EXP/ELF.Agent.F.118

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.ppc.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
79.133.46.252	unknown	Germany	203833	AT-FIRSTCOLOAustriaAT	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
79.133.46.252	Space.mpsl.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.mpsl
	Space.x86.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.x86
	Space.mips.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.mips
	Space.arm7.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.arm7
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	/hiddenbin/Space.arm6
91.189.91.43	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	main.arm.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	main.arm.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
AT-FIRSTCOLOAustriaAT	Space.mpsl.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.x86.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.mips.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.arm7.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	79.133.46.252
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	79.133.33.157
	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Get hash	malicious	Unknown	Browse	159.100.29.29
	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Get hash	malicious	Unknown	Browse	159.100.29.29
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	YIztve8dU8.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
INIT7CH	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.953826699350604
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.ppc.elf
File size:	35'140 bytes
MD5:	de88799d1ab49f7164548fd63e38dc26
SHA1:	490ec5aa292c9a1a9964e36a8d29eeb8b5ee35b5
SHA256:	962ee21c4e79d3941e0e09608b670972fa0df51bea976a9e4e0348eea5446c26
SHA512:	48b643774da14b0dc37b5682fa354ed9c9a5c3419651a5ed3f83c67e5bd0502c061ccb7db9700c235dd8367dfe9033bdcaf31bfe999ee867794253c76c5e2d3c
SSDEEP:	768:seDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2bj/hB2zs/ey4uVcqgw09f:sCRocD0Lu/PWUWr/iuo1gzny4u+qgw0V
TLSH:	F5F2E075C59D4FD2ED9D9EB5269193EABFEC1E4F17108C6322018F90D7024018ADEAE6
File Content Preview:	.ELF......................v`...4.........4. ...(.......................H...H..............I...I...I.................dt.Q................................UPX!..........%...%........V.......?.E.h4...@b..............i...[.Q.........4+j..xUs.].......6....)....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x107660
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x8848	0x8848	7.9566	0x5	R E	0x10000
LOAD	0x49a4	0x100249a4	0x100249a4	0x0	0x0	0.0000	0x6	RW	0x10000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 21:22:48.359462023 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:48.364303112 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:48.364352942 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:48.396287918 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:48.401098967 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:48.401151896 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:48.405935049 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.016017914 CET	3778	47580	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.016092062 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.016311884 CET	47580	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.016674995 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.021424055 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.021480083 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.022161961 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.026875019 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.026937008 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.031693935 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.679135084 CET	3778	47582	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.679436922 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.679436922 CET	47582	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.679940939 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.684698105 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.684748888 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.685631990 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.690375090 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:49.690448046 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:49.695233107 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.334383965 CET	3778	47584	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.334697962 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.340738058 CET	47584	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.341073990 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.345858097 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.345904112 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.346518040 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.351294994 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.351353884 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.356107950 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.972405910 CET	3778	47586	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.972651005 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.972651005 CET	47586	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.973051071 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.977826118 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.977874041 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.978559017 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.983295918 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:50.983356953 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:50.988135099 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:51.144716024 CET	43928	443	192.168.2.23	91.189.91.42
Jan 4, 2025 21:22:51.612706900 CET	3778	47588	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:51.613085032 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:51.613085032 CET	47588	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:51.613611937 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:51.618333101 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:51.618382931 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:51.619079113 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:51.623830080 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:51.623908997 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:51.628699064 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.257302046 CET	3778	47590	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.257596016 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.257596016 CET	47590	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.257972956 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.262738943 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.262785912 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.263515949 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.268935919 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.268996000 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.273715019 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.899627924 CET	3778	47592	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.899744034 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.899780035 CET	47592	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.900198936 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.905014992 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.905070066 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.905759096 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.910480022 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:52.910540104 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:52.915344000 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:53.526727915 CET	3778	47594	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:53.526982069 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.526983023 CET	47594	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.527405024 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.532316923 CET	3778	47596	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:53.532365084 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.533072948 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.537864923 CET	3778	47596	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:53.537925005 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.542772055 CET	3778	47596	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:53.912607908 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.917613029 CET	3778	47598	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:53.917686939 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.945421934 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.950225115 CET	3778	47598	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:53.950269938 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:53.955039978 CET	3778	47598	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.186774969 CET	3778	47596	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.186867952 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.186897039 CET	47596	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.187277079 CET	47600	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.192065001 CET	3778	47600	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.192120075 CET	47600	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.192819118 CET	47600	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.197604895 CET	3778	47600	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.197668076 CET	47600	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.202450991 CET	3778	47600	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.656291962 CET	3778	47598	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.656476021 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.656529903 CET	47598	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.656950951 CET	47602	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.661731005 CET	3778	47602	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.661780119 CET	47602	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.662525892 CET	47602	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.668761015 CET	3778	47602	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.668818951 CET	47602	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.673693895 CET	3778	47602	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.933315992 CET	3778	47600	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.933556080 CET	47600	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.933556080 CET	47600	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.934029102 CET	47604	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.938915014 CET	3778	47604	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.938967943 CET	47604	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.939809084 CET	47604	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.944534063 CET	3778	47604	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:54.944607973 CET	47604	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:54.949548006 CET	3778	47604	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.306613922 CET	3778	47602	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.306803942 CET	47602	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.306803942 CET	47602	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.307179928 CET	47606	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.312007904 CET	3778	47606	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.312064886 CET	47606	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.312756062 CET	47606	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.317567110 CET	3778	47606	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.317635059 CET	47606	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.322443008 CET	3778	47606	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.579916000 CET	3778	47604	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.580107927 CET	47604	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.580107927 CET	47604	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.580410004 CET	47608	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.585220098 CET	3778	47608	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.585278034 CET	47608	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.585964918 CET	47608	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.590682983 CET	3778	47608	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.590749979 CET	47608	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.595551014 CET	3778	47608	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.964473963 CET	3778	47606	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.964663029 CET	47606	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.964663029 CET	47606	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.965008020 CET	47610	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.969825029 CET	3778	47610	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.969877005 CET	47610	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.970561028 CET	47610	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.975327969 CET	3778	47610	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:55.975389004 CET	47610	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:55.980115891 CET	3778	47610	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.223115921 CET	3778	47608	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.223197937 CET	47608	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.223197937 CET	47608	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.223607063 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.228974104 CET	3778	47612	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.229026079 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.229720116 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.234481096 CET	3778	47612	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.234544039 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.239280939 CET	3778	47612	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.594803095 CET	3778	47610	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.595000982 CET	47610	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.595000982 CET	47610	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.595279932 CET	47614	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.600014925 CET	3778	47614	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.600068092 CET	47614	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.600753069 CET	47614	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.605458975 CET	3778	47614	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.605525017 CET	47614	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:56.610301971 CET	3778	47614	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:56.775933027 CET	42836	443	192.168.2.23	91.189.91.43
Jan 4, 2025 21:22:57.230622053 CET	3778	47614	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:57.230828047 CET	47614	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.230861902 CET	47614	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.231317997 CET	47616	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.236148119 CET	3778	47616	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:57.236202002 CET	47616	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.236922026 CET	47616	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.241669893 CET	3778	47616	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:57.241739035 CET	47616	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.246474028 CET	3778	47616	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:57.894113064 CET	3778	47616	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:57.894218922 CET	47616	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.894218922 CET	47616	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.894651890 CET	47618	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.899415016 CET	3778	47618	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:57.899468899 CET	47618	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.900172949 CET	47618	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.905009985 CET	3778	47618	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:57.905071974 CET	47618	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:57.909842014 CET	3778	47618	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:58.055732012 CET	42516	80	192.168.2.23	109.202.202.202
Jan 4, 2025 21:22:58.532407045 CET	3778	47618	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:58.532583952 CET	47618	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:58.532583952 CET	47618	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:58.532938004 CET	47620	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:58.537707090 CET	3778	47620	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:58.537760973 CET	47620	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:58.538438082 CET	47620	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:58.543183088 CET	3778	47620	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:58.543262959 CET	47620	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:58.548057079 CET	3778	47620	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.270195007 CET	3778	47620	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.270420074 CET	47620	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.270420074 CET	47620	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.270893097 CET	47622	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.275733948 CET	3778	47622	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.275789976 CET	47622	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.276510954 CET	47622	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.281300068 CET	3778	47622	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.281359911 CET	47622	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.286113977 CET	3778	47622	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.903987885 CET	3778	47622	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.904109955 CET	47622	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.904196024 CET	47622	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.904593945 CET	47624	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.909360886 CET	3778	47624	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.909414053 CET	47624	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.910109043 CET	47624	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.914840937 CET	3778	47624	79.133.46.252	192.168.2.23
Jan 4, 2025 21:22:59.914917946 CET	47624	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:22:59.919740915 CET	3778	47624	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:00.557245970 CET	3778	47624	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:00.557451963 CET	47624	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:00.557451963 CET	47624	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:00.558005095 CET	47626	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:00.562783003 CET	3778	47626	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:00.562870979 CET	47626	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:00.563853979 CET	47626	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:00.568641901 CET	3778	47626	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:00.568705082 CET	47626	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:00.573472977 CET	3778	47626	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.203838110 CET	3778	47626	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.204058886 CET	47626	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.204085112 CET	47626	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.204533100 CET	47628	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.209280968 CET	3778	47628	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.209341049 CET	47628	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.210328102 CET	47628	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.215133905 CET	3778	47628	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.215208054 CET	47628	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.219994068 CET	3778	47628	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.870471001 CET	3778	47628	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.870851994 CET	47628	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.870852947 CET	47628	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.871583939 CET	47630	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.876359940 CET	3778	47630	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.876450062 CET	47630	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.877460003 CET	47630	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.882188082 CET	3778	47630	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:01.882252932 CET	47630	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:01.887048960 CET	3778	47630	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:02.523232937 CET	3778	47630	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:02.523444891 CET	47630	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:02.523444891 CET	47630	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:02.524152040 CET	47632	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:02.530491114 CET	3778	47632	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:02.530584097 CET	47632	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:02.531586885 CET	47632	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:02.537630081 CET	3778	47632	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:02.537695885 CET	47632	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:02.543265104 CET	3778	47632	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.188877106 CET	3778	47632	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.189095974 CET	47632	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.189131975 CET	47632	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.189666033 CET	47634	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.195127964 CET	3778	47634	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.195174932 CET	47634	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.195807934 CET	47634	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.201165915 CET	3778	47634	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.201209068 CET	47634	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.206531048 CET	3778	47634	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.825865030 CET	3778	47634	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.826055050 CET	47634	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.826266050 CET	47634	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.826910973 CET	47636	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.831751108 CET	3778	47636	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.831852913 CET	47636	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.832742929 CET	47636	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.837552071 CET	3778	47636	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:03.837620020 CET	47636	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:03.842381001 CET	3778	47636	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:04.495893955 CET	3778	47636	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:04.496346951 CET	47636	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:04.496483088 CET	47636	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:04.497292042 CET	47638	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:04.502893925 CET	3778	47638	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:04.502974987 CET	47638	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:04.504079103 CET	47638	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:04.509643078 CET	3778	47638	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:04.509716988 CET	47638	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:04.515738010 CET	3778	47638	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.191240072 CET	3778	47638	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.191517115 CET	47638	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.191699028 CET	47638	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.192512035 CET	47640	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.197310925 CET	3778	47640	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.197381973 CET	47640	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.198487997 CET	47640	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.203226089 CET	3778	47640	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.203284025 CET	47640	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.208095074 CET	3778	47640	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.832088947 CET	3778	47640	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.832295895 CET	47640	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.832297087 CET	47640	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.832906961 CET	47642	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.837646008 CET	3778	47642	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.837694883 CET	47642	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.838599920 CET	47642	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.843311071 CET	3778	47642	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:05.843374968 CET	47642	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:05.848126888 CET	3778	47642	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:06.238466978 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.243309975 CET	3778	47612	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:06.436409950 CET	3778	47612	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:06.436615944 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.478562117 CET	3778	47642	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:06.478646040 CET	47642	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.478693962 CET	47642	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.479281902 CET	47644	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.484071970 CET	3778	47644	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:06.484122038 CET	47644	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.484993935 CET	47644	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.489741087 CET	3778	47644	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:06.489803076 CET	47644	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:06.494538069 CET	3778	47644	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.112289906 CET	3778	47644	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.112478971 CET	47644	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.112478971 CET	47644	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.113013983 CET	47646	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.117844105 CET	3778	47646	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.117891073 CET	47646	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.118753910 CET	47646	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.123589993 CET	3778	47646	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.123656034 CET	47646	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.128417969 CET	3778	47646	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.753237009 CET	3778	47646	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.753488064 CET	47646	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.753488064 CET	47646	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.754163980 CET	47648	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.758966923 CET	3778	47648	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.759047031 CET	47648	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.759994984 CET	47648	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.764717102 CET	3778	47648	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:07.764823914 CET	47648	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:07.769566059 CET	3778	47648	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:08.440807104 CET	3778	47648	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:08.441099882 CET	47648	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:08.441287041 CET	47648	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:08.441936970 CET	47650	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:08.446727991 CET	3778	47650	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:08.446808100 CET	47650	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:08.447856903 CET	47650	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:08.452634096 CET	3778	47650	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:08.452739000 CET	47650	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:08.457545042 CET	3778	47650	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.088224888 CET	3778	47650	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.088582039 CET	47650	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.088718891 CET	47650	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.089382887 CET	47652	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.103585005 CET	3778	47652	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.103719950 CET	47652	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.104712009 CET	47652	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.110347986 CET	3778	47652	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.110410929 CET	47652	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.116091967 CET	3778	47652	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.759664059 CET	3778	47652	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.760035038 CET	47652	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.760035038 CET	47652	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.760709047 CET	47654	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.765494108 CET	3778	47654	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.765575886 CET	47654	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.766371965 CET	47654	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.771097898 CET	3778	47654	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:09.771162987 CET	47654	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:09.776110888 CET	3778	47654	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:10.494119883 CET	3778	47654	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:10.494326115 CET	47654	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:10.494411945 CET	47654	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:10.495183945 CET	47656	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:10.499953985 CET	3778	47656	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:10.500094891 CET	47656	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:10.501058102 CET	47656	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:10.506043911 CET	3778	47656	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:10.506108999 CET	47656	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:10.511037111 CET	3778	47656	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.137938976 CET	3778	47656	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.138087034 CET	47656	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.138144016 CET	47656	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.138804913 CET	47658	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.143537998 CET	3778	47658	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.143619061 CET	47658	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.144699097 CET	47658	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.149435043 CET	3778	47658	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.149496078 CET	47658	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.154376984 CET	3778	47658	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.787738085 CET	3778	47658	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.788074017 CET	47658	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.788074017 CET	47658	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.788712025 CET	47660	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.793550014 CET	3778	47660	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.793606997 CET	47660	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.794194937 CET	47660	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.798913002 CET	3778	47660	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:11.798962116 CET	47660	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:11.803699017 CET	3778	47660	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:12.133713007 CET	43928	443	192.168.2.23	91.189.91.42
Jan 4, 2025 21:23:12.436677933 CET	3778	47660	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:12.436852932 CET	47660	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:12.437001944 CET	47660	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:12.437663078 CET	47662	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:12.442440033 CET	3778	47662	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:12.442527056 CET	47662	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:12.443588972 CET	47662	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:12.448421001 CET	3778	47662	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:12.448486090 CET	47662	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:12.453227043 CET	3778	47662	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.071345091 CET	3778	47662	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.071677923 CET	47662	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.071973085 CET	47662	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.072761059 CET	47664	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.077621937 CET	3778	47664	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.077699900 CET	47664	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.078912973 CET	47664	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.083718061 CET	3778	47664	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.083780050 CET	47664	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.088577986 CET	3778	47664	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.701880932 CET	3778	47664	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.702178001 CET	47664	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.702203035 CET	47664	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.702878952 CET	47666	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.707645893 CET	3778	47666	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.707720995 CET	47666	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.708807945 CET	47666	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.713587999 CET	3778	47666	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:13.713644981 CET	47666	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:13.718476057 CET	3778	47666	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:14.343353987 CET	3778	47666	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:14.343617916 CET	47666	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:14.343663931 CET	47666	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:14.344450951 CET	47668	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:14.349195957 CET	3778	47668	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:14.349272013 CET	47668	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:14.350408077 CET	47668	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:14.355164051 CET	3778	47668	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:14.355225086 CET	47668	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:14.360029936 CET	3778	47668	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.091623068 CET	3778	47668	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.091851950 CET	47668	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.091932058 CET	47668	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.092648029 CET	47670	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.097480059 CET	3778	47670	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.097549915 CET	47670	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.098668098 CET	47670	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.103471041 CET	3778	47670	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.103530884 CET	47670	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.108236074 CET	3778	47670	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.735680103 CET	3778	47670	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.736088991 CET	47670	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.736152887 CET	47670	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.736849070 CET	47672	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.742714882 CET	3778	47672	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.742786884 CET	47672	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.743843079 CET	47672	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.749412060 CET	3778	47672	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:15.749469995 CET	47672	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:15.754380941 CET	3778	47672	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:16.405742884 CET	3778	47672	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:16.406058073 CET	47672	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:16.406272888 CET	47672	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:16.407054901 CET	47674	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:16.411830902 CET	3778	47674	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:16.411906958 CET	47674	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:16.412995100 CET	47674	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:16.417701960 CET	3778	47674	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:16.417769909 CET	47674	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:16.422530890 CET	3778	47674	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.030277014 CET	3778	47674	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.030544043 CET	47674	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.030706882 CET	47674	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.031258106 CET	47676	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.036184072 CET	3778	47676	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.036256075 CET	47676	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.037317991 CET	47676	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.042129040 CET	3778	47676	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.042206049 CET	47676	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.047096968 CET	3778	47676	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.666688919 CET	3778	47676	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.666939020 CET	47676	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.666939020 CET	47676	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.667613029 CET	47678	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.672403097 CET	3778	47678	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.672477007 CET	47678	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.673615932 CET	47678	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.680340052 CET	3778	47678	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:17.680404902 CET	47678	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:17.685131073 CET	3778	47678	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.322365046 CET	3778	47678	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.322638035 CET	47678	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.322638035 CET	47678	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.323210955 CET	47680	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.328142881 CET	3778	47680	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.328213930 CET	47680	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.329147100 CET	47680	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.333950996 CET	3778	47680	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.333997011 CET	47680	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.338766098 CET	3778	47680	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.964956045 CET	3778	47680	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.965068102 CET	47680	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.965306044 CET	47680	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.965795994 CET	47682	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.970629930 CET	3778	47682	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.970732927 CET	47682	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.971841097 CET	47682	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.981647015 CET	3778	47682	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:18.981729031 CET	47682	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:18.986547947 CET	3778	47682	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:19.615544081 CET	3778	47682	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:19.615784883 CET	47682	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:19.615891933 CET	47682	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:19.616445065 CET	47684	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:19.621246099 CET	3778	47684	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:19.621301889 CET	47684	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:19.622235060 CET	47684	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:19.626969099 CET	3778	47684	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:19.627034903 CET	47684	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:19.631817102 CET	3778	47684	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:20.286721945 CET	3778	47684	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:20.286984921 CET	47684	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:20.287219048 CET	47684	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:20.287787914 CET	47686	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:20.292531967 CET	3778	47686	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:20.292617083 CET	47686	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:20.293705940 CET	47686	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:20.298523903 CET	3778	47686	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:20.298583031 CET	47686	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:20.303368092 CET	3778	47686	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.055675030 CET	3778	47686	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.055850983 CET	47686	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.056054115 CET	47686	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.056648016 CET	47688	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.061443090 CET	3778	47688	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.061527967 CET	47688	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.062596083 CET	47688	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.067305088 CET	3778	47688	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.067367077 CET	47688	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.072139025 CET	3778	47688	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.701008081 CET	3778	47688	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.701200008 CET	47688	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.701267958 CET	47688	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.702214956 CET	47690	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.706999063 CET	3778	47690	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.707087994 CET	47690	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.708168983 CET	47690	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.712943077 CET	3778	47690	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:21.713006020 CET	47690	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:21.717777014 CET	3778	47690	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:22.341931105 CET	3778	47690	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:22.342128038 CET	47690	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.342381001 CET	47690	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.343105078 CET	47692	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.347886086 CET	3778	47692	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:22.347975016 CET	47692	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.349140882 CET	47692	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.353883982 CET	3778	47692	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:22.353945971 CET	47692	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.358675957 CET	3778	47692	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:22.372339964 CET	42836	443	192.168.2.23	91.189.91.43
Jan 4, 2025 21:23:22.998377085 CET	3778	47692	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:22.998667002 CET	47692	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.998832941 CET	47692	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:22.999548912 CET	47694	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.004304886 CET	3778	47694	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:23.004381895 CET	47694	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.005290985 CET	47694	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.010029078 CET	3778	47694	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:23.010097027 CET	47694	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.014924049 CET	3778	47694	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:23.645219088 CET	3778	47694	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:23.645381927 CET	47694	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.645601034 CET	47694	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.646083117 CET	47696	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.651057959 CET	3778	47696	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:23.651156902 CET	47696	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.652220964 CET	47696	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.656975985 CET	3778	47696	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:23.657037973 CET	47696	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:23.661835909 CET	3778	47696	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:24.336497068 CET	3778	47696	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:24.336877108 CET	47696	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:24.336877108 CET	47696	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:24.337692976 CET	47698	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:24.342461109 CET	3778	47698	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:24.342535973 CET	47698	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:24.343611002 CET	47698	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:24.348330975 CET	3778	47698	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:24.348393917 CET	47698	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:24.353183985 CET	3778	47698	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.006335974 CET	3778	47698	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.006737947 CET	47698	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.006771088 CET	47698	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.007534027 CET	47700	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.012317896 CET	3778	47700	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.012388945 CET	47700	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.013514042 CET	47700	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.018222094 CET	3778	47700	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.018297911 CET	47700	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.023163080 CET	3778	47700	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.633239985 CET	3778	47700	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.633527040 CET	47700	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.633527040 CET	47700	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.634227037 CET	47702	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.638983011 CET	3778	47702	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.639034986 CET	47702	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.639936924 CET	47702	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.644692898 CET	3778	47702	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:25.644747972 CET	47702	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:25.649607897 CET	3778	47702	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:26.353385925 CET	3778	47702	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:26.353589058 CET	47702	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:26.353589058 CET	47702	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:26.354084015 CET	47704	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:26.358854055 CET	3778	47704	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:26.358926058 CET	47704	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:26.359927893 CET	47704	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:26.364707947 CET	3778	47704	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:26.364788055 CET	47704	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:26.369610071 CET	3778	47704	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.012581110 CET	3778	47704	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.012752056 CET	47704	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.012752056 CET	47704	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.013104916 CET	47706	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.017858982 CET	3778	47706	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.017906904 CET	47706	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.018588066 CET	47706	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.023340940 CET	3778	47706	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.023400068 CET	47706	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.028209925 CET	3778	47706	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.674777031 CET	3778	47706	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.675024986 CET	47706	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.675024986 CET	47706	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.675647974 CET	47708	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.682312965 CET	3778	47708	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.682384968 CET	47708	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.683298111 CET	47708	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.689862013 CET	3778	47708	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:27.689924955 CET	47708	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:27.696605921 CET	3778	47708	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:28.515458107 CET	42516	80	192.168.2.23	109.202.202.202
Jan 4, 2025 21:23:28.628634930 CET	3778	47708	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:28.628818035 CET	47708	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:28.628818035 CET	47708	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:28.629323959 CET	47710	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:28.634713888 CET	3778	47710	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:28.634757996 CET	47710	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:28.635539055 CET	47710	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:28.640316963 CET	3778	47710	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:28.640357018 CET	47710	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:28.645185947 CET	3778	47710	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.277614117 CET	3778	47710	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.277726889 CET	47710	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.277726889 CET	47710	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.278153896 CET	47712	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.283782005 CET	3778	47712	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.283848047 CET	47712	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.284540892 CET	47712	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.290720940 CET	3778	47712	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.290777922 CET	47712	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.296320915 CET	3778	47712	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.938431025 CET	3778	47712	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.938519955 CET	47712	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.938539028 CET	47712	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.938994884 CET	47714	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.950747967 CET	3778	47714	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.950809002 CET	47714	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.951595068 CET	47714	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.957812071 CET	3778	47714	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:29.957870960 CET	47714	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:29.963447094 CET	3778	47714	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:30.582726002 CET	3778	47714	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:30.582833052 CET	47714	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:30.582833052 CET	47714	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:30.583242893 CET	47716	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:30.588079929 CET	3778	47716	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:30.588130951 CET	47716	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:30.588876009 CET	47716	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:30.593653917 CET	3778	47716	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:30.593730927 CET	47716	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:30.598503113 CET	3778	47716	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.233304024 CET	3778	47716	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.233515978 CET	47716	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.233515978 CET	47716	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.233971119 CET	47718	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.238693953 CET	3778	47718	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.238749027 CET	47718	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.239509106 CET	47718	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.244240046 CET	3778	47718	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.244288921 CET	47718	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.249070883 CET	3778	47718	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.895574093 CET	3778	47718	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.895714045 CET	47718	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.895803928 CET	47718	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.896332979 CET	47720	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.901122093 CET	3778	47720	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.901177883 CET	47720	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.902179956 CET	47720	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.906899929 CET	3778	47720	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:31.906961918 CET	47720	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:31.911734104 CET	3778	47720	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:32.602371931 CET	3778	47720	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:32.602714062 CET	47720	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:32.602714062 CET	47720	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:32.603156090 CET	47722	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:32.607953072 CET	3778	47722	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:32.608052969 CET	47722	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:32.608871937 CET	47722	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:32.613626003 CET	3778	47722	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:32.613684893 CET	47722	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:32.618534088 CET	3778	47722	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:36.359776020 CET	3778	47722	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:36.360284090 CET	47722	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:36.360284090 CET	47722	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:36.360831022 CET	47724	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:36.365602970 CET	3778	47724	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:36.365684032 CET	47724	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:36.366534948 CET	47724	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:36.371272087 CET	3778	47724	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:36.371350050 CET	47724	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:36.376085997 CET	3778	47724	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.026451111 CET	3778	47724	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.026719093 CET	47724	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.026719093 CET	47724	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.027266026 CET	47726	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.032005072 CET	3778	47726	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.032089949 CET	47726	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.032968044 CET	47726	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.037686110 CET	3778	47726	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.037772894 CET	47726	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.042579889 CET	3778	47726	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.796458006 CET	3778	47726	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.796578884 CET	47726	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.796580076 CET	47726	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.796972990 CET	47728	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.801851034 CET	3778	47728	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.801928997 CET	47728	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.802556992 CET	47728	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.807322979 CET	3778	47728	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:37.807373047 CET	47728	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:37.812112093 CET	3778	47728	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:38.448923111 CET	3778	47728	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:38.449048996 CET	47728	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:38.449048996 CET	47728	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:38.449599981 CET	47730	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:38.454370975 CET	3778	47730	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:38.454431057 CET	47730	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:38.455285072 CET	47730	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:38.460107088 CET	3778	47730	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:38.460174084 CET	47730	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:38.464941978 CET	3778	47730	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.083406925 CET	3778	47730	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.083553076 CET	47730	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.083705902 CET	47730	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.084196091 CET	47732	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.088996887 CET	3778	47732	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.089045048 CET	47732	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.089945078 CET	47732	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.094718933 CET	3778	47732	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.094780922 CET	47732	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.099550009 CET	3778	47732	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.800616026 CET	3778	47732	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.800704002 CET	47732	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.800704002 CET	47732	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.801367998 CET	47734	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.806124926 CET	3778	47734	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.806185961 CET	47734	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.807064056 CET	47734	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.811862946 CET	3778	47734	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:39.811908007 CET	47734	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:39.816616058 CET	3778	47734	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:40.454088926 CET	3778	47734	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:40.454174042 CET	47734	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:40.454191923 CET	47734	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:40.454735041 CET	47736	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:40.459557056 CET	3778	47736	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:40.459615946 CET	47736	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:40.460453033 CET	47736	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:40.465207100 CET	3778	47736	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:40.465274096 CET	47736	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:40.470029116 CET	3778	47736	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.112499952 CET	3778	47736	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.112781048 CET	47736	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.112781048 CET	47736	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.113081932 CET	47738	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.117803097 CET	3778	47738	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.117849112 CET	47738	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.118488073 CET	47738	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.123260975 CET	3778	47738	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.123327017 CET	47738	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.128077030 CET	3778	47738	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.745625019 CET	3778	47738	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.745817900 CET	47738	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.745817900 CET	47738	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.746227980 CET	47740	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.750998974 CET	3778	47740	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.751044989 CET	47740	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.751779079 CET	47740	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.756532907 CET	3778	47740	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:41.756593943 CET	47740	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:41.761343002 CET	3778	47740	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:42.416302919 CET	3778	47740	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:42.416491985 CET	47740	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:42.416554928 CET	47740	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:42.417141914 CET	47742	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:42.421906948 CET	3778	47742	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:42.421952963 CET	47742	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:42.422827005 CET	47742	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:42.427566051 CET	3778	47742	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:42.427611113 CET	47742	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:42.432485104 CET	3778	47742	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:43.067137957 CET	3778	47742	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:43.067333937 CET	47742	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:43.067333937 CET	47742	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:43.067799091 CET	47744	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:43.072535992 CET	3778	47744	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:43.072582006 CET	47744	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:43.073458910 CET	47744	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:43.078227043 CET	3778	47744	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:43.078270912 CET	47744	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:43.083060026 CET	3778	47744	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:53.082442999 CET	47744	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:23:53.087332010 CET	3778	47744	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:53.087960958 CET	43928	443	192.168.2.23	91.189.91.42
Jan 4, 2025 21:23:53.276098967 CET	3778	47744	79.133.46.252	192.168.2.23
Jan 4, 2025 21:23:53.276190042 CET	47744	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:24:06.465239048 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:24:06.470175028 CET	3778	47612	79.133.46.252	192.168.2.23
Jan 4, 2025 21:24:06.669948101 CET	3778	47612	79.133.46.252	192.168.2.23
Jan 4, 2025 21:24:06.670248985 CET	47612	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:24:13.565457106 CET	42836	443	192.168.2.23	91.189.91.43
Jan 4, 2025 21:24:53.328680992 CET	47744	3778	192.168.2.23	79.133.46.252
Jan 4, 2025 21:24:53.333503962 CET	3778	47744	79.133.46.252	192.168.2.23
Jan 4, 2025 21:24:53.549040079 CET	3778	47744	79.133.46.252	192.168.2.23
Jan 4, 2025 21:24:53.549223900 CET	47744	3778	192.168.2.23	79.133.46.252

System Behavior

Analysis Process: Space.ppc.elf PID: 6234, Parent PID: 6152

General

Start time (UTC):	20:22:47
Start date (UTC):	04/01/2025
Path:	/tmp/Space.ppc.elf
Arguments:	/tmp/Space.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6236, Parent PID: 6234

General

Start time (UTC):	20:22:47
Start date (UTC):	04/01/2025
Path:	/tmp/Space.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6238, Parent PID: 6236

General

Start time (UTC):	20:22:47
Start date (UTC):	04/01/2025
Path:	/tmp/Space.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6239, Parent PID: 6236

General

Start time (UTC):	20:22:47
Start date (UTC):	04/01/2025
Path:	/tmp/Space.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6249, Parent PID: 6234

General

Start time (UTC):	20:22:53
Start date (UTC):	04/01/2025
Path:	/tmp/Space.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6251, Parent PID: 6234

General

Start time (UTC):	20:22:53
Start date (UTC):	04/01/2025
Path:	/tmp/Space.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.ppc.elf PID: 6234, Parent PID: 6152

General

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6236, Parent PID: 6234

General

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6238, Parent PID: 6236

General

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6239, Parent PID: 6236

General

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6249, Parent PID: 6234

General

Chronological Activities

Analysis Process: Space.ppc.elf PID: 6251, Parent PID: 6234

General

Chronological Activities

Linux Analysis Report
Space.ppc.elf