Edit tour

Linux Analysis Report
qbfwdbg.elf

Overview

General Information

Sample name:	qbfwdbg.elf
Analysis ID:	1588071
MD5:	a919a9b444ce65f18d828134ce16597d
SHA1:	f907cb8ee47b629760c3e360cd273dc9a426d599
SHA256:	c9156abfacfc54dbab20f1878c989ab65cf3dc2a78f1178f499f8f9e15ee214f
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588071
Start date and time:	2025-01-10 21:11:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	qbfwdbg.elf
Detection:	MAL
Classification:	mal68.spre.evad.linELF@0/14@7/0

Warnings

VT rate limit hit for: qbfwdbg.elf

Runtime Messages

Command:	/tmp/qbfwdbg.elf
PID:	5426
Exit Code:
Exit Code Info:
Killed:	True
Standard Output:	about to cum inside a femboy btw [main] created new process group [main/ensure] no other instance detected, joining botnet [main] failed to hide cmdline name, continuing anyway [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/avahi-daemon, PID: 780 [0clKillerKillerEXE] Killed process: /usr/sbin/irqbalance, PID: 790 [0clKillerKillerEXE] Killed process: /usr/sbin/rsyslogd, PID: 795 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/kerneloops, PID: 914 [0clKillerKillerEXE] Killed process: /usr/sbin/kerneloops, PID: 917 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd, PID: 3104 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 3161 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 3162 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 3163 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 3164 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 3165 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 3170 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd, PID: 3182 [0clKillerKillerEXE] Killed process: /usr/libexec/evolution-data-server/evolution-alarm-notify, PID: 3208 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd, PID: 3212 [0clKillerKillerEXE] Killed process: /tmp/qbfwdbg.elf (deleted), PID: 5429 [0clKillerKillerEXE] Killed process: /usr/sbin/rsyslogd, PID: 5450 [0clKillerKillerEXE] Killed process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 5453 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855 [0clKillerStat] Killed Process: /usr/sbin/sshd, PID: 936 [0clKillerStat] Killed Process: /usr/sbin/gdm3, PID: 1400 [0clKillerStat] Killed Process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 5454 [0clKillerStat] Killed Process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 5455 [0clKillerStat] Killed Process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 5456 [0clKillerStat] Killed Process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 5457 [0clKillerStat] Killed Process: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0, PID: 5458 [0clKillerStat] Killed Process: /usr/sbin/rsyslogd, PID: 5459 [0clKillerStat] Killed Process: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd, PID: 5476 [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerKillerEXE] Killed process: /usr/sbin/rsyslogd, PID: 5497 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855 [0clKillerStat] Killed Process: /usr/sbin/sshd, PID: 936 [0clKillerStat] Killed Process: /usr/sbin/gdm3, PID: 1400 [0clKillerStat] Killed Process: /usr/sbin/rsyslogd, PID: 5505 [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerKillerEXE] Killed process: /usr/sbin/rsyslogd, PID: 5509 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855 [0clKillerStat] Killed Process: /usr/sbin/sshd, PID: 936 [0clKillerStat] Killed Process: /usr/sbin/gdm3, PID: 1400 [0clKillerStat] Killed Process: /usr/sbin/rsyslogd, PID: 5518 [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerKillerEXE] Killed process: /usr/sbin/rsyslogd, PID: 5523 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855 [0clKillerStat] Killed Process: /usr/sbin/sshd, PID: 936 [0clKillerStat] Killed Process: /usr/sbin/gdm3, PID: 1400 [0clKillerStat] Killed Process: /usr/sbin/rsyslogd, PID: 5531 [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerMaps] Killed Process: ./src/basic/errno-util.h, PID: 2 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855 [0clKillerStat] Killed Process: /usr/sbin/sshd, PID: 936 [0clKillerStat] Killed Process: /usr/sbin/gdm3, PID: 1400 [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855 [0clKillerStat] Killed Process: /usr/sbin/sshd, PID: 936 [0clKillerStat] Killed Process: /usr/sbin/gdm3, PID: 1400 [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855 [0clKillerStat] Killed Process: /usr/sbin/sshd, PID: 936 [0clKillerStat] Killed Process: /usr/sbin/gdm3, PID: 1400 [0clKillerKillerEXE] Killed process: /usr/sbin/multipathd, PID: 660 [0clKillerKillerEXE] Killed process: /usr/sbin/acpid, PID: 778 [0clKillerKillerEXE] Killed process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerKillerEXE] Killed process: /usr/sbin/ModemManager, PID: 855 [0clKillerKillerEXE] Killed process: /usr/sbin/gdm3, PID: 1400 [0clKillerStat] Killed Process: /usr/sbin/multipathd, PID: 660 [0clKillerStat] Killed Process: /usr/sbin/acpid, PID: 778 [0clKillerStat] Killed Process: /usr/sbin/wpa_supplicant, PID: 803 [0clKillerStat] Killed Process: /usr/sbin/ModemManager, PID: 855
Standard Error:

Process Tree

system is lnxubuntu20

qbfwdbg.elf (PID: 5426, Parent: 5346, MD5: a919a9b444ce65f18d828134ce16597d) Arguments: /tmp/qbfwdbg.elf

qbfwdbg.elf New Fork (PID: 5427, Parent: 5426)

qbfwdbg.elf New Fork (PID: 5428, Parent: 5426)

qbfwdbg.elf New Fork (PID: 5429, Parent: 5426)

systemd New Fork (PID: 5450, Parent: 1)

rsyslogd (PID: 5450, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 5453, Parent: 3147)

wrapper-2.0 (PID: 5453, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5454, Parent: 3147)

wrapper-2.0 (PID: 5454, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5455, Parent: 3147)

wrapper-2.0 (PID: 5455, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5456, Parent: 3147)

wrapper-2.0 (PID: 5456, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5480, Parent: 5456)

xfpm-power-backlight-helper (PID: 5480, Parent: 5456, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5457, Parent: 3147)

wrapper-2.0 (PID: 5457, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5458, Parent: 3147)

wrapper-2.0 (PID: 5458, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 5459, Parent: 1)

rsyslogd (PID: 5459, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 5476, Parent: 5475)

xfconfd (PID: 5476, Parent: 5475, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5497, Parent: 1)

rsyslogd (PID: 5497, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5505, Parent: 1)

rsyslogd (PID: 5505, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5509, Parent: 1)

rsyslogd (PID: 5509, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5518, Parent: 1)

rsyslogd (PID: 5518, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5523, Parent: 1)

rsyslogd (PID: 5523, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5531, Parent: 1)

rsyslogd (PID: 5531, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
qbfwdbg.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf184:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
qbfwdbg.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xf9fb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
qbfwdbg.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb976:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x1190c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
qbfwdbg.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1367e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
qbfwdbg.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x185f2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
qbfwdbg.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf5bb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
qbfwdbg.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x16d2e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
qbfwdbg.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf886:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
qbfwdbg.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x16f27:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
qbfwdbg.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
qbfwdbg.elf	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1b8e6:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
qbfwdbg.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
qbfwdbg.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4542:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf184:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xf9fb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb976:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x1190c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1367e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x185f2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf5bb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x16d2e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf886:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x16f27:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1b8e6:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5428.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4542:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf184:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xf9fb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb976:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x1190c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1367e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x185f2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf5bb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x16d2e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf886:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x16f27:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1b8e6:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5426.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4542:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf184:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xf9fb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb976:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x1190c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1367e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x185f2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf5bb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x16d2e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf886:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x16f27:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1b8e6:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5429.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4542:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf184:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xf9fb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb976:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x1190c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1367e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x185f2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf5bb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x16d2e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xf886:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x16f27:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1b8e6:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5427.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4542:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 47 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: qbfwdbg.elf

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: qbfwdbg.elf

Joe Sandbox ML: detected

Source: global traffic	TCP traffic: 192.168.2.13:44728 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.13:43034 -> 141.98.10.40:33966

Source: /usr/sbin/rsyslogd (PID: 5459)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5497)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5505)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5509)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5518)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5523)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5531)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ofewu.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: syslog.39.dr, syslog.31.dr, syslog.41.dr, syslog.47.dr, syslog.43.dr, syslog.45.dr, syslog.37.dr

String found in binary or memory: https://www.rsyslog.com

System Summary

Malicious sample detected (through community Yara rule)

Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/qbfwdbg.elf (PID: 5426)	SIGKILL sent: pid: 5428, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5429, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5429, result: no such process	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5450, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5453, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5454, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5455, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5456, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5457, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5458, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5505, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5509, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5523, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5531, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 2, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: EOF/proc/%d/exe/proc/%d/stat/proc/%d/mapssys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)sh4[killer] starting memory scan on (pid=%d)

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/qbfwdbg.elf (PID: 5426)	SIGKILL sent: pid: 5428, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5429, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5429, result: no such process	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5450, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5453, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5454, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5455, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5456, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5457, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5458, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5505, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5509, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5523, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 5531, result: successful	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	SIGKILL sent: pid: 2, result: successful	Jump to behavior

Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: qbfwdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5428.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5426.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5429.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5427.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.spre.evad.linELF@0/14@7/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5456)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5457)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5457)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5457)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5457)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5458)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5476)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5476)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5476)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5476)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/5261/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/5261/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/3632/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/3632/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/3632/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/3095/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/3095/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/3095/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/241/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/241/stat	Jump to behavior
Source: /tmp/qbfwdbg.elf (PID: 5427)	File opened: /proc/241/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5459)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5497)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5505)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5509)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5518)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5523)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5531)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/qbfwdbg.elf (PID: 5426)

File: /tmp/qbfwdbg.elf

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5454)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5455)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5456)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5457)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5458)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5459)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5497)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5505)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5509)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5518)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5523)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5531)	Queries kernel information via 'uname':	Jump to behavior

Source: qbfwdbg.elf, 5429.1.00000000006fa000.00000000006fb000.rw-.sdmp	Binary or memory string: 1/tmp/vmware-root_727-4290690966
Source: qbfwdbg.elf, 5429.1.00000000006fb000.0000000000702000.rw-.sdmp	Binary or memory string: vmwareS
Source: qbfwdbg.elf, 5429.1.00000000006fb000.0000000000702000.rw-.sdmp	Binary or memory string: vmware
Source: qbfwdbg.elf, 5429.1.00000000006fa000.00000000006fb000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_727-4290690966
Source: kern.log.31.dr	Binary or memory string: Jan 10 14:12:35 galassia kernel: [ 104.299363] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse mptspi scsi_transport_spi ahci mptscsih libahci mptbase vmxnet3
Source: kern.log.31.dr	Binary or memory string: Jan 10 14:12:35 galassia kernel: [ 104.299382] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
qbfwdbg.elf	34%	ReversingLabs	Linux.Backdoor.Mirai
qbfwdbg.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ofewu.eye-network.ru	141.98.10.40	true	false		high
daisy.ubuntu.com	162.213.35.24	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.39.dr, syslog.31.dr, syslog.41.dr, syslog.47.dr, syslog.43.dr, syslog.45.dr, syslog.37.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false
141.98.10.40	ofewu.eye-network.ru	Lithuania		209605	HOSTBALTICLT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.190.156.145	wrjkngh4.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse
	jefne64.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Unknown	Browse
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Unknown	Browse
	debvps.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
141.98.10.40	DOC11042024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	vyebetsh.sa.com/nMcrGmhC252.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ofewu.eye-network.ru	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
ofewu.eye-network.ru	debvps.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
daisy.ubuntu.com	ssh.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	UnHAnaAW.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	UnHAnaAW.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	UnHAnaAW.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	UnHAnaAW.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	UnHAnaAW.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	woega6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	jefne64.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	debvps.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wev86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
HOSTBALTICLT	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	jefne64.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	wlw68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	fqkjei686.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	ngwa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	debvps.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	wev86.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	vevhea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.40

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	841
Entropy (8bit):	4.709348145969902
Encrypted:	false
SSDEEP:	24:xznV/fG6n16AIwn2AIRn7TAINxnze5nNTn0UnbznvGt:xznV/Fn1EwnIRn5NxnMnRnznfnk
MD5:	A2C909BEED7FC2D9281D2C675C6025B6
SHA1:	3AA75877DD316B447C03194DCE569B67CF92BC33
SHA-256:	104C3AFDCC2B912B134628967473B3E1FE98E3C7F6EE982E67FFD33F8842DD6C
SHA-512:	4D2353483F8D1C3D7261D00755C4D7B2A590E7F5CA7ADEF3E4E34B2E6C39B2159DA8622F0573486D8B459C8A594A788340C3AACA79D075AD1004BAA0CC85FD30
Malicious:	false
Reputation:	low
Preview:	Jan 10 14:12:53 galassia kernel: [ 123.531175] blocking signal 9: 5427 -> 1400.Jan 10 14:12:53 galassia kernel: [ 123.852633] New task spawned: old: (tgid 5531, tid 5531), new (tgid: 5531, tid: 5532).Jan 10 14:12:53 galassia kernel: [ 123.853085] New task spawned: old: (tgid 5531, tid 5531), new (tgid: 5531, tid: 5533).Jan 10 14:12:53 galassia kernel: [ 123.854823] New task spawned: old: (tgid 5531, tid 5532), new (tgid: 5531, tid: 5534).Jan 10 14:12:53 galassia kernel: [ 123.948784] blocking signal 9: 5427 -> 660.Jan 10 14:12:53 galassia kernel: [ 123.964516] blocking signal 9: 5427 -> 778.Jan 10 14:12:53 galassia kernel: [ 123.977010] blocking signal 9: 5427 -> 803.Jan 10 14:12:53 galassia kernel: [ 123.986932] blocking signal 9: 5427 -> 855.Jan 10 14:12:53 galassia kernel: [ 123.999795] blocking signal 9: 5427 -> 936.

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	5.012616341037928
Encrypted:	false
SSDEEP:	48:xzr31rWrP5s5RRAnV/Fn1EwnIRq6dFiGMXn5NxnMnRnznfnk:Zpaz5s5RRALdmZziGUBMRzfk
MD5:	A6D097194DA61234904FD82B90AE7BFB
SHA1:	BEBF889DCE4E15FDFD0202C1C1B3540E449882E3
SHA-256:	A9FD66FDED699C1BAC575B42D81A7BE248D1BAF6824DC67056A66B7356C2B909
SHA-512:	196121128710133FDCA526AD15861E00E8D948B2EDF328465B8A6AB650EEF6DE3E7DAD55D17B9B043E707013C3239F2BFF98C41EE340B9D3E91C095A021F0B1D
Malicious:	false
Reputation:	low
Preview:	Jan 10 14:12:53 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 10 14:12:53 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 10 14:12:53 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 8..Jan 10 14:12:53 galassia systemd[1]: Stopped System Logging Service..Jan 10 14:12:53 galassia systemd[1]: Starting System Logging Service....Jan 10 14:12:53 galassia systemd[1]: Started System Logging Service..Jan 10 14:12:53 galassia kernel: [ 123.531175] blocking signal 9: 5427 -> 1400.Jan 10 14:12:53 galassia kernel: [ 123.852633] New task spawned: old: (tgid 5531, tid 5531), new (tgid: 5531, tid: 5532).Jan 10 14:12:53 galassia kernel: [ 123.853085] New task spawned: old: (tgid 5531, tid 5531), new (tgid: 5531, tid: 5533).Jan 10 14:12:53 galassia rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0].Jan 10 14:12:53 galassia rsyslogd: rsyslogd's gro

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.220829002740549
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	qbfwdbg.elf
File size:	160'136 bytes
MD5:	a919a9b444ce65f18d828134ce16597d
SHA1:	f907cb8ee47b629760c3e360cd273dc9a426d599
SHA256:	c9156abfacfc54dbab20f1878c989ab65cf3dc2a78f1178f499f8f9e15ee214f
SHA512:	5851904a57e30d4fa8f9f0518c1f91483da9ba50114657aaa732b55ac787ea880b17b0ba386016255bdfbad4b6c32e9cf0b2005e05c6a212db174f5d06f80e40
SSDEEP:	3072:dznxapmWvKUQMFDdPW7Ly486GDU92zNnejnbsR6GWegi2GYc8:dznxapmWvKUQ2QC6KRejIgi2G
TLSH:	7AF35B1BB5C0C8FDC5D9C1788BAEA236E971F41D4238B21B27D4EA262E4DE305B5E650
File Content Preview:	.ELF..............>.......@.....@........o..........@.8...@.......................@.......@...............................................Q.......Q.............................Q.td....................................................H...._....j...H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	159496
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x18c96	0x0	0x6	AX	16
.fini	PROGBITS	0x418d96	0x18d96	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x418dc0	0x18dc0	0x4f20	0x0	0x2	A	32
.ctors	PROGBITS	0x51e000	0x1e000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x51e018	0x1e018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x51e040	0x1e040	0x8e88	0x0	0x3	WA	32
.bss	NOBITS	0x526ee0	0x26ec8	0xf0a0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x26ec8	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1dce0	0x1dce0	6.2498	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x1e000	0x51e000	0x51e000	0x8ec8	0x17f80	0.2504	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:12:33.946273088 CET	44728	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:33.951103926 CET	7733	44728	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:33.951158047 CET	44728	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:33.952157021 CET	44728	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:33.953742027 CET	44730	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:33.956990957 CET	7733	44728	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:33.958542109 CET	7733	44730	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:33.958580017 CET	44730	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:33.959022999 CET	43034	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:33.959964991 CET	44730	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:33.963759899 CET	33966	43034	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:33.963836908 CET	43034	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:33.964710951 CET	7733	44730	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.168205023 CET	44734	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.168736935 CET	43034	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:34.173285007 CET	7733	44734	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.173346996 CET	44734	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.173604965 CET	33966	43034	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:34.173672915 CET	43034	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:34.174555063 CET	44734	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.177414894 CET	44736	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.178508997 CET	33966	43034	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:34.179383039 CET	7733	44734	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.182266951 CET	7733	44736	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.182322979 CET	44736	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.183860064 CET	44736	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.187233925 CET	44738	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.188698053 CET	7733	44736	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.192210913 CET	7733	44738	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.192276955 CET	44738	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.194019079 CET	44738	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.197859049 CET	44740	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.198815107 CET	7733	44738	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.202800035 CET	7733	44740	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.202853918 CET	44740	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.204328060 CET	44740	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.207036018 CET	44742	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.209188938 CET	7733	44740	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.211874008 CET	7733	44742	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.211927891 CET	44742	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.213350058 CET	44742	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.215979099 CET	44744	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.218198061 CET	7733	44742	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.220865011 CET	7733	44744	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.220913887 CET	44744	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.222110033 CET	44744	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.224965096 CET	44746	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.227026939 CET	7733	44744	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.229846954 CET	7733	44746	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.229899883 CET	44746	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.231053114 CET	44746	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.233587980 CET	44748	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.235883951 CET	7733	44746	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.238532066 CET	7733	44748	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.238595963 CET	44748	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.241543055 CET	44748	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.247349024 CET	44750	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.249216080 CET	7733	44748	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.253582954 CET	7733	44750	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.253626108 CET	44750	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.255173922 CET	44750	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.257914066 CET	44752	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.260034084 CET	7733	44750	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.262835026 CET	7733	44752	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.262888908 CET	44752	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.266657114 CET	44752	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.269068956 CET	44754	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.272757053 CET	7733	44752	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.275363922 CET	7733	44754	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.275432110 CET	44754	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.277765036 CET	44754	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.280873060 CET	44756	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.283972979 CET	7733	44754	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.286604881 CET	7733	44756	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.286650896 CET	44756	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.288002968 CET	44756	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.293045044 CET	44758	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.295905113 CET	7733	44756	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.299151897 CET	7733	44758	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.299201012 CET	44758	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.300635099 CET	44758	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.303179979 CET	44760	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.305366039 CET	7733	44758	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.308053970 CET	7733	44760	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.308103085 CET	44760	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.310379028 CET	44760	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.313868999 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.315200090 CET	7733	44760	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.318747044 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.318790913 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.320291996 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.323590040 CET	44764	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.326447964 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.329776049 CET	7733	44764	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.329833031 CET	44764	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.330908060 CET	44764	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.336955070 CET	7733	44764	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.343693018 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.349901915 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.349948883 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.352647066 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.356302023 CET	44768	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.358901024 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.361131907 CET	7733	44768	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.361175060 CET	44768	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.368638039 CET	44768	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.374885082 CET	7733	44768	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.375499010 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.381850958 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.381902933 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.392787933 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.397639036 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.407510996 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.412444115 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.412493944 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.414978027 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.418762922 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.419744968 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.423557997 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:34.423625946 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.426569939 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:34.431349039 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.405106068 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.410260916 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.410358906 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.411159992 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.416043997 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.426980019 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.432014942 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.432090044 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.451613903 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.456620932 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.601521015 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.607399940 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.607484102 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.614737034 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.619658947 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.646965027 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.651896000 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.652848005 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.669610023 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.675035954 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.704134941 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.712007999 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.712083101 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.719542027 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.724356890 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.763984919 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.769030094 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:40.769105911 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.775724888 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:40.780606031 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.337603092 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.342564106 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.342617035 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.348329067 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.353169918 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.373424053 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.378221989 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.380233049 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.390342951 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.395133972 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.405591011 CET	44792	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.410595894 CET	7733	44792	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.410665989 CET	44792	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.434568882 CET	44792	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.439363956 CET	7733	44792	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.458671093 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.463454962 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.463613987 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.472745895 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.477489948 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.490392923 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.495197058 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.495264053 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.508074045 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.512892008 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.520064116 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.524888992 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.524945974 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.526705027 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.531490088 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.539907932 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.544719934 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:42.544881105 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.546294928 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:42.551198006 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.559067965 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.564970016 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.565047026 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.565998077 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.567553997 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.572938919 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.576955080 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.577018023 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.577984095 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.579543114 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.583698034 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.584940910 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.584988117 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.585915089 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.588705063 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.591046095 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.596961975 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.597017050 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.598053932 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.599615097 CET	44810	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.602823019 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.604934931 CET	7733	44810	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.604990959 CET	44810	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.605910063 CET	44810	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.611114025 CET	44812	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.611994028 CET	7733	44810	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.617027998 CET	7733	44812	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:45.617075920 CET	44812	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.618185043 CET	44812	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:45.623023987 CET	7733	44812	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.300705910 CET	44814	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.306689978 CET	7733	44814	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.306819916 CET	44814	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.307435036 CET	44814	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.313225985 CET	7733	44814	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.320314884 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.327558994 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.327668905 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.328511000 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.335424900 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.336354971 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.345015049 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.345139980 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.345813036 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.348162889 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.352940083 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.356012106 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.356098890 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.356951952 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.359977961 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.361767054 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.364954948 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.365010023 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.365736961 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.370642900 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.370735884 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.375736952 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.375885963 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.376569986 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.381469011 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.521359921 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.527524948 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:46.527607918 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.528870106 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:46.534684896 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.537795067 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.542876959 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.542929888 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.544312000 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.546730042 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.549200058 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.552033901 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.552078962 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.552999020 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.554444075 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.558315039 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.559792042 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.559828997 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.560766935 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.566116095 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.566337109 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.572156906 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.572206020 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.573029041 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.578046083 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.579910040 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.585530996 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.585582018 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.586435080 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.591864109 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.592643976 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.599570990 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:49.599639893 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.600481033 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:49.606296062 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.330189943 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.335074902 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.335262060 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.336160898 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.340889931 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.352024078 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.356991053 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.357042074 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.357927084 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.363459110 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.369098902 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.374928951 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.375000000 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.376065016 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.379590988 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.381103992 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.384644032 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.384689093 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.385576010 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.389775038 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.390309095 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.394740105 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.394778013 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.395677090 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.400470972 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.401483059 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.406346083 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.406394958 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.408113003 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.412883043 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.559731007 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.564640999 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:50.564699888 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.565620899 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:50.570414066 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.573434114 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.578418970 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.578474045 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.579916000 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.581809044 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.584794998 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.586687088 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.586761951 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.587995052 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.589899063 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.592824936 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.594764948 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.594826937 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.595997095 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.598028898 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.600742102 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.602849960 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.602912903 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.604075909 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.605449915 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.609464884 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.610811949 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.610857010 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.611917973 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.614814997 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.617240906 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.619688034 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:53.619744062 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.620596886 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:53.625303984 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.023175001 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.028183937 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.028253078 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.029166937 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.033997059 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.038894892 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.043813944 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.043873072 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.044819117 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.049623013 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.051388025 CET	44870	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.056283951 CET	7733	44870	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.056339979 CET	44870	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.057259083 CET	44870	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.062062979 CET	7733	44870	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.063605070 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.068522930 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.068576097 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.070027113 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.074673891 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.074842930 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.079472065 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.079524040 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.082461119 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.087230921 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.087346077 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.092252016 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.092310905 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.093300104 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.098042965 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.185785055 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.190711021 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:54.190769911 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.191808939 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:54.196578979 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.314197063 CET	7733	44730	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.316611052 CET	44730	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.346254110 CET	7733	44728	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.347569942 CET	33966	43034	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:55.347812891 CET	43034	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:55.348414898 CET	44728	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.352664948 CET	33966	43034	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:55.562832117 CET	7733	44738	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.562853098 CET	7733	44734	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.564441919 CET	44738	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.564449072 CET	44734	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.564800978 CET	7733	44736	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.568402052 CET	44736	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.576476097 CET	7733	44740	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.576590061 CET	7733	44744	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.580409050 CET	44740	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.580425024 CET	44744	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.607999086 CET	7733	44750	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.608411074 CET	44750	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.608589888 CET	7733	44748	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.609761000 CET	7733	44742	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.612406015 CET	44742	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.612411976 CET	44748	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.614624023 CET	7733	44746	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.616410971 CET	44746	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.638328075 CET	7733	44758	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.640424967 CET	44758	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.642570972 CET	7733	44752	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.642652988 CET	7733	44754	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.644412994 CET	44754	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.644413948 CET	44752	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.656184912 CET	7733	44760	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.656415939 CET	44760	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.687639952 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.688424110 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.701241970 CET	7733	44764	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.701309919 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.703110933 CET	7733	44756	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.704423904 CET	44756	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.704427958 CET	44764	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.704427958 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.716459990 CET	7733	44768	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.720413923 CET	44768	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.930823088 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.930860043 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.930869102 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:55.932441950 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.932441950 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:55.932446957 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:56.366575956 CET	43182	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:56.371481895 CET	33966	43182	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:56.371536016 CET	43182	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:56.372431040 CET	43182	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:56.504024029 CET	33966	43182	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:56.504246950 CET	43182	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:12:56.509134054 CET	33966	43182	141.98.10.40	192.168.2.13
Jan 10, 2025 21:12:57.202364922 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.207402945 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.207483053 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.208424091 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.210016012 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.213229895 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.214965105 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.215019941 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.215984106 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.217470884 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.220751047 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.222240925 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.222294092 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.223215103 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.225351095 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.228010893 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.230144024 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.230199099 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.231146097 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.233127117 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.235939026 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.237957954 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.238022089 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.238996029 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.243794918 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.344132900 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.349237919 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.349332094 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.350671053 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.355447054 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.368875980 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.373701096 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.373769999 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.374799013 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.376821041 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.379565001 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.381616116 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.381685019 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.382745028 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.384665966 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.387571096 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.389504910 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.389686108 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.390763044 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.393198013 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.395632029 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.398118019 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.398180008 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.399293900 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.401360035 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.404082060 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.406176090 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.406240940 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.407258034 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.409009933 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.412025928 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.413853884 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 10, 2025 21:12:57.413921118 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.414902925 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:12:57.419795036 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.426693916 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.431744099 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.431812048 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.432881117 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.434406996 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.437691927 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.439294100 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.439353943 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.440299988 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.442015886 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.445169926 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.446834087 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.446888924 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.448021889 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.450022936 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.452858925 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.454898119 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.454965115 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.455888033 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.457551956 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.460793018 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.462342978 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.462399006 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.463397026 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.468249083 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.481159925 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.486175060 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.486254930 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.487129927 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.488665104 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.491883993 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.493453026 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.493520975 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.494453907 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.495837927 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.499264002 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.500710964 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.500771046 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.501636028 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.503563881 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.506371021 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.508323908 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.508364916 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.509196043 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.510528088 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.513963938 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.515321970 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.515363932 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.516192913 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.517558098 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.521044016 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.522372961 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:00.522412062 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.523230076 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:00.528008938 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:01.779242992 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:01.780433893 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:01.814579010 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:01.816436052 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:02.111114979 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:02.111179113 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:02.111283064 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:02.112541914 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:02.112541914 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:02.112541914 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:02.144563913 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:02.148467064 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.534904957 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.539999008 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.540067911 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.540980101 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.542570114 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.545799017 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.547440052 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.547530890 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.549385071 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.552066088 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.554687977 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.558090925 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.558176041 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.559782982 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.563323975 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.565289021 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.569128990 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.569189072 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.570676088 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.573268890 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.575954914 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.578243017 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.578304052 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.579947948 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.584734917 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.605957031 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.611387968 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.611443043 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.612708092 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.614830017 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.617490053 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.619662046 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.619719028 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.621174097 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.623663902 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.625957966 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.629790068 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.629839897 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.631335020 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.634752989 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.636097908 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.641913891 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.641983032 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.643639088 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.646089077 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.648485899 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.651057959 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.651125908 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.652698040 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.655240059 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.657535076 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.660448074 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.660526037 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.662149906 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.666970968 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.686464071 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.688427925 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.749527931 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.752446890 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.783597946 CET	7733	44792	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.784411907 CET	44792	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.861567020 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.864541054 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.875734091 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.876420021 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.905643940 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.908404112 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:03.908467054 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:03.912419081 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.676750898 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.681708097 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.681771040 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.682820082 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.684459925 CET	44952	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.687680960 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.689300060 CET	7733	44952	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.689352989 CET	44952	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.690452099 CET	44952	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.692069054 CET	44954	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.695296049 CET	7733	44952	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.696897030 CET	7733	44954	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.696974993 CET	44954	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.697990894 CET	44954	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.700335979 CET	44956	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.702837944 CET	7733	44954	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.705298901 CET	7733	44956	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.705362082 CET	44956	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.706422091 CET	44956	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.708002090 CET	44958	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.711347103 CET	7733	44956	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.712800026 CET	7733	44958	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.712897062 CET	44958	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.713946104 CET	44958	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.718862057 CET	7733	44958	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.733861923 CET	44960	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.738781929 CET	7733	44960	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.738841057 CET	44960	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.740015984 CET	44960	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.741790056 CET	44962	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.744869947 CET	7733	44960	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.746705055 CET	7733	44962	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.746778011 CET	44962	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.747833967 CET	44962	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.749898911 CET	44964	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.752713919 CET	7733	44962	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.754815102 CET	7733	44964	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.754884005 CET	44964	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.755877018 CET	44964	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.760767937 CET	7733	44964	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.760845900 CET	44966	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.765680075 CET	7733	44966	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.765752077 CET	44966	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.766815901 CET	44966	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.768362999 CET	44968	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.771689892 CET	7733	44966	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.773303032 CET	7733	44968	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.773364067 CET	44968	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.774337053 CET	44968	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.775895119 CET	44970	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.779136896 CET	7733	44968	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.780709028 CET	7733	44970	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.780759096 CET	44970	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.781743050 CET	44970	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.786623955 CET	7733	44970	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.922413111 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.924463034 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.936711073 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.940442085 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.951456070 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.952423096 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.982835054 CET	7733	44812	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.984411955 CET	44812	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:06.988287926 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:06.988415003 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.002110958 CET	7733	44810	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.004487038 CET	44810	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.691730022 CET	7733	44814	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.692451000 CET	44814	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.718154907 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.720426083 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.751539946 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.752460957 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.763997078 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.764499903 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.764815092 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.767973900 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.768416882 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.768418074 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:07.924382925 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:07.928431988 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:09.797645092 CET	44972	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:09.803657055 CET	7733	44972	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:09.803733110 CET	44972	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:09.805036068 CET	44972	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:09.806956053 CET	44974	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:09.992638111 CET	7733	44972	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:09.992655039 CET	7733	44974	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:09.992832899 CET	44974	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:09.995829105 CET	44974	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:09.998064995 CET	44976	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.000664949 CET	7733	44974	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.003372908 CET	7733	44976	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.003444910 CET	44976	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.004751921 CET	44976	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.007539034 CET	44978	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.009447098 CET	7733	44976	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.012307882 CET	7733	44978	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.012371063 CET	44978	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.013339996 CET	44978	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.015010118 CET	44980	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.018255949 CET	7733	44978	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.019821882 CET	7733	44980	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.019867897 CET	44980	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.020881891 CET	44980	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.025696993 CET	7733	44980	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.048784018 CET	44982	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.054668903 CET	7733	44982	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.054744005 CET	44982	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.055972099 CET	44982	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.057964087 CET	44984	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.061880112 CET	7733	44982	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.063805103 CET	7733	44984	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.063857079 CET	44984	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.065053940 CET	44984	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.067034006 CET	44986	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.069772959 CET	7733	44984	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.071775913 CET	7733	44986	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.071830034 CET	44986	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.072884083 CET	44986	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.075301886 CET	44988	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.077678919 CET	7733	44986	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.080104113 CET	7733	44988	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.080182076 CET	44988	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.081278086 CET	44988	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.082921982 CET	44990	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.086047888 CET	7733	44988	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.087677956 CET	7733	44990	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.087738991 CET	44990	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.088838100 CET	44990	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.090715885 CET	44992	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.093544960 CET	7733	44990	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.095505953 CET	7733	44992	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:10.095570087 CET	44992	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.096638918 CET	44992	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:10.101417065 CET	7733	44992	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.083365917 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.083419085 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.083456039 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.083487034 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.083517075 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.083547115 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.084490061 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.084490061 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.084510088 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.084510088 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.084626913 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.084628105 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.689809084 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.692531109 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.736000061 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.736442089 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.751034975 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.751954079 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.752403021 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.752403021 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.795403004 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.796446085 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.800990105 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.804416895 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:11.937807083 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:11.940448999 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.113848925 CET	44994	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.118777990 CET	7733	44994	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.118876934 CET	44994	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.120403051 CET	44994	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.122972012 CET	44996	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.125194073 CET	7733	44994	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.127818108 CET	7733	44996	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.127912998 CET	44996	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.129592896 CET	44996	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.132143974 CET	44998	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.134429932 CET	7733	44996	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.136953115 CET	7733	44998	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.137031078 CET	44998	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.138708115 CET	44998	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.142025948 CET	45000	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.143493891 CET	7733	44998	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.146848917 CET	7733	45000	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.146915913 CET	45000	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.148607969 CET	45000	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.150357962 CET	45002	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.153383970 CET	7733	45000	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.155167103 CET	7733	45002	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.155323982 CET	45002	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.156949997 CET	45002	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.161757946 CET	7733	45002	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.184734106 CET	45004	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.189721107 CET	7733	45004	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.189780951 CET	45004	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.191060066 CET	45004	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.193547964 CET	45006	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.195802927 CET	7733	45004	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.198313951 CET	7733	45006	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.198398113 CET	45006	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.199913979 CET	45006	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.202606916 CET	45008	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.204654932 CET	7733	45006	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.207412958 CET	7733	45008	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.207513094 CET	45008	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.208918095 CET	45008	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.212402105 CET	45010	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.213690042 CET	7733	45008	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.217160940 CET	7733	45010	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.217259884 CET	45010	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.218862057 CET	45010	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.221117973 CET	45012	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.223608017 CET	7733	45010	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.225929976 CET	7733	45012	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.226011038 CET	45012	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.228068113 CET	45012	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.231369972 CET	45014	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.232916117 CET	7733	45012	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.236299038 CET	7733	45014	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:13.236380100 CET	45014	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.238522053 CET	45014	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:13.243418932 CET	7733	45014	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:14.937045097 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:14.940444946 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:14.954999924 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:14.956458092 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:14.967468977 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:14.968424082 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:14.983942986 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:14.984390974 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:14.988563061 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:14.992393017 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.004390955 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.008407116 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.405061007 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.408534050 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.420689106 CET	7733	44870	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.421080112 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.424387932 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.424393892 CET	44870	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.437918901 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.440510035 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.455383062 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.456500053 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.488605022 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.492830992 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:15.560589075 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:15.564548016 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.258280993 CET	45016	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.263254881 CET	7733	45016	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.263345003 CET	45016	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.264467955 CET	45016	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.266374111 CET	45018	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.269282103 CET	7733	45016	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.271209955 CET	7733	45018	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.271297932 CET	45018	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.272629976 CET	45018	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.274408102 CET	45020	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.277457952 CET	7733	45018	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.279366016 CET	7733	45020	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.279428959 CET	45020	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.280431032 CET	45020	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.282586098 CET	45022	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.285290956 CET	7733	45020	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.287422895 CET	7733	45022	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.287482023 CET	45022	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.288505077 CET	45022	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.290100098 CET	45024	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.293304920 CET	7733	45022	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.294956923 CET	7733	45024	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.295017958 CET	45024	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.296475887 CET	45024	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.301327944 CET	7733	45024	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.318336964 CET	45026	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.323306084 CET	7733	45026	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.323379040 CET	45026	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.324353933 CET	45026	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.325746059 CET	45028	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.329143047 CET	7733	45026	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.330527067 CET	7733	45028	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.330583096 CET	45028	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.331433058 CET	45028	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.332966089 CET	45030	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.336191893 CET	7733	45028	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.337762117 CET	7733	45030	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.337817907 CET	45030	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.338809967 CET	45030	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.341139078 CET	45032	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.343610048 CET	7733	45030	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.345979929 CET	7733	45032	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.346028090 CET	45032	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.347462893 CET	45032	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.349421978 CET	45034	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.352314949 CET	7733	45032	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.354280949 CET	7733	45034	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.354341984 CET	45034	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.355551958 CET	45034	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.357835054 CET	45036	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.360450029 CET	7733	45034	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.362728119 CET	7733	45036	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:16.362802029 CET	45036	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.364347935 CET	45036	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:16.369168997 CET	7733	45036	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:17.906838894 CET	33966	43182	141.98.10.40	192.168.2.13
Jan 10, 2025 21:13:17.907146931 CET	43182	33966	192.168.2.13	141.98.10.40
Jan 10, 2025 21:13:17.911952972 CET	33966	43182	141.98.10.40	192.168.2.13
Jan 10, 2025 21:13:18.562980890 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.564481020 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.576745033 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.578386068 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.580400944 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.580468893 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.608198881 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.608418941 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.610497952 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.612413883 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.938951969 CET	45036	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.938976049 CET	45034	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.938976049 CET	45032	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.938990116 CET	45030	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.938990116 CET	45028	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939007044 CET	45026	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939007998 CET	45024	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939028025 CET	45022	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939038038 CET	45020	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939049959 CET	45018	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939058065 CET	45016	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939069986 CET	45014	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939080000 CET	45012	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939099073 CET	45010	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939099073 CET	45008	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939106941 CET	45006	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939138889 CET	45002	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939141989 CET	45004	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939138889 CET	45000	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939157009 CET	44996	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939157009 CET	44998	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939172029 CET	44990	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939172029 CET	44988	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939188957 CET	44986	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939188957 CET	44984	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939210892 CET	44982	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939210892 CET	44980	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939228058 CET	44978	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939228058 CET	44976	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939244986 CET	44974	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939254045 CET	44972	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939259052 CET	44994	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939260006 CET	44992	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939268112 CET	44970	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939279079 CET	44968	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939297915 CET	44966	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939318895 CET	44964	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939327002 CET	44962	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939340115 CET	44960	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939356089 CET	44958	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939356089 CET	44956	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939377069 CET	44954	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939377069 CET	44952	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939403057 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939403057 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939414978 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939426899 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939436913 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939445019 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939450979 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939465046 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939485073 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939485073 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939506054 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939506054 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939532042 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939532042 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939542055 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939554930 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939557076 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939558029 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939562082 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939574003 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939585924 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939599037 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939604998 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939615965 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939625978 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939625978 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939642906 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939642906 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939666033 CET	44890	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939670086 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939670086 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939677954 CET	44888	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939681053 CET	44886	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939697981 CET	44884	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939722061 CET	44882	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939743042 CET	44878	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939743042 CET	44876	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939757109 CET	44874	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939766884 CET	44872	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939779043 CET	44870	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939790010 CET	44868	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939806938 CET	44866	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939820051 CET	44864	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939834118 CET	44862	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939834118 CET	44860	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939857960 CET	44858	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939860106 CET	44854	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939857960 CET	44856	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939872026 CET	44852	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939874887 CET	44850	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939874887 CET	44848	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939882040 CET	44846	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939888954 CET	44844	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939903975 CET	44840	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939903975 CET	44842	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939918041 CET	44838	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939925909 CET	44836	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939940929 CET	44834	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939940929 CET	44832	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939964056 CET	44830	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939964056 CET	44828	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939985991 CET	44826	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.939985991 CET	44824	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940000057 CET	44822	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940000057 CET	44820	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940013885 CET	44818	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940023899 CET	44816	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940027952 CET	44814	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940040112 CET	44812	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940067053 CET	44810	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940067053 CET	44808	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940076113 CET	44806	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940076113 CET	44804	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940082073 CET	44802	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940095901 CET	44800	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940097094 CET	44798	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940097094 CET	44796	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940133095 CET	44794	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940134048 CET	44790	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940134048 CET	44792	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940144062 CET	44786	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940145969 CET	44788	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940155983 CET	44784	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940172911 CET	44782	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940172911 CET	44780	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940196037 CET	44778	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940196037 CET	44776	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940207958 CET	44774	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940207958 CET	44772	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940220118 CET	44770	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940231085 CET	44768	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940238953 CET	44766	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940238953 CET	44764	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940263033 CET	44762	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940263033 CET	44760	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940277100 CET	44758	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940277100 CET	44756	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940288067 CET	44754	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940298080 CET	44752	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940305948 CET	44748	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940305948 CET	44750	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940335035 CET	44746	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940335989 CET	44744	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940355062 CET	44742	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940371037 CET	44740	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940390110 CET	44738	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940408945 CET	44736	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940426111 CET	44734	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940431118 CET	44730	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.940438986 CET	44728	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972220898 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972270966 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972282887 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972296000 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972306967 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972316980 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972316980 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972326994 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972341061 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972341061 CET	44898	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972342014 CET	44902	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972361088 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972368956 CET	44900	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972367048 CET	44904	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972390890 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972433090 CET	44892	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972609043 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972620010 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.972671986 CET	44894	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.972676039 CET	44896	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:18.974610090 CET	7733	44904	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974621058 CET	7733	44902	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974630117 CET	7733	44900	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974642992 CET	7733	44898	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974653006 CET	7733	44896	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974662066 CET	7733	44890	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974672079 CET	7733	44888	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974680901 CET	7733	44892	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974689960 CET	7733	44894	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974700928 CET	7733	44886	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974709988 CET	7733	44884	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974720001 CET	7733	44882	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974737883 CET	7733	44878	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974746943 CET	7733	44876	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974756956 CET	7733	44874	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974766016 CET	7733	44872	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974776983 CET	7733	44870	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974787951 CET	7733	44868	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974797964 CET	7733	44866	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974807978 CET	7733	44864	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974817991 CET	7733	44862	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974828005 CET	7733	44860	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974837065 CET	7733	44854	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974844933 CET	7733	44858	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974893093 CET	7733	44856	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.974997997 CET	7733	44852	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975008011 CET	7733	44850	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975018978 CET	7733	44848	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975028038 CET	7733	44846	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975038052 CET	7733	44844	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975055933 CET	7733	44840	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975065947 CET	7733	44842	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975075960 CET	7733	44838	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975085974 CET	7733	44836	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975096941 CET	7733	44834	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975106001 CET	7733	44832	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975116968 CET	7733	44830	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975126028 CET	7733	44828	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975136042 CET	7733	44826	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975146055 CET	7733	44824	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975156069 CET	7733	44822	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975164890 CET	7733	44820	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975176096 CET	7733	44818	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975184917 CET	7733	44816	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975193977 CET	7733	44814	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975204945 CET	7733	44812	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975214005 CET	7733	44810	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975224018 CET	7733	44806	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975261927 CET	7733	44804	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975272894 CET	7733	44802	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975281954 CET	7733	44808	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975308895 CET	7733	44800	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975325108 CET	7733	44798	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975336075 CET	7733	44796	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975404024 CET	7733	44790	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975414038 CET	7733	44794	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975424051 CET	7733	44786	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975433111 CET	7733	44792	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975442886 CET	7733	44788	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975455999 CET	7733	44784	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975466967 CET	7733	44782	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975476980 CET	7733	44780	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975486994 CET	7733	44778	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975496054 CET	7733	44776	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975506067 CET	7733	44774	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975516081 CET	7733	44772	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975524902 CET	7733	44770	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975533962 CET	7733	44768	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975543022 CET	7733	44766	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975552082 CET	7733	44764	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975562096 CET	7733	44762	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975572109 CET	7733	44760	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975780010 CET	7733	44758	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975790024 CET	7733	44756	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975799084 CET	7733	44754	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975816011 CET	7733	44752	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975826025 CET	7733	44748	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975835085 CET	7733	44750	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975843906 CET	7733	44746	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975852013 CET	7733	44744	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975857019 CET	7733	44742	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975866079 CET	7733	44740	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975874901 CET	7733	44738	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975882053 CET	7733	44736	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975893021 CET	7733	44730	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975902081 CET	7733	44734	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:18.975910902 CET	7733	44728	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.148514032 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148530006 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148530006 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148538113 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148539066 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148539066 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148539066 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148545980 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148547888 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148545980 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148545980 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148545980 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148547888 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148547888 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148547888 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148554087 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148554087 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148547888 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148549080 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148567915 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148567915 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148576021 CET	44956	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148567915 CET	44960	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148576021 CET	44958	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148567915 CET	44962	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148587942 CET	44952	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148587942 CET	44954	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148587942 CET	44968	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148588896 CET	44970	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148595095 CET	44976	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148595095 CET	44978	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148612022 CET	44980	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148612022 CET	44982	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148614883 CET	44984	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148614883 CET	44986	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148622990 CET	44988	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148622990 CET	44990	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148641109 CET	44996	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148641109 CET	44998	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148641109 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148641109 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148642063 CET	44964	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148642063 CET	44966	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148642063 CET	44992	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148642063 CET	44994	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148648024 CET	45000	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148648024 CET	45002	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148649931 CET	45004	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148649931 CET	45006	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148663044 CET	45008	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148663044 CET	45010	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148668051 CET	45012	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148668051 CET	45014	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148694992 CET	45016	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148694992 CET	45018	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148699045 CET	45020	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148699045 CET	45022	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148711920 CET	45028	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148714066 CET	45024	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148714066 CET	45026	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148719072 CET	45030	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148726940 CET	45032	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148726940 CET	45034	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.148737907 CET	45036	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:19.167751074 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167768955 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167783022 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167795897 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167807102 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167817116 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167826891 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167838097 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167850971 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167862892 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167872906 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167882919 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167892933 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167902946 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167913914 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167923927 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167934895 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167946100 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167956114 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167967081 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.167988062 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168005943 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168016911 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168026924 CET	7733	44952	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168036938 CET	7733	44954	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168049097 CET	7733	44956	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168059111 CET	7733	44958	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168068886 CET	7733	44960	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168078899 CET	7733	44962	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168087959 CET	7733	44964	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168097973 CET	7733	44966	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168102026 CET	7733	44992	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168106079 CET	7733	44994	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168112993 CET	7733	44968	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168123007 CET	7733	44970	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168133020 CET	7733	44972	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168143034 CET	7733	44974	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168153048 CET	7733	44976	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168163061 CET	7733	44978	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168173075 CET	7733	44980	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168184042 CET	7733	44982	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168200970 CET	7733	44984	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168212891 CET	7733	44986	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168222904 CET	7733	44988	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168232918 CET	7733	44998	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168242931 CET	7733	44996	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168252945 CET	7733	44990	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168262959 CET	7733	45000	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168272972 CET	7733	45002	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168282986 CET	7733	45004	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168292999 CET	7733	45006	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168303013 CET	7733	45008	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168313026 CET	7733	45010	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168323040 CET	7733	45012	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168333054 CET	7733	45014	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168342113 CET	7733	45016	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168351889 CET	7733	45018	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168361902 CET	7733	45020	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168373108 CET	7733	45022	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168384075 CET	7733	45024	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168394089 CET	7733	45026	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168404102 CET	7733	45032	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168414116 CET	7733	45028	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168428898 CET	7733	45030	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168438911 CET	7733	45034	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.168450117 CET	7733	45036	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169821978 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169831038 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169840097 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169848919 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169853926 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169907093 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169915915 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169924974 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169934988 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169944048 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169954062 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169964075 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169974089 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.169982910 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170001030 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170011997 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170022011 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170031071 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170039892 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170048952 CET	7733	44960	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170058012 CET	7733	44962	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170068026 CET	7733	44976	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170078039 CET	7733	44978	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170089960 CET	7733	44956	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170797110 CET	7733	44958	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170806885 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170815945 CET	7733	44952	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170825005 CET	7733	44954	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170834064 CET	7733	44968	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170846939 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170856953 CET	7733	44980	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170866013 CET	7733	44982	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170876026 CET	7733	44984	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170886040 CET	7733	44986	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170896053 CET	7733	44988	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170905113 CET	7733	44990	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170914888 CET	7733	44970	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170922995 CET	7733	44996	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170933008 CET	7733	44998	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170942068 CET	7733	45000	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170972109 CET	7733	45002	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170981884 CET	7733	45004	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.170990944 CET	7733	45006	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171000004 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171009064 CET	7733	45008	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171020031 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171029091 CET	7733	45010	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171039104 CET	7733	44964	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171108007 CET	7733	45012	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171117067 CET	7733	45014	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171224117 CET	7733	44966	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171233892 CET	7733	44992	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171241999 CET	7733	44994	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171253920 CET	7733	45016	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171262980 CET	7733	45018	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171272039 CET	7733	45020	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171276093 CET	7733	45022	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171279907 CET	7733	45028	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171283007 CET	7733	45024	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171287060 CET	7733	45026	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171295881 CET	7733	45030	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171308994 CET	7733	45032	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171328068 CET	7733	45034	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:19.171338081 CET	7733	45036	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.811373949 CET	7733	44908	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.811433077 CET	7733	44912	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.811546087 CET	44908	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.811570883 CET	44912	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.815428019 CET	7733	44906	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.815500021 CET	44906	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.826886892 CET	7733	44910	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.826948881 CET	7733	44914	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.826993942 CET	44910	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.827054977 CET	44914	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.857949972 CET	7733	44918	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.858073950 CET	44918	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.862128973 CET	7733	44916	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.862202883 CET	44916	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.873941898 CET	7733	44922	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.874026060 CET	44922	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.893096924 CET	7733	44924	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.893151999 CET	7733	44920	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.893269062 CET	44920	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.893270969 CET	44924	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:21.941852093 CET	7733	44926	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:21.941975117 CET	44926	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287646055 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287681103 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287692070 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287703037 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287792921 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287805080 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287818909 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287825108 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287825108 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287834883 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287847996 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287854910 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287858963 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287869930 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287890911 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287900925 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287909985 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287913084 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287910938 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287921906 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287931919 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287925959 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287925959 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287942886 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287944078 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287945032 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287954092 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287965059 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287965059 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287965059 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287969112 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287977934 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.287991047 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.287997961 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.288002014 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.288003922 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.288024902 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.288028002 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.288048029 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.288052082 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.288064003 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.288069963 CET	44942	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.288090944 CET	44948	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.288100004 CET	44944	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.456789970 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.456878901 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.456908941 CET	44928	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.456912041 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.456943989 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.456974030 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457003117 CET	44932	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.457004070 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457017899 CET	44938	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.457035065 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457065105 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457068920 CET	44934	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.457089901 CET	44930	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.457098007 CET	44936	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.457107067 CET	44940	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.457112074 CET	44946	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:25.457410097 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457442045 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457470894 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457500935 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457531929 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457570076 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457597971 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457628012 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457657099 CET	7733	44942	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457685947 CET	7733	44948	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.457715034 CET	7733	44944	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.461962938 CET	7733	44928	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.461992979 CET	7733	44932	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.462045908 CET	7733	44938	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.462075949 CET	7733	44934	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.462104082 CET	7733	44930	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.462131023 CET	7733	44936	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.462158918 CET	7733	44946	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:25.462192059 CET	7733	44940	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.063141108 CET	7733	44954	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.063263893 CET	44954	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.066152096 CET	7733	44952	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.066256046 CET	44952	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.092482090 CET	7733	44958	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.092562914 CET	44958	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.096302986 CET	7733	44956	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.096506119 CET	44956	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.097385883 CET	7733	44950	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.097440004 CET	44950	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.108164072 CET	7733	44960	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.108228922 CET	44960	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.295111895 CET	7733	44968	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.295161963 CET	7733	44962	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.295192957 CET	7733	44970	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.295223951 CET	7733	44964	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.295254946 CET	7733	44966	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:28.295351028 CET	44966	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.295351028 CET	44968	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.295383930 CET	44962	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.295401096 CET	44964	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:28.295413017 CET	44970	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.343182087 CET	7733	44974	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.343566895 CET	44974	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.362397909 CET	7733	44972	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.362579107 CET	44972	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.378302097 CET	7733	44976	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.378359079 CET	7733	44978	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.378423929 CET	44976	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.378423929 CET	44978	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.379268885 CET	7733	44980	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.379334927 CET	44980	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.422487974 CET	7733	44982	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.422764063 CET	44982	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.436618090 CET	7733	44988	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.436702013 CET	44988	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.438064098 CET	7733	44986	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.438157082 CET	44986	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.456080914 CET	7733	44984	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.456376076 CET	44984	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.469396114 CET	7733	44992	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.469484091 CET	44992	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:31.484112978 CET	7733	44990	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:31.484226942 CET	44990	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.485261917 CET	7733	44994	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.485409021 CET	44994	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.486953974 CET	7733	44996	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.487040043 CET	44996	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.502763033 CET	7733	44998	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.502832890 CET	44998	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.518436909 CET	7733	45000	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.518518925 CET	45000	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.533287048 CET	7733	45002	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.533386946 CET	45002	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.545799971 CET	7733	45006	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.545861959 CET	45006	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.561414003 CET	7733	45008	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.561450958 CET	45008	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.561503887 CET	7733	45004	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.561562061 CET	45004	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.577061892 CET	7733	45010	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.577130079 CET	45010	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.592684984 CET	7733	45014	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.592783928 CET	45014	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:34.594438076 CET	7733	45012	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:34.594499111 CET	45012	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.610554934 CET	7733	45016	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.610780001 CET	45016	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.641432047 CET	7733	45020	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.641602993 CET	45020	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.643477917 CET	7733	45018	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.643577099 CET	45018	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.674721956 CET	7733	45024	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.674823999 CET	45024	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.686760902 CET	7733	45022	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.686778069 CET	7733	45028	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.686788082 CET	7733	45032	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.686799049 CET	7733	45026	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.686850071 CET	45028	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.686855078 CET	45022	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.686868906 CET	45026	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.686877012 CET	45032	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.702275038 CET	7733	45030	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.702367067 CET	45030	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.717335939 CET	7733	45034	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.717453003 CET	45034	7733	192.168.2.13	89.190.156.145
Jan 10, 2025 21:13:37.734514952 CET	7733	45036	89.190.156.145	192.168.2.13
Jan 10, 2025 21:13:37.734608889 CET	45036	7733	192.168.2.13	89.190.156.145

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:12:33.936875105 CET	38993	53	192.168.2.13	8.8.8.8
Jan 10, 2025 21:12:33.947828054 CET	53	38993	8.8.8.8	192.168.2.13
Jan 10, 2025 21:12:33.948754072 CET	48403	53	192.168.2.13	8.8.8.8
Jan 10, 2025 21:12:33.958529949 CET	53	48403	8.8.8.8	192.168.2.13
Jan 10, 2025 21:12:56.350498915 CET	40319	53	192.168.2.13	8.8.8.8
Jan 10, 2025 21:12:56.357616901 CET	53	40319	8.8.8.8	192.168.2.13
Jan 10, 2025 21:12:56.358639956 CET	60900	53	192.168.2.13	8.8.8.8
Jan 10, 2025 21:12:56.366087914 CET	53	60900	8.8.8.8	192.168.2.13
Jan 10, 2025 21:13:18.909681082 CET	53901	53	192.168.2.13	8.8.8.8
Jan 10, 2025 21:13:18.977575064 CET	53	53901	8.8.8.8	192.168.2.13
Jan 10, 2025 21:15:17.354231119 CET	46645	53	192.168.2.13	1.1.1.1
Jan 10, 2025 21:15:17.354306936 CET	43075	53	192.168.2.13	1.1.1.1
Jan 10, 2025 21:15:17.361284971 CET	53	46645	1.1.1.1	192.168.2.13
Jan 10, 2025 21:15:17.361938000 CET	53	43075	1.1.1.1	192.168.2.13

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 10, 2025 21:13:18.977677107 CET	192.168.2.13	8.8.8.8	d011	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:12:33.936875105 CET	192.168.2.13	8.8.8.8	0x1b15	Standard query (0)	ofewu.eye-network.ru	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:12:33.948754072 CET	192.168.2.13	8.8.8.8	0x527	Standard query (0)	ofewu.eye-network.ru	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:12:56.350498915 CET	192.168.2.13	8.8.8.8	0x4012	Standard query (0)	ofewu.eye-network.ru	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:12:56.358639956 CET	192.168.2.13	8.8.8.8	0xec49	Standard query (0)	ofewu.eye-network.ru	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:13:18.909681082 CET	192.168.2.13	8.8.8.8	0x5b1c	Standard query (0)	ofewu.eye-network.ru	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:15:17.354231119 CET	192.168.2.13	1.1.1.1	0xbdcb	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:15:17.354306936 CET	192.168.2.13	1.1.1.1	0x18b	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:12:33.947828054 CET	8.8.8.8	192.168.2.13	0x1b15	No error (0)	ofewu.eye-network.ru	141.98.10.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:12:33.958529949 CET	8.8.8.8	192.168.2.13	0x527	No error (0)	ofewu.eye-network.ru	141.98.10.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:12:56.357616901 CET	8.8.8.8	192.168.2.13	0x4012	No error (0)	ofewu.eye-network.ru	141.98.10.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:12:56.366087914 CET	8.8.8.8	192.168.2.13	0xec49	No error (0)	ofewu.eye-network.ru	141.98.10.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:13:18.977575064 CET	8.8.8.8	192.168.2.13	0x5b1c	No error (0)	ofewu.eye-network.ru	141.98.10.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:15:17.361284971 CET	1.1.1.1	192.168.2.13	0xbdcb	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:15:17.361284971 CET	1.1.1.1	192.168.2.13	0xbdcb	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: qbfwdbg.elf PID: 5426, Parent PID: 5346

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/tmp/qbfwdbg.elf
Arguments:	/tmp/qbfwdbg.elf
File size:	160136 bytes
MD5 hash:	a919a9b444ce65f18d828134ce16597d

Chronological Activities

Analysis Process: qbfwdbg.elf PID: 5427, Parent PID: 5426

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/tmp/qbfwdbg.elf
Arguments:	-
File size:	160136 bytes
MD5 hash:	a919a9b444ce65f18d828134ce16597d

Chronological Activities

Analysis Process: qbfwdbg.elf PID: 5428, Parent PID: 5426

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/tmp/qbfwdbg.elf
Arguments:	-
File size:	160136 bytes
MD5 hash:	a919a9b444ce65f18d828134ce16597d

Analysis Process: qbfwdbg.elf PID: 5429, Parent PID: 5426

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/tmp/qbfwdbg.elf
Arguments:	-
File size:	160136 bytes
MD5 hash:	a919a9b444ce65f18d828134ce16597d

Chronological Activities

Analysis Process: systemd PID: 5450, Parent PID: 1

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5450, Parent PID: 1

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: xfce4-panel PID: 5453, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5453, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5454, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5454, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5455, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5455, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5456, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5456, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5480, Parent PID: 5456

General

Start time (UTC):	20:12:41
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 5480, Parent PID: 5456

General

Start time (UTC):	20:12:41
Start date (UTC):	10/01/2025
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Chronological Activities

Analysis Process: xfce4-panel PID: 5457, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5457, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5458, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5458, Parent PID: 3147

General

Start time (UTC):	20:12:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: systemd PID: 5459, Parent PID: 1

General

Start time (UTC):	20:12:34
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5459, Parent PID: 1

General

Start time (UTC):	20:12:34
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: dbus-daemon PID: 5476, Parent PID: 5475

General

Start time (UTC):	20:12:40
Start date (UTC):	10/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 5476, Parent PID: 5475

General

Start time (UTC):	20:12:40
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: systemd PID: 5497, Parent PID: 1

General

Start time (UTC):	20:12:42
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5497, Parent PID: 1

General

Start time (UTC):	20:12:42
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5505, Parent PID: 1

General

Start time (UTC):	20:12:45
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5505, Parent PID: 1

General

Start time (UTC):	20:12:45
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5509, Parent PID: 1

General

Start time (UTC):	20:12:46
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5509, Parent PID: 1

General

Start time (UTC):	20:12:46
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5518, Parent PID: 1

General

Start time (UTC):	20:12:49
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5518, Parent PID: 1

General

Start time (UTC):	20:12:49
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5523, Parent PID: 1

General

Start time (UTC):	20:12:50
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5523, Parent PID: 1

General

Start time (UTC):	20:12:50
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5531, Parent PID: 1

General

Start time (UTC):	20:12:53
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5531, Parent PID: 1

General

Start time (UTC):	20:12:53
Start date (UTC):	10/01/2025
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report qbfwdbg.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: qbfwdbg.elf PID: 5426, Parent PID: 5346

General

Chronological Activities

Analysis Process: qbfwdbg.elf PID: 5427, Parent PID: 5426

General

Chronological Activities

Analysis Process: qbfwdbg.elf PID: 5428, Parent PID: 5426

General

Analysis Process: qbfwdbg.elf PID: 5429, Parent PID: 5426

General

Chronological Activities

Analysis Process: systemd PID: 5450, Parent PID: 1

General

Chronological Activities

Linux Analysis Report
qbfwdbg.elf