Edit tour

Linux Analysis Report
Space.x86.elf

Overview

General Information

Sample name:	Space.x86.elf
Analysis ID:	1589119
MD5:	3ad65bc28dc97b946f2f4cfe7af9dbcf
SHA1:	eb143e60b001f0ba83571365a6f081a3018001aa
SHA256:	2e447f7ec23cfe7329559c4acaf87f90be77d219004904b2652954e2ac492418
Tags:	user-elfdigest
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589119
Start date and time:	2025-01-11 10:29:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.x86.elf
Detection:	MAL
Classification:	mal64.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.x86.elf
PID:	5434
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.x86.elf (PID: 5434, Parent: 5357, MD5: 3ad65bc28dc97b946f2f4cfe7af9dbcf) Arguments: /tmp/Space.x86.elf

Space.x86.elf New Fork (PID: 5435, Parent: 5434)

Space.x86.elf New Fork (PID: 5436, Parent: 5435)

Space.x86.elf New Fork (PID: 5437, Parent: 5435)

Space.x86.elf New Fork (PID: 5446, Parent: 5434)

Space.x86.elf New Fork (PID: 5447, Parent: 5434)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5446.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5446.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5446.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5446.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5436.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5436.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5436.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5436.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5435.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5435.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5435.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5435.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5434.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5434.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
5434.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
5434.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: Space.x86.elf PID: 5434	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x160c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1620:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1634:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1648:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x165c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1670:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1684:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5435	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1407:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1443:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1457:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1493:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1533:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1583:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5436	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.x86.elf PID: 5446	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x655:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x669:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x691:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x709:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x731:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x745:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x759:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x781:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.x86.elf	Virustotal: Detection: 42%			Perma Link
Source: Space.x86.elf	ReversingLabs: Detection: 57%

Machine Learning detection for sample

Source: Space.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.13:59036 -> 212.81.47.243:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243
Source: unknown	TCP traffic detected without corresponding DNS query: 212.81.47.243

Source: Space.x86.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.x86.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5446.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5436.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5435.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: Space.x86.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5436, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.x86.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/5381/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/3632/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/5276/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Space.x86.elf (PID: 5434)	File opened: /proc/30/status	Jump to behavior

Source: Space.x86.elf

Submission file: segment LOAD with 7.964 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.x86.elf	43%	Virustotal		Browse
Space.x86.elf	58%	ReversingLabs	Linux.Backdoor.Mirai
Space.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.81.47.243	unknown	Germany		9009	M247GB	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	ssd.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssp.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sse.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	89.33.192.138
	ssi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	89.33.192.138
	ssc.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssl.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sst.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssx.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.962110899080558
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Space.x86.elf
File size:	38'724 bytes
MD5:	3ad65bc28dc97b946f2f4cfe7af9dbcf
SHA1:	eb143e60b001f0ba83571365a6f081a3018001aa
SHA256:	2e447f7ec23cfe7329559c4acaf87f90be77d219004904b2652954e2ac492418
SHA512:	2bd84b5b2ec383b815e5bd603abc3adf2501bb7eaa661529e1db13e9d48044c2378f808b159c1d6d87927f09ab72ab336faa3493694c14ba1eda6d21b45ba7ac
SSDEEP:	768:ea+BWS+ZPwIIBPGXna4nvdQL5zc6R96SMO/ieUeSMI1vmEHfnbcuyD7UrQRj+:ea+BH+hKBAa4Vcc6RwSMO/ieCME+WfnP
TLSH:	6403F11195DF9A91D7D552B81A3FFE0D30C1D33941292A62FDC06631AE68FAF263C982
File Content Preview:	.ELF....................X...4...........4. ...(.....................L...L...........................................Q.td.............................-..UPX!.........2...2......W..........?..k.I/.j....\.R......)..n.4go.\|.>#.....{~o....8.F.^...MFL.f.5 ..I.r

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc09458
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x964c	0x964c	7.9640	0x5	R E	0x1000
LOAD	0xc08	0x805bc08	0x805bc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 10:29:54.547272921 CET	59036	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:54.552314043 CET	3778	59036	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:54.552371979 CET	59036	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:54.552440882 CET	59036	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:54.557254076 CET	3778	59036	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:54.557293892 CET	59036	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:54.562128067 CET	3778	59036	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:55.467847109 CET	3778	59036	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:55.467910051 CET	59036	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:55.467945099 CET	59036	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:55.468013048 CET	59038	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:55.472839117 CET	3778	59038	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:55.472939014 CET	59038	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:55.472939014 CET	59038	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:55.477823019 CET	3778	59038	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:55.477864981 CET	59038	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:55.482691050 CET	3778	59038	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:56.426280022 CET	3778	59038	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:56.426532030 CET	59038	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:56.426532030 CET	59038	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:56.426615000 CET	59040	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:56.431684017 CET	3778	59040	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:56.431797028 CET	59040	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:56.431855917 CET	59040	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:56.436701059 CET	3778	59040	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:56.436768055 CET	59040	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:56.441631079 CET	3778	59040	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:57.342719078 CET	3778	59040	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:57.342948914 CET	59040	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:57.343012094 CET	59040	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:57.343077898 CET	59042	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:57.347917080 CET	3778	59042	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:57.348020077 CET	59042	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:57.348078012 CET	59042	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:57.352885962 CET	3778	59042	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:57.352968931 CET	59042	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:57.357863903 CET	3778	59042	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:58.258928061 CET	3778	59042	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:58.259092093 CET	59042	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:58.259151936 CET	59042	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:58.259195089 CET	59044	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:58.264048100 CET	3778	59044	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:58.264192104 CET	59044	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:58.264192104 CET	59044	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:58.269131899 CET	3778	59044	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:58.269191027 CET	59044	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:58.274084091 CET	3778	59044	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:59.155251980 CET	3778	59044	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:59.155466080 CET	59044	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:59.155466080 CET	59044	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:59.155534983 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:59.160351992 CET	3778	59046	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:59.160450935 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:59.160504103 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:59.165252924 CET	3778	59046	212.81.47.243	192.168.2.13
Jan 11, 2025 10:29:59.165370941 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:29:59.170176983 CET	3778	59046	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:00.659245968 CET	59048	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:00.664125919 CET	3778	59048	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:00.664200068 CET	59048	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:00.664231062 CET	59048	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:00.669099092 CET	3778	59048	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:00.669151068 CET	59048	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:00.674021006 CET	3778	59048	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:01.556617975 CET	3778	59048	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:01.556911945 CET	59048	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:01.556911945 CET	59048	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:01.556911945 CET	59050	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:01.561913967 CET	3778	59050	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:01.562024117 CET	59050	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:01.562048912 CET	59050	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:01.566925049 CET	3778	59050	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:01.566970110 CET	59050	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:01.571809053 CET	3778	59050	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:02.505692005 CET	3778	59050	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:02.505966902 CET	59050	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:02.505966902 CET	59050	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:02.506006002 CET	59052	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:02.510927916 CET	3778	59052	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:02.511039019 CET	59052	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:02.511039019 CET	59052	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:02.515897036 CET	3778	59052	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:02.516005993 CET	59052	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:02.520865917 CET	3778	59052	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:03.415432930 CET	3778	59052	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:03.415570974 CET	59052	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:03.415663004 CET	59052	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:03.415703058 CET	59054	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:03.420598984 CET	3778	59054	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:03.420658112 CET	59054	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:03.420680046 CET	59054	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:03.425534010 CET	3778	59054	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:03.425615072 CET	59054	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:03.430414915 CET	3778	59054	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:04.314342022 CET	3778	59054	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:04.314620018 CET	59054	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:04.314620018 CET	59054	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:04.314775944 CET	59056	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:04.319657087 CET	3778	59056	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:04.319766045 CET	59056	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:04.319840908 CET	59056	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:04.324667931 CET	3778	59056	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:04.324753046 CET	59056	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:04.329651117 CET	3778	59056	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:05.249005079 CET	3778	59056	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:05.249346018 CET	59056	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:05.249346018 CET	59056	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:05.249346018 CET	59058	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:05.255601883 CET	3778	59058	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:05.255757093 CET	59058	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:05.255824089 CET	59058	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:05.260665894 CET	3778	59058	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:05.260746956 CET	59058	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:05.265626907 CET	3778	59058	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:06.166150093 CET	3778	59058	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:06.166503906 CET	59060	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:06.166533947 CET	59058	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:06.166533947 CET	59058	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:06.172436953 CET	3778	59060	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:06.172532082 CET	59060	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:06.172606945 CET	59060	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:06.178517103 CET	3778	59060	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:06.178587914 CET	59060	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:06.183403015 CET	3778	59060	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:07.105458975 CET	3778	59060	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:07.105719090 CET	59060	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:07.105719090 CET	59060	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:07.105772018 CET	59062	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:07.110701084 CET	3778	59062	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:07.110852957 CET	59062	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:07.110904932 CET	59062	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:07.115731001 CET	3778	59062	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:07.115806103 CET	59062	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:07.120614052 CET	3778	59062	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.012655020 CET	3778	59062	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.012793064 CET	59062	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.012830973 CET	59062	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.012893915 CET	59064	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.017759085 CET	3778	59064	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.017828941 CET	59064	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.017895937 CET	59064	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.022656918 CET	3778	59064	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.022743940 CET	59064	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.027565956 CET	3778	59064	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.916071892 CET	3778	59064	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.916338921 CET	59066	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.916369915 CET	59064	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.916369915 CET	59064	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.921273947 CET	3778	59066	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.921406031 CET	59066	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.921484947 CET	59066	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.926325083 CET	3778	59066	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:08.926390886 CET	59066	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:08.931189060 CET	3778	59066	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:09.170577049 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.175550938 CET	3778	59046	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:09.504220963 CET	3778	59046	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:09.504348040 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.841867924 CET	3778	59066	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:09.842067957 CET	59066	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.842109919 CET	59066	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.842207909 CET	59068	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.847137928 CET	3778	59068	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:09.847266912 CET	59068	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.847337961 CET	59068	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.852231026 CET	3778	59068	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:09.852297068 CET	59068	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:09.857141972 CET	3778	59068	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:10.744678020 CET	3778	59068	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:10.744831085 CET	59068	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:10.744918108 CET	59068	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:10.744985104 CET	59070	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:10.749872923 CET	3778	59070	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:10.750005007 CET	59070	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:10.750102043 CET	59070	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:10.754956007 CET	3778	59070	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:10.755008936 CET	59070	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:10.759944916 CET	3778	59070	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:11.660178900 CET	3778	59070	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:11.660398006 CET	59070	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:11.660398006 CET	59070	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:11.660453081 CET	59072	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:11.665357113 CET	3778	59072	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:11.665427923 CET	59072	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:11.665457964 CET	59072	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:11.670259953 CET	3778	59072	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:11.670326948 CET	59072	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:11.675225973 CET	3778	59072	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:12.606838942 CET	3778	59072	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:12.607160091 CET	59072	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:12.607161045 CET	59072	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:12.607254028 CET	59074	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:12.612339973 CET	3778	59074	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:12.612590075 CET	59074	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:12.612591028 CET	59074	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:12.617547989 CET	3778	59074	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:12.617785931 CET	59074	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:12.622658014 CET	3778	59074	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:13.517343998 CET	3778	59074	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:13.517695904 CET	59074	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:13.517776012 CET	59074	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:13.517863989 CET	59076	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:13.522799969 CET	3778	59076	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:13.522947073 CET	59076	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:13.523003101 CET	59076	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:13.527818918 CET	3778	59076	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:13.527889013 CET	59076	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:13.532726049 CET	3778	59076	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:14.414261103 CET	3778	59076	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:14.414493084 CET	59076	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:14.414551020 CET	59076	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:14.414611101 CET	59078	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:14.419476986 CET	3778	59078	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:14.419600010 CET	59078	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:14.419650078 CET	59078	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:14.424479008 CET	3778	59078	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:14.424612045 CET	59078	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:14.429523945 CET	3778	59078	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:15.330960989 CET	3778	59078	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:15.331167936 CET	59078	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:15.331243992 CET	59078	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:15.331353903 CET	59080	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:15.336270094 CET	3778	59080	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:15.336411953 CET	59080	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:15.336452961 CET	59080	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:15.341291904 CET	3778	59080	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:15.341398001 CET	59080	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:15.346298933 CET	3778	59080	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:16.229176998 CET	3778	59080	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:16.229335070 CET	59080	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:16.229417086 CET	59080	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:16.229444981 CET	59082	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:16.234318972 CET	3778	59082	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:16.234448910 CET	59082	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:16.234499931 CET	59082	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:16.239348888 CET	3778	59082	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:16.239423037 CET	59082	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:16.244402885 CET	3778	59082	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:17.128149033 CET	3778	59082	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:17.128273010 CET	59082	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:17.128334999 CET	59082	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:17.128412962 CET	59084	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:17.133846998 CET	3778	59084	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:17.133954048 CET	59084	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:17.133991957 CET	59084	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:17.139126062 CET	3778	59084	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:17.139204979 CET	59084	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:17.144371986 CET	3778	59084	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.044071913 CET	3778	59084	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.044295073 CET	59084	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.044295073 CET	59084	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.044359922 CET	59086	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.049185991 CET	3778	59086	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.049292088 CET	59086	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.049350977 CET	59086	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.054160118 CET	3778	59086	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.054235935 CET	59086	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.059103012 CET	3778	59086	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.953862906 CET	3778	59086	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.954308987 CET	59086	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.954308987 CET	59086	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.954356909 CET	59088	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.959219933 CET	3778	59088	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.959312916 CET	59088	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.959384918 CET	59088	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.964202881 CET	3778	59088	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:18.964282036 CET	59088	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:18.969077110 CET	3778	59088	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:19.862471104 CET	3778	59088	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:19.862689972 CET	59088	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:19.862771034 CET	59088	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:19.862855911 CET	59090	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:19.867671967 CET	3778	59090	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:19.867772102 CET	59090	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:19.867839098 CET	59090	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:19.872652054 CET	3778	59090	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:19.872721910 CET	59090	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:19.877654076 CET	3778	59090	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:20.806375027 CET	3778	59090	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:20.806663990 CET	59090	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:20.806755066 CET	59090	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:20.806804895 CET	59092	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:20.811676025 CET	3778	59092	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:20.811777115 CET	59092	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:20.811830997 CET	59092	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:20.816632986 CET	3778	59092	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:20.816705942 CET	59092	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:20.821546078 CET	3778	59092	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:21.737478971 CET	3778	59092	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:21.737704039 CET	59092	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:21.737778902 CET	59092	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:21.737859011 CET	59094	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:21.742732048 CET	3778	59094	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:21.742861032 CET	59094	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:21.742893934 CET	59094	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:21.747756004 CET	3778	59094	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:21.747833014 CET	59094	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:21.752707005 CET	3778	59094	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:22.656940937 CET	3778	59094	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:22.657253981 CET	59094	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:22.657334089 CET	59094	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:22.657351971 CET	59096	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:22.662298918 CET	3778	59096	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:22.662389040 CET	59096	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:22.662446976 CET	59096	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:22.667262077 CET	3778	59096	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:22.667370081 CET	59096	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:22.672300100 CET	3778	59096	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:23.606107950 CET	3778	59096	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:23.606306076 CET	59096	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:23.606460094 CET	59096	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:23.606549978 CET	59098	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:23.611443043 CET	3778	59098	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:23.611535072 CET	59098	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:23.611588001 CET	59098	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:23.616400957 CET	3778	59098	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:23.616472960 CET	59098	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:23.621335030 CET	3778	59098	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:24.514117956 CET	3778	59098	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:24.514288902 CET	59098	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:24.514338017 CET	59098	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:24.514425993 CET	59100	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:24.519355059 CET	3778	59100	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:24.519474983 CET	59100	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:24.519515991 CET	59100	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:24.524327993 CET	3778	59100	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:24.524406910 CET	59100	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:24.529329062 CET	3778	59100	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:25.424768925 CET	3778	59100	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:25.424953938 CET	59100	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:25.425043106 CET	59100	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:25.425043106 CET	59102	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:25.430052042 CET	3778	59102	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:25.430159092 CET	59102	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:25.430224895 CET	59102	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:25.435041904 CET	3778	59102	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:25.435122967 CET	59102	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:25.439970016 CET	3778	59102	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:26.343749046 CET	3778	59102	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:26.344146967 CET	59102	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:26.344146967 CET	59102	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:26.344235897 CET	59104	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:26.349127054 CET	3778	59104	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:26.349210978 CET	59104	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:26.349293947 CET	59104	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:26.354146004 CET	3778	59104	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:26.354257107 CET	59104	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:26.359075069 CET	3778	59104	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:27.306911945 CET	3778	59104	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:27.307132959 CET	59104	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:27.307209015 CET	59104	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:27.307280064 CET	59106	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:27.312077045 CET	3778	59106	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:27.312165976 CET	59106	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:27.312227964 CET	59106	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:27.317045927 CET	3778	59106	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:27.317109108 CET	59106	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:27.322372913 CET	3778	59106	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:28.225574970 CET	3778	59106	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:28.225794077 CET	59106	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:28.225794077 CET	59106	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:28.225853920 CET	59108	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:28.230680943 CET	3778	59108	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:28.230761051 CET	59108	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:28.230829954 CET	59108	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:28.235625982 CET	3778	59108	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:28.235744953 CET	59108	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:28.240570068 CET	3778	59108	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:29.139965057 CET	3778	59108	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:29.140207052 CET	59108	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:29.140207052 CET	59108	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:29.140265942 CET	59110	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:29.145067930 CET	3778	59110	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:29.145188093 CET	59110	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:29.145246983 CET	59110	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:29.150069952 CET	3778	59110	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:29.150162935 CET	59110	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:29.155008078 CET	3778	59110	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.051631927 CET	3778	59110	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.051822901 CET	59110	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.051877022 CET	59110	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.051883936 CET	59112	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.056715012 CET	3778	59112	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.056806087 CET	59112	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.056832075 CET	59112	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.061662912 CET	3778	59112	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.061791897 CET	59112	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.066617012 CET	3778	59112	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.966820002 CET	3778	59112	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.967025042 CET	59112	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.967050076 CET	59112	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.967068911 CET	59114	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.971888065 CET	3778	59114	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.971951008 CET	59114	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.971977949 CET	59114	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.976757050 CET	3778	59114	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:30.976808071 CET	59114	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:30.981578112 CET	3778	59114	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:31.902442932 CET	3778	59114	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:31.902726889 CET	59114	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:31.902813911 CET	59114	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:31.902901888 CET	59116	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:31.907727957 CET	3778	59116	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:31.907851934 CET	59116	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:31.907905102 CET	59116	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:31.912749052 CET	3778	59116	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:31.912827969 CET	59116	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:31.917670012 CET	3778	59116	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:32.824538946 CET	3778	59116	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:32.824732065 CET	59116	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:32.824794054 CET	59116	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:32.824861050 CET	59118	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:32.829782963 CET	3778	59118	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:32.829876900 CET	59118	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:32.829952955 CET	59118	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:32.834791899 CET	3778	59118	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:32.834858894 CET	59118	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:32.839719057 CET	3778	59118	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:33.731889963 CET	3778	59118	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:33.732214928 CET	59118	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:33.732319117 CET	59118	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:33.732355118 CET	59120	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:33.737320900 CET	3778	59120	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:33.737409115 CET	59120	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:33.737478018 CET	59120	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:33.742269039 CET	3778	59120	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:33.742335081 CET	59120	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:33.747185946 CET	3778	59120	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:34.631290913 CET	3778	59120	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:34.631414890 CET	59120	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:34.631416082 CET	59120	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:34.631503105 CET	59122	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:34.636347055 CET	3778	59122	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:34.636465073 CET	59122	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:34.636497974 CET	59122	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:34.641292095 CET	3778	59122	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:34.641383886 CET	59122	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:34.646153927 CET	3778	59122	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:35.532742023 CET	3778	59122	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:35.532938957 CET	59122	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:35.532938957 CET	59122	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:35.532974958 CET	59124	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:35.537854910 CET	3778	59124	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:35.537928104 CET	59124	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:35.537970066 CET	59124	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:35.542838097 CET	3778	59124	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:35.542939901 CET	59124	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:35.547800064 CET	3778	59124	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:36.433049917 CET	3778	59124	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:36.433331966 CET	59124	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:36.433495045 CET	59124	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:36.433495045 CET	59126	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:36.438425064 CET	3778	59126	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:36.438533068 CET	59126	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:36.438605070 CET	59126	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:36.443448067 CET	3778	59126	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:36.443557978 CET	59126	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:36.448405981 CET	3778	59126	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:37.349503994 CET	3778	59126	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:37.349817991 CET	59126	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:37.349939108 CET	59126	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:37.350018978 CET	59128	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:37.354851961 CET	3778	59128	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:37.354959965 CET	59128	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:37.355001926 CET	59128	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:37.359818935 CET	3778	59128	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:37.359911919 CET	59128	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:37.364705086 CET	3778	59128	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:38.270266056 CET	3778	59128	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:38.270400047 CET	59128	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:38.270482063 CET	59128	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:38.270534992 CET	59130	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:38.275451899 CET	3778	59130	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:38.275538921 CET	59130	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:38.275592089 CET	59130	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:38.280417919 CET	3778	59130	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:38.280529022 CET	59130	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:38.285422087 CET	3778	59130	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:39.221920967 CET	3778	59130	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:39.222138882 CET	59130	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:39.222212076 CET	59130	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:39.222234011 CET	59132	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:39.227118969 CET	3778	59132	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:39.227233887 CET	59132	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:39.227288961 CET	59132	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:39.232109070 CET	3778	59132	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:39.232182980 CET	59132	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:39.237107992 CET	3778	59132	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:40.121159077 CET	3778	59132	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:40.121539116 CET	59132	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:40.121684074 CET	59132	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:40.121753931 CET	59134	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:40.126601934 CET	3778	59134	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:40.126687050 CET	59134	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:40.126777887 CET	59134	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:40.131561995 CET	3778	59134	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:40.131623030 CET	59134	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:40.136466980 CET	3778	59134	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.022209883 CET	3778	59134	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.022546053 CET	59134	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.022602081 CET	59134	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.022675037 CET	59136	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.027622938 CET	3778	59136	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.027756929 CET	59136	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.027800083 CET	59136	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.032696009 CET	3778	59136	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.032825947 CET	59136	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.037713051 CET	3778	59136	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.940318108 CET	3778	59136	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.940515041 CET	59136	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.940650940 CET	59136	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.940732002 CET	59138	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.945614100 CET	3778	59138	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.945713043 CET	59138	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.945787907 CET	59138	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.950611115 CET	3778	59138	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:41.950709105 CET	59138	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:41.955523968 CET	3778	59138	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:42.854984999 CET	3778	59138	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:42.855343103 CET	59138	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:42.855422974 CET	59138	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:42.855462074 CET	59140	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:42.860389948 CET	3778	59140	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:42.860522032 CET	59140	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:42.860574961 CET	59140	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:42.865344048 CET	3778	59140	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:42.865423918 CET	59140	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:42.870326996 CET	3778	59140	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:43.768733025 CET	3778	59140	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:43.769103050 CET	59140	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:43.769234896 CET	59140	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:43.769318104 CET	59142	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:43.774202108 CET	3778	59142	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:43.774300098 CET	59142	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:43.774374008 CET	59142	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:43.779263020 CET	3778	59142	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:43.779355049 CET	59142	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:43.784214020 CET	3778	59142	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:44.702244043 CET	3778	59142	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:44.702416897 CET	59142	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:44.702474117 CET	59142	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:44.702538013 CET	59144	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:44.707463026 CET	3778	59144	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:44.707547903 CET	59144	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:44.707618952 CET	59144	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:44.712479115 CET	3778	59144	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:44.712552071 CET	59144	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:44.717358112 CET	3778	59144	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:45.624954939 CET	3778	59144	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:45.625490904 CET	59144	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:45.625490904 CET	59144	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:45.625490904 CET	59146	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:45.630574942 CET	3778	59146	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:45.630727053 CET	59146	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:45.630773067 CET	59146	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:45.635587931 CET	3778	59146	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:45.635683060 CET	59146	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:45.640470028 CET	3778	59146	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:46.541457891 CET	3778	59146	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:46.541965008 CET	59146	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:46.541965008 CET	59146	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:46.542006016 CET	59148	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:46.546960115 CET	3778	59148	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:46.547053099 CET	59148	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:46.547131062 CET	59148	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:46.551939964 CET	3778	59148	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:46.552010059 CET	59148	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:46.556869030 CET	3778	59148	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:47.451239109 CET	3778	59148	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:47.451416016 CET	59148	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:47.451452017 CET	59148	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:47.451466084 CET	59150	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:47.456352949 CET	3778	59150	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:47.456470966 CET	59150	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:47.456470966 CET	59150	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:47.461354971 CET	3778	59150	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:47.461425066 CET	59150	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:47.466357946 CET	3778	59150	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:48.371684074 CET	3778	59150	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:48.372030973 CET	59150	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:48.372128963 CET	59150	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:48.372342110 CET	59152	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:48.377197981 CET	3778	59152	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:48.377285004 CET	59152	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:48.377343893 CET	59152	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:48.382118940 CET	3778	59152	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:48.382189989 CET	59152	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:48.386957884 CET	3778	59152	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:49.325504065 CET	3778	59152	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:49.325731993 CET	59152	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:49.325731993 CET	59152	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:49.325731993 CET	59154	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:49.333122969 CET	3778	59154	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:49.333185911 CET	59154	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:49.333204031 CET	59154	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:49.340363979 CET	3778	59154	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:49.340421915 CET	59154	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:49.345899105 CET	3778	59154	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:50.232578993 CET	3778	59154	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:50.232800961 CET	59154	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:50.232839108 CET	59154	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:50.232992887 CET	59156	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:50.237905979 CET	3778	59156	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:50.238024950 CET	59156	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:50.238065958 CET	59156	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:50.242913961 CET	3778	59156	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:50.242993116 CET	59156	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:50.247786999 CET	3778	59156	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:51.139765978 CET	3778	59156	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:51.140010118 CET	59156	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:51.140156984 CET	59156	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:51.140156984 CET	59158	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:51.145070076 CET	3778	59158	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:51.145180941 CET	59158	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:51.145220041 CET	59158	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:51.150099039 CET	3778	59158	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:51.150171041 CET	59158	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:51.154968023 CET	3778	59158	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.048032999 CET	3778	59158	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.048459053 CET	59160	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.048532963 CET	59158	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.048533916 CET	59158	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.053345919 CET	3778	59160	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.053442001 CET	59160	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.053483009 CET	59160	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.058299065 CET	3778	59160	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.058352947 CET	59160	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.063283920 CET	3778	59160	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.974828959 CET	3778	59160	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.975028038 CET	59162	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.975028038 CET	59160	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.975028038 CET	59160	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.980010986 CET	3778	59162	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.980109930 CET	59162	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.980129957 CET	59162	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.985021114 CET	3778	59162	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:52.985096931 CET	59162	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:52.989972115 CET	3778	59162	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:53.920325994 CET	3778	59162	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:53.920614958 CET	59162	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:53.920614958 CET	59162	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:53.920658112 CET	59164	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:53.925549030 CET	3778	59164	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:53.925648928 CET	59164	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:53.925712109 CET	59164	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:53.930562019 CET	3778	59164	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:53.930645943 CET	59164	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:53.935472012 CET	3778	59164	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:54.828452110 CET	3778	59164	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:54.828674078 CET	59164	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:54.828674078 CET	59164	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:54.828742981 CET	59166	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:54.833642006 CET	3778	59166	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:54.833748102 CET	59166	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:54.833801985 CET	59166	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:54.838665962 CET	3778	59166	212.81.47.243	192.168.2.13
Jan 11, 2025 10:30:54.838748932 CET	59166	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:30:54.843611956 CET	3778	59166	212.81.47.243	192.168.2.13
Jan 11, 2025 10:31:04.843931913 CET	59166	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:31:04.849066019 CET	3778	59166	212.81.47.243	192.168.2.13
Jan 11, 2025 10:31:05.161534071 CET	3778	59166	212.81.47.243	192.168.2.13
Jan 11, 2025 10:31:05.161730051 CET	59166	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:31:09.560388088 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:31:09.565495014 CET	3778	59046	212.81.47.243	192.168.2.13
Jan 11, 2025 10:31:09.904486895 CET	3778	59046	212.81.47.243	192.168.2.13
Jan 11, 2025 10:31:09.904771090 CET	59046	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:32:05.206371069 CET	59166	3778	192.168.2.13	212.81.47.243
Jan 11, 2025 10:32:05.211538076 CET	3778	59166	212.81.47.243	192.168.2.13
Jan 11, 2025 10:32:05.524811029 CET	3778	59166	212.81.47.243	192.168.2.13
Jan 11, 2025 10:32:05.525248051 CET	59166	3778	192.168.2.13	212.81.47.243

System Behavior

Analysis Process: Space.x86.elf PID: 5434, Parent PID: 5357

General

Start time (UTC):	09:29:53
Start date (UTC):	11/01/2025
Path:	/tmp/Space.x86.elf
Arguments:	/tmp/Space.x86.elf
File size:	38724 bytes
MD5 hash:	3ad65bc28dc97b946f2f4cfe7af9dbcf

Chronological Activities

Analysis Process: Space.x86.elf PID: 5435, Parent PID: 5434

General

Start time (UTC):	09:29:53
Start date (UTC):	11/01/2025
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	3ad65bc28dc97b946f2f4cfe7af9dbcf

Chronological Activities

Analysis Process: Space.x86.elf PID: 5436, Parent PID: 5435

General

Start time (UTC):	09:29:53
Start date (UTC):	11/01/2025
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	3ad65bc28dc97b946f2f4cfe7af9dbcf

Chronological Activities

Analysis Process: Space.x86.elf PID: 5437, Parent PID: 5435

General

Start time (UTC):	09:29:53
Start date (UTC):	11/01/2025
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	3ad65bc28dc97b946f2f4cfe7af9dbcf

Analysis Process: Space.x86.elf PID: 5446, Parent PID: 5434

General

Start time (UTC):	09:29:59
Start date (UTC):	11/01/2025
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	3ad65bc28dc97b946f2f4cfe7af9dbcf

Chronological Activities

Analysis Process: Space.x86.elf PID: 5447, Parent PID: 5434

General

Start time (UTC):	09:29:59
Start date (UTC):	11/01/2025
Path:	/tmp/Space.x86.elf
Arguments:	-
File size:	38724 bytes
MD5 hash:	3ad65bc28dc97b946f2f4cfe7af9dbcf

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.x86.elf PID: 5434, Parent PID: 5357

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5435, Parent PID: 5434

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5436, Parent PID: 5435

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5437, Parent PID: 5435

General

Analysis Process: Space.x86.elf PID: 5446, Parent PID: 5434

General

Chronological Activities

Analysis Process: Space.x86.elf PID: 5447, Parent PID: 5434

General

Linux Analysis Report
Space.x86.elf