Edit tour

Linux Analysis Report
camp.x86_64.elf

Overview

General Information

Sample name:	camp.x86_64.elf
Analysis ID:	1590313
MD5:	5872e361c75eb6d934fec4f7ae32dc70
SHA1:	6d5c97236ba057e124b51445d49e5df7602fa915
SHA256:	e5dd3b3de502814e1bc66d6b3bb3244eb848cb299b85c323586347d939563f1d
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590313
Start date and time:	2025-01-13 23:17:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	camp.x86_64.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/camp.x86_64.elf
PID:	5445
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

camp.x86_64.elf (PID: 5445, Parent: 5370, MD5: 5872e361c75eb6d934fec4f7ae32dc70) Arguments: /tmp/camp.x86_64.elf

camp.x86_64.elf New Fork (PID: 5446, Parent: 5445)

camp.x86_64.elf New Fork (PID: 5447, Parent: 5446)

camp.x86_64.elf New Fork (PID: 5448, Parent: 5446)

camp.x86_64.elf New Fork (PID: 5457, Parent: 5445)

camp.x86_64.elf New Fork (PID: 5458, Parent: 5445)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5446.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x231a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x241d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5446.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5457.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x231a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x241d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5457.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5447.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x231a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x241d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5447.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5445.1.0000000000400000.0000000000412000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9d48:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa537:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x76c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x77d0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xde2a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa0f7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9782:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa3c2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x997b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x231a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x57df:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x241d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5445.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4832:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: camp.x86_64.elf PID: 5445	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.x86_64.elf PID: 5445	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xadf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.x86_64.elf PID: 5446	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.x86_64.elf PID: 5446	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xcf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.x86_64.elf PID: 5447	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.x86_64.elf PID: 5447	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x62c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.x86_64.elf PID: 5457	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.x86_64.elf PID: 5457	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1635:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1649:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x165d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1671:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1685:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1699:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1711:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1739:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1761:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1775:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1789:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x179d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 59 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: camp.x86_64.elf	Virustotal: Detection: 39%			Perma Link
Source: camp.x86_64.elf	ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: camp.x86_64.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.13:60410 -> 154.213.187.11:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11

Source: camp.x86_64.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: camp.x86_64.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.x86_64.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.x86_64.elf PID: 5447, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.x86_64.elf PID: 5457, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x100000

Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: camp.x86_64.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.x86_64.elf PID: 5446, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.x86_64.elf PID: 5447, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.x86_64.elf PID: 5457, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/3635/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/5392/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/5287/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/camp.x86_64.elf (PID: 5445)	File opened: /proc/3777/status	Jump to behavior

Source: camp.x86_64.elf

Submission file: segment LOAD with 7.9634 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5446, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5447, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5457, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5446.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5457.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5447.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5445.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5446, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5447, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.x86_64.elf PID: 5457, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
camp.x86_64.elf	40%	Virustotal		Browse
camp.x86_64.elf	39%	ReversingLabs	Linux.Backdoor.Mirai
camp.x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	camp.x86_64.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.213.187.11	unknown	Seychelles		22769	DDOSING-BGP-NETWORKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.213.187.11	camp.sh4.elf	Get hash	malicious	Mirai	Browse
	camp.spc.elf	Get hash	malicious	Mirai	Browse
	camp.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DDOSING-BGP-NETWORKUS	hikarm4.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	hikarm7.elf	Get hash	malicious	Mirai	Browse	154.213.187.125
	hikarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	gx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	camp.sh4.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.spc.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.x86.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	mpsl.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	arm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	x86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.961380687131556
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	camp.x86_64.elf
File size:	36'916 bytes
MD5:	5872e361c75eb6d934fec4f7ae32dc70
SHA1:	6d5c97236ba057e124b51445d49e5df7602fa915
SHA256:	e5dd3b3de502814e1bc66d6b3bb3244eb848cb299b85c323586347d939563f1d
SHA512:	c05b6151584da7ba6724ce780287cdf96e26d3489f633e195ac34af21d4ad3d7ca73df53535aed6d9fe01d45b790613d0856d33be05e66c69b571970fa02a448
SSDEEP:	768:AwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKT1oS7tUx0nZG:rOX80VqVi2otGtzXEqMZG
TLSH:	91F2E135C2FDE978C03F74390D5D4A4AB983E9625A26372A0525A2B99FF79C43D01AC1
File Content Preview:	.ELF..............>......}......@...................@.8...@.....................................4.......4................................VQ......VQ.............................Q.td....................................................BGI.UPX!D.......P'..P'.

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x107df8
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x8f34	0x8f34	7.9634	0x5	R E	0x100000
LOAD	0x6e8	0x5156e8	0x5156e8	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 23:18:03.110193968 CET	60410	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:03.115370035 CET	3778	60410	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:03.115439892 CET	60410	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:03.120482922 CET	60410	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:03.125474930 CET	3778	60410	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:03.125530005 CET	60410	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:03.130377054 CET	3778	60410	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:04.753120899 CET	3778	60410	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:04.753386021 CET	60410	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:04.758285046 CET	3778	60410	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:05.755644083 CET	60412	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:05.760632038 CET	3778	60412	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:05.760843039 CET	60412	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:05.763098001 CET	60412	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:05.768043041 CET	3778	60412	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:05.768117905 CET	60412	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:05.772937059 CET	3778	60412	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:07.394686937 CET	3778	60412	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:07.395000935 CET	60412	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:07.400516033 CET	3778	60412	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:08.396701097 CET	60414	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.401866913 CET	3778	60414	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:08.402041912 CET	60414	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.402694941 CET	60414	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.407655001 CET	3778	60414	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:08.407712936 CET	60414	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.412580013 CET	3778	60414	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:08.555139065 CET	60416	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.561985016 CET	3778	60416	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:08.562050104 CET	60416	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.565973997 CET	60416	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.570761919 CET	3778	60416	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:08.570807934 CET	60416	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:08.575624943 CET	3778	60416	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:10.016333103 CET	3778	60414	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:10.016940117 CET	60414	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:10.022587061 CET	3778	60414	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:10.153379917 CET	3778	60416	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:10.153794050 CET	60416	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:10.159178972 CET	3778	60416	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:11.024224043 CET	60418	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.029618979 CET	3778	60418	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:11.029762030 CET	60418	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.033994913 CET	60418	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.038992882 CET	3778	60418	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:11.039186001 CET	60418	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.044018984 CET	3778	60418	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:11.159322023 CET	60420	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.164829016 CET	3778	60420	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:11.165154934 CET	60420	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.167059898 CET	60420	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.172158003 CET	3778	60420	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:11.172230005 CET	60420	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:11.177115917 CET	3778	60420	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:12.660751104 CET	3778	60418	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:12.661463976 CET	60418	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:12.666860104 CET	3778	60418	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:12.811367989 CET	3778	60420	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:12.812211990 CET	60420	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:12.817625999 CET	3778	60420	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:13.667515993 CET	60422	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.673106909 CET	3778	60422	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:13.673388004 CET	60422	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.675867081 CET	60422	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.681327105 CET	3778	60422	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:13.681529999 CET	60422	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.686990023 CET	3778	60422	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:13.818635941 CET	60424	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.824151993 CET	3778	60424	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:13.824588060 CET	60424	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.826339006 CET	60424	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.831629038 CET	3778	60424	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:13.832081079 CET	60424	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:13.837702990 CET	3778	60424	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:15.278914928 CET	3778	60422	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:15.279481888 CET	60422	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:15.284436941 CET	3778	60422	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:15.458878994 CET	3778	60424	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:15.459142923 CET	60424	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:15.464493036 CET	3778	60424	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:16.282248974 CET	60426	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.287625074 CET	3778	60426	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:16.287708998 CET	60426	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.289294958 CET	60426	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.294109106 CET	3778	60426	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:16.294178009 CET	60426	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.299031973 CET	3778	60426	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:16.464081049 CET	60428	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.469331026 CET	3778	60428	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:16.469532967 CET	60428	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.471592903 CET	60428	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.476537943 CET	3778	60428	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:16.476602077 CET	60428	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:16.481362104 CET	3778	60428	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:17.890338898 CET	3778	60426	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:17.891005039 CET	60426	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:17.895934105 CET	3778	60426	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:18.060420990 CET	3778	60428	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:18.060841084 CET	60428	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:18.066608906 CET	3778	60428	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:18.896013021 CET	60430	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:18.901480913 CET	3778	60430	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:18.901731968 CET	60430	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:18.903738976 CET	60430	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:18.908957958 CET	3778	60430	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:18.909270048 CET	60430	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:18.914710045 CET	3778	60430	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:19.067938089 CET	60432	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:19.073497057 CET	3778	60432	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:19.073646069 CET	60432	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:19.075943947 CET	60432	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:19.081185102 CET	3778	60432	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:19.081278086 CET	60432	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:19.086174011 CET	3778	60432	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:20.565443993 CET	3778	60430	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:20.565973043 CET	60430	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:20.571261883 CET	3778	60430	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:20.687900066 CET	3778	60432	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:20.688394070 CET	60432	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:20.693730116 CET	3778	60432	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:21.571563959 CET	60434	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.576792955 CET	3778	60434	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:21.577159882 CET	60434	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.578766108 CET	60434	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.583633900 CET	3778	60434	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:21.583730936 CET	60434	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.588824987 CET	3778	60434	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:21.693393946 CET	60436	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.699775934 CET	3778	60436	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:21.699870110 CET	60436	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.701910973 CET	60436	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.707243919 CET	3778	60436	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:21.707359076 CET	60436	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:21.716394901 CET	3778	60436	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:23.222935915 CET	3778	60434	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:23.223417044 CET	60434	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:23.228339911 CET	3778	60434	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:23.348731995 CET	3778	60436	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:23.349315882 CET	60436	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:23.354759932 CET	3778	60436	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:24.227751017 CET	60438	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.353168011 CET	60440	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.785826921 CET	3778	60438	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:24.785857916 CET	3778	60440	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:24.785985947 CET	60438	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.786003113 CET	60440	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.788949013 CET	60440	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.789151907 CET	60438	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.794585943 CET	3778	60440	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:24.794615984 CET	3778	60438	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:24.794652939 CET	60440	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.794682026 CET	60438	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:24.799608946 CET	3778	60440	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:24.799635887 CET	3778	60438	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:26.406902075 CET	3778	60440	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:26.407455921 CET	60440	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:26.412573099 CET	3778	60440	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:26.422249079 CET	3778	60438	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:26.422558069 CET	60438	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:26.427593946 CET	3778	60438	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:27.413425922 CET	60442	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.418612957 CET	3778	60442	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:27.419003963 CET	60442	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.420649052 CET	60442	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.424906015 CET	60444	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.425470114 CET	3778	60442	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:27.425538063 CET	60442	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.429806948 CET	3778	60444	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:27.429928064 CET	60444	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.430366993 CET	3778	60442	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:27.431524038 CET	60444	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.436384916 CET	3778	60444	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:27.436460018 CET	60444	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:27.441273928 CET	3778	60444	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:29.064115047 CET	3778	60444	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:29.064599037 CET	60444	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:29.069772005 CET	3778	60444	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:29.101167917 CET	3778	60442	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:29.101680040 CET	60442	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:29.107187986 CET	3778	60442	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:30.069749117 CET	60446	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.074620962 CET	3778	60446	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:30.074697971 CET	60446	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.076169014 CET	60446	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.080988884 CET	3778	60446	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:30.081111908 CET	60446	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.085947037 CET	3778	60446	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:30.106069088 CET	60448	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.111502886 CET	3778	60448	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:30.111710072 CET	60448	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.113240004 CET	60448	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.118376017 CET	3778	60448	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:30.118447065 CET	60448	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:30.123456955 CET	3778	60448	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:31.670017004 CET	3778	60446	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:31.670381069 CET	60446	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:31.675498962 CET	3778	60446	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:31.747131109 CET	3778	60448	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:31.747467995 CET	60448	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:31.752962112 CET	3778	60448	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:32.674576998 CET	60450	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.679565907 CET	3778	60450	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:32.679692984 CET	60450	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.681431055 CET	60450	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.686371088 CET	3778	60450	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:32.686496019 CET	60450	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.691310883 CET	3778	60450	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:32.752971888 CET	60452	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.758514881 CET	3778	60452	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:32.758913040 CET	60452	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.761387110 CET	60452	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.766485929 CET	3778	60452	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:32.766781092 CET	60452	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:32.771936893 CET	3778	60452	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:34.334640980 CET	3778	60450	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:34.335282087 CET	60450	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:34.340749025 CET	3778	60450	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:34.372106075 CET	3778	60452	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:34.372798920 CET	60452	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:34.377988100 CET	3778	60452	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:35.339324951 CET	60454	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.344537020 CET	3778	60454	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:35.344691992 CET	60454	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.346039057 CET	60454	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.350847960 CET	3778	60454	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:35.350908041 CET	60454	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.355690002 CET	3778	60454	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:35.377234936 CET	60456	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.382395029 CET	3778	60456	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:35.382556915 CET	60456	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.383940935 CET	60456	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.388848066 CET	3778	60456	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:35.388925076 CET	60456	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:35.393836975 CET	3778	60456	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:36.989167929 CET	3778	60454	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:36.989564896 CET	60454	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:36.994503021 CET	3778	60454	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:37.008265018 CET	3778	60456	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:37.008593082 CET	60456	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:37.013525009 CET	3778	60456	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:37.992821932 CET	60458	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:37.997781992 CET	3778	60458	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:37.997869015 CET	60458	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:37.999371052 CET	60458	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:38.004152060 CET	3778	60458	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:38.004220963 CET	60458	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:38.009088039 CET	3778	60458	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:38.011624098 CET	60460	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:38.016522884 CET	3778	60460	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:38.016591072 CET	60460	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:38.018048048 CET	60460	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:38.022969961 CET	3778	60460	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:38.023015022 CET	60460	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:38.027784109 CET	3778	60460	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:39.655407906 CET	3778	60458	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:39.656008005 CET	60458	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:39.660495996 CET	3778	60460	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:39.660636902 CET	60460	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:39.661165953 CET	3778	60458	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:39.665473938 CET	3778	60460	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:40.661484003 CET	60462	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.663228989 CET	60464	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.666651011 CET	3778	60462	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:40.666742086 CET	60462	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.668555975 CET	60462	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.668617010 CET	3778	60464	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:40.668725014 CET	60464	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.669975996 CET	60464	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.674026012 CET	3778	60462	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:40.674484968 CET	60462	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.674833059 CET	3778	60464	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:40.675019026 CET	60464	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:40.679693937 CET	3778	60462	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:40.680138111 CET	3778	60464	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:42.264132023 CET	3778	60462	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:42.264692068 CET	60462	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:42.270075083 CET	3778	60462	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:42.301028967 CET	3778	60464	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:42.301589012 CET	60464	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:42.306843996 CET	3778	60464	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:43.269467115 CET	60466	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.274740934 CET	3778	60466	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:43.274923086 CET	60466	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.276359081 CET	60466	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.281270981 CET	3778	60466	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:43.281671047 CET	60466	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.287004948 CET	3778	60466	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:43.307029963 CET	60468	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.312361002 CET	3778	60468	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:43.312704086 CET	60468	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.314851046 CET	60468	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.320010900 CET	3778	60468	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:43.320370913 CET	60468	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:43.325922012 CET	3778	60468	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:44.897595882 CET	3778	60466	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:44.898457050 CET	60466	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:44.903965950 CET	3778	60466	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:45.903681040 CET	60470	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:45.908854008 CET	3778	60470	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:45.909329891 CET	60470	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:45.911261082 CET	60470	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:45.916568995 CET	3778	60470	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:45.916785002 CET	60470	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:45.922049046 CET	3778	60470	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:47.553385019 CET	3778	60470	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:47.554121971 CET	60470	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:47.559279919 CET	3778	60470	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:48.558818102 CET	60472	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:48.563885927 CET	3778	60472	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:48.564107895 CET	60472	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:48.565788984 CET	60472	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:48.570899010 CET	3778	60472	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:48.571202993 CET	60472	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:48.576157093 CET	3778	60472	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:50.209688902 CET	3778	60472	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:50.210333109 CET	60472	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:50.215856075 CET	3778	60472	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:50.346935987 CET	3778	60468	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:50.347395897 CET	60468	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:50.352916956 CET	3778	60468	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:51.214869976 CET	60474	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.220084906 CET	3778	60474	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:51.220516920 CET	60474	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.222884893 CET	60474	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.228236914 CET	3778	60474	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:51.228720903 CET	60474	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.233968019 CET	3778	60474	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:51.352802038 CET	60476	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.358468056 CET	3778	60476	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:51.358798981 CET	60476	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.360261917 CET	60476	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.365381956 CET	3778	60476	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:51.365658045 CET	60476	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:51.371149063 CET	3778	60476	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:53.001077890 CET	3778	60476	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:53.001684904 CET	60476	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:53.007234097 CET	3778	60476	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:54.008025885 CET	60478	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:54.013817072 CET	3778	60478	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:54.014153957 CET	60478	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:54.016393900 CET	60478	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:54.021574020 CET	3778	60478	154.213.187.11	192.168.2.13
Jan 13, 2025 23:18:54.021661043 CET	60478	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:18:54.027276993 CET	3778	60478	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:01.066143036 CET	3778	60478	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:01.066756964 CET	60478	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:01.071763992 CET	3778	60478	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:01.233057976 CET	60474	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:01.238430023 CET	3778	60474	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:02.072717905 CET	60480	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:02.078010082 CET	3778	60480	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:02.078437090 CET	60480	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:02.081355095 CET	60480	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:02.086653948 CET	3778	60480	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:02.087227106 CET	60480	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:02.092586040 CET	3778	60480	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:03.768660069 CET	3778	60480	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:03.769268990 CET	60480	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:03.774813890 CET	3778	60480	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:04.764142990 CET	3778	60474	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:04.764914989 CET	60474	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:04.770118952 CET	3778	60474	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:04.774929047 CET	60482	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:04.779932022 CET	3778	60482	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:04.780046940 CET	60482	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:04.781577110 CET	60482	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:04.786477089 CET	3778	60482	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:04.786561012 CET	60482	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:04.791460037 CET	3778	60482	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:05.770580053 CET	60484	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:05.775804043 CET	3778	60484	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:05.776074886 CET	60484	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:05.777980089 CET	60484	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:05.783216953 CET	3778	60484	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:05.783701897 CET	60484	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:05.789177895 CET	3778	60484	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:06.454602957 CET	3778	60482	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:06.455420971 CET	60482	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:06.460798025 CET	3778	60482	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:07.427820921 CET	3778	60484	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:07.428524971 CET	60484	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:07.434206009 CET	3778	60484	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:07.461927891 CET	60486	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:07.467576981 CET	3778	60486	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:07.467981100 CET	60486	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:07.470851898 CET	60486	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:07.476521015 CET	3778	60486	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:07.476793051 CET	60486	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:07.482387066 CET	3778	60486	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:08.437195063 CET	60488	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:08.442815065 CET	3778	60488	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:08.443128109 CET	60488	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:08.445904970 CET	60488	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:08.451500893 CET	3778	60488	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:08.451658010 CET	60488	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:08.457448006 CET	3778	60488	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:09.102389097 CET	3778	60486	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:09.103009939 CET	60486	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:09.108829975 CET	3778	60486	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:10.063575029 CET	3778	60488	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:10.064182997 CET	60488	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:10.069717884 CET	3778	60488	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:10.109431028 CET	60490	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:10.115031958 CET	3778	60490	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:10.115411997 CET	60490	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:10.117449045 CET	60490	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:10.122831106 CET	3778	60490	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:10.123234034 CET	60490	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:10.128985882 CET	3778	60490	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:11.070183039 CET	60492	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:11.075875044 CET	3778	60492	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:11.076040030 CET	60492	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:11.078500986 CET	60492	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:11.085474968 CET	3778	60492	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:11.085617065 CET	60492	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:11.092048883 CET	3778	60492	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:11.733165026 CET	3778	60490	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:11.733870983 CET	60490	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:11.739685059 CET	3778	60490	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:12.702775002 CET	3778	60492	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:12.703425884 CET	60492	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:12.709175110 CET	3778	60492	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:12.740966082 CET	60494	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:12.746728897 CET	3778	60494	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:12.747176886 CET	60494	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:12.749572992 CET	60494	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:12.754584074 CET	3778	60494	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:12.754939079 CET	60494	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:12.760442972 CET	3778	60494	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:13.711364985 CET	60496	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:13.717084885 CET	3778	60496	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:13.717641115 CET	60496	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:13.720527887 CET	60496	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:13.725780010 CET	3778	60496	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:13.726233959 CET	60496	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:13.731470108 CET	3778	60496	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:14.411946058 CET	3778	60494	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:14.412703037 CET	60494	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:14.418523073 CET	3778	60494	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:15.345762968 CET	3778	60496	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:15.346390009 CET	60496	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:15.351521969 CET	3778	60496	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:15.419697046 CET	60498	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:15.425548077 CET	3778	60498	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:15.425909042 CET	60498	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:15.428252935 CET	60498	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:15.433427095 CET	3778	60498	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:15.433672905 CET	60498	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:15.438936949 CET	3778	60498	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:16.354974031 CET	60500	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:16.360744953 CET	3778	60500	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:16.360924006 CET	60500	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:16.363467932 CET	60500	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:16.369081020 CET	3778	60500	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:16.369373083 CET	60500	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:16.374849081 CET	3778	60500	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:17.048593044 CET	3778	60498	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:17.049411058 CET	60498	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:17.054816961 CET	3778	60498	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:17.951527119 CET	3778	60500	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:17.951956034 CET	60500	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:17.957597971 CET	3778	60500	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:18.055672884 CET	60502	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.061181068 CET	3778	60502	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:18.061341047 CET	60502	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.063700914 CET	60502	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.069031000 CET	3778	60502	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:18.069245100 CET	60502	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.074702024 CET	3778	60502	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:18.957866907 CET	60504	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.963505030 CET	3778	60504	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:18.963970900 CET	60504	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.965720892 CET	60504	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.971038103 CET	3778	60504	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:18.971462965 CET	60504	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:18.977287054 CET	3778	60504	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:19.692770004 CET	3778	60502	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:19.693262100 CET	60502	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:19.698411942 CET	3778	60502	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:20.611228943 CET	3778	60504	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:20.612198114 CET	60504	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:20.617527008 CET	3778	60504	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:20.697463036 CET	60506	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:20.702620983 CET	3778	60506	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:20.702825069 CET	60506	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:20.704627991 CET	60506	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:20.709534883 CET	3778	60506	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:20.709728003 CET	60506	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:20.714663029 CET	3778	60506	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:21.618112087 CET	60508	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:21.623752117 CET	3778	60508	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:21.623923063 CET	60508	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:21.625085115 CET	60508	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:21.630047083 CET	3778	60508	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:21.630167961 CET	60508	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:21.634988070 CET	3778	60508	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:22.362612009 CET	3778	60506	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:22.362777948 CET	60506	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:22.367760897 CET	3778	60506	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:23.369071007 CET	60510	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:23.374556065 CET	3778	60510	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:23.374696016 CET	60510	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:23.377147913 CET	60510	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:23.382110119 CET	3778	60510	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:23.382339001 CET	60510	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:23.387475014 CET	3778	60510	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:25.007468939 CET	3778	60510	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:25.008033991 CET	60510	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:25.013226032 CET	3778	60510	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:26.014827967 CET	60512	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:26.020266056 CET	3778	60512	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:26.020643950 CET	60512	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:26.022774935 CET	60512	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:26.027868032 CET	3778	60512	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:26.028283119 CET	60512	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:26.033802986 CET	3778	60512	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:27.625194073 CET	3778	60512	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:27.626003027 CET	60512	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:27.631392002 CET	3778	60512	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:28.633676052 CET	60514	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:28.638959885 CET	3778	60514	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:28.639518023 CET	60514	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:28.642337084 CET	60514	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:28.647484064 CET	3778	60514	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:28.647866964 CET	60514	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:28.653156996 CET	3778	60514	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:30.267772913 CET	3778	60514	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:30.268413067 CET	60514	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:30.274030924 CET	3778	60514	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:31.273384094 CET	60516	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:31.278620005 CET	3778	60516	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:31.278832912 CET	60516	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:31.280415058 CET	60516	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:31.285518885 CET	3778	60516	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:31.285793066 CET	60516	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:31.290977001 CET	3778	60516	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:32.888801098 CET	3778	60516	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:32.889527082 CET	60516	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:32.894926071 CET	3778	60516	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:33.896841049 CET	60518	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:33.902465105 CET	3778	60518	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:33.902760983 CET	60518	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:33.905711889 CET	60518	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:33.910881042 CET	3778	60518	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:33.911222935 CET	60518	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:33.916718960 CET	3778	60518	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:35.174933910 CET	3778	60508	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:35.175790071 CET	60508	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:35.181235075 CET	3778	60508	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:35.584703922 CET	3778	60518	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:35.585423946 CET	60518	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:35.590569019 CET	3778	60518	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:36.181703091 CET	60520	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.186949015 CET	3778	60520	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:36.187187910 CET	60520	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.188791990 CET	60520	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.193759918 CET	3778	60520	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:36.193974018 CET	60520	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.199088097 CET	3778	60520	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:36.589937925 CET	60522	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.595454931 CET	3778	60522	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:36.595607996 CET	60522	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.596901894 CET	60522	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.601762056 CET	3778	60522	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:36.601841927 CET	60522	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:36.606786966 CET	3778	60522	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:37.818011999 CET	3778	60520	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:37.818909883 CET	60520	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:37.824651003 CET	3778	60520	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:38.238629103 CET	3778	60522	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:38.239181995 CET	60522	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:38.244247913 CET	3778	60522	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:38.825571060 CET	60524	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:38.830910921 CET	3778	60524	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:38.831348896 CET	60524	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:38.833704948 CET	60524	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:38.838567972 CET	3778	60524	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:38.838675976 CET	60524	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:38.843586922 CET	3778	60524	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:39.244348049 CET	60526	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:39.249403000 CET	3778	60526	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:39.249483109 CET	60526	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:39.250925064 CET	60526	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:39.255819082 CET	3778	60526	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:39.255886078 CET	60526	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:39.260744095 CET	3778	60526	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:40.436472893 CET	3778	60524	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:40.437180042 CET	60524	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:40.442277908 CET	3778	60524	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:40.844197989 CET	3778	60526	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:40.844784021 CET	60526	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:40.850017071 CET	3778	60526	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:41.442051888 CET	60528	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.447216988 CET	3778	60528	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:41.447315931 CET	60528	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.448924065 CET	60528	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.453917027 CET	3778	60528	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:41.453975916 CET	60528	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.458884954 CET	3778	60528	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:41.850421906 CET	60530	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.855592012 CET	3778	60530	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:41.855746031 CET	60530	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.857738972 CET	60530	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.862628937 CET	3778	60530	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:41.862710953 CET	60530	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:41.867629051 CET	3778	60530	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:43.084063053 CET	3778	60528	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:43.084784031 CET	60528	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:43.090559006 CET	3778	60528	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:43.491748095 CET	3778	60530	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:43.492383957 CET	60530	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:43.497912884 CET	3778	60530	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:44.091864109 CET	60532	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.097781897 CET	3778	60532	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:44.098196983 CET	60532	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.100940943 CET	60532	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.106098890 CET	3778	60532	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:44.106491089 CET	60532	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.112153053 CET	3778	60532	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:44.497603893 CET	60534	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.502666950 CET	3778	60534	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:44.502820015 CET	60534	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.504126072 CET	60534	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.509141922 CET	3778	60534	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:44.509402037 CET	60534	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:44.514342070 CET	3778	60534	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:45.929444075 CET	3778	60532	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:45.929999113 CET	60532	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:45.931529999 CET	3778	60532	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:45.931610107 CET	60532	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:45.935030937 CET	3778	60532	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:46.162498951 CET	3778	60534	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:46.163145065 CET	60534	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:46.168384075 CET	3778	60534	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:46.935950041 CET	60536	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:46.941554070 CET	3778	60536	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:46.942018032 CET	60536	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:46.944669962 CET	60536	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:46.949932098 CET	3778	60536	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:46.950454950 CET	60536	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:46.956037045 CET	3778	60536	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:47.167157888 CET	60538	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:47.172377110 CET	3778	60538	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:47.172492027 CET	60538	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:47.174438953 CET	60538	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:47.179502964 CET	3778	60538	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:47.179997921 CET	60538	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:47.185525894 CET	3778	60538	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:48.566690922 CET	3778	60536	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:48.567373991 CET	60536	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:48.572726011 CET	3778	60536	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:48.783788919 CET	3778	60538	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:48.784060001 CET	60538	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:48.789012909 CET	3778	60538	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:49.573410034 CET	60540	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.579000950 CET	3778	60540	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:49.579519033 CET	60540	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.582174063 CET	60540	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.587452888 CET	3778	60540	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:49.587763071 CET	60540	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.593075991 CET	3778	60540	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:49.787529945 CET	60542	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.792793989 CET	3778	60542	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:49.793036938 CET	60542	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.794591904 CET	60542	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.799981117 CET	3778	60542	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:49.800319910 CET	60542	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:49.805775881 CET	3778	60542	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:51.273747921 CET	3778	60540	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:51.274571896 CET	60540	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:51.280191898 CET	3778	60540	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:51.427058935 CET	3778	60542	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:51.427566051 CET	60542	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:51.432888985 CET	3778	60542	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:52.280253887 CET	60544	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.286206007 CET	3778	60544	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:52.286566019 CET	60544	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.288964987 CET	60544	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.293998957 CET	3778	60544	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:52.294259071 CET	60544	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.299596071 CET	3778	60544	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:52.431790113 CET	60546	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.437351942 CET	3778	60546	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:52.437917948 CET	60546	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.440592051 CET	60546	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.445785046 CET	3778	60546	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:52.446122885 CET	60546	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:52.451436043 CET	3778	60546	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:53.912988901 CET	3778	60544	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:53.914036989 CET	60544	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:53.919717073 CET	3778	60544	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:54.065354109 CET	3778	60546	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:54.066016912 CET	60546	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:54.071206093 CET	3778	60546	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:54.919466972 CET	60548	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:54.925831079 CET	3778	60548	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:54.925995111 CET	60548	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:54.928164005 CET	60548	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:54.933931112 CET	3778	60548	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:54.934098959 CET	60548	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:54.939426899 CET	3778	60548	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:55.071542978 CET	60550	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:55.077266932 CET	3778	60550	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:55.077822924 CET	60550	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:55.080439091 CET	60550	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:55.085774899 CET	3778	60550	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:55.086561918 CET	60550	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:55.092250109 CET	3778	60550	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:56.549839020 CET	3778	60548	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:56.550659895 CET	60548	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:56.556322098 CET	3778	60548	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:56.709220886 CET	3778	60550	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:56.709680080 CET	60550	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:56.715203047 CET	3778	60550	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:57.557346106 CET	60552	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.563086033 CET	3778	60552	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:57.563446999 CET	60552	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.565514088 CET	60552	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.570663929 CET	3778	60552	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:57.570919991 CET	60552	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.576402903 CET	3778	60552	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:57.715977907 CET	60554	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.721591949 CET	3778	60554	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:57.721769094 CET	60554	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.723809004 CET	60554	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.729162931 CET	3778	60554	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:57.729707003 CET	60554	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:57.735120058 CET	3778	60554	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:59.192493916 CET	3778	60552	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:59.193295956 CET	60552	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:59.198985100 CET	3778	60552	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:59.347080946 CET	3778	60554	154.213.187.11	192.168.2.13
Jan 13, 2025 23:19:59.347707033 CET	60554	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:19:59.353456020 CET	3778	60554	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:00.199866056 CET	60556	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.352305889 CET	60558	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.559901953 CET	3778	60556	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:00.560012102 CET	3778	60558	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:00.560555935 CET	60556	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.560556889 CET	60558	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.563647985 CET	60558	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.563832045 CET	60556	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.568553925 CET	3778	60558	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:00.568964005 CET	60558	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.569127083 CET	3778	60556	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:00.569463968 CET	60556	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:00.574152946 CET	3778	60558	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:00.575131893 CET	3778	60556	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:02.174415112 CET	3778	60556	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:02.175065994 CET	60556	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:02.180582047 CET	3778	60556	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:03.180732965 CET	60560	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:03.185900927 CET	3778	60560	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:03.186233044 CET	60560	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:03.188414097 CET	60560	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:03.194152117 CET	3778	60560	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:03.194423914 CET	60560	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:03.199959040 CET	3778	60560	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:04.563477993 CET	3778	60558	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:04.563822031 CET	60558	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:04.570684910 CET	3778	60558	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:04.816586971 CET	3778	60560	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:04.817172050 CET	60560	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:04.823532104 CET	3778	60560	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:05.566891909 CET	60562	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.572386980 CET	3778	60562	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:05.572638035 CET	60562	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.575203896 CET	60562	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.580539942 CET	3778	60562	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:05.580914974 CET	60562	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.586422920 CET	3778	60562	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:05.821423054 CET	60564	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.826781034 CET	3778	60564	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:05.826952934 CET	60564	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.829581022 CET	60564	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.834512949 CET	3778	60564	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:05.834830046 CET	60564	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:05.840214014 CET	3778	60564	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:07.174633026 CET	3778	60562	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:07.175466061 CET	60562	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:07.181220055 CET	3778	60562	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:07.501980066 CET	3778	60564	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:07.502703905 CET	60564	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:07.508182049 CET	3778	60564	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:08.182796001 CET	60566	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.188534975 CET	3778	60566	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:08.189086914 CET	60566	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.191857100 CET	60566	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.197416067 CET	3778	60566	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:08.197784901 CET	60566	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.203166962 CET	3778	60566	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:08.507217884 CET	60568	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.690062046 CET	3778	60568	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:08.690632105 CET	60568	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.694153070 CET	60568	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.700079918 CET	3778	60568	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:08.700297117 CET	60568	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:08.705969095 CET	3778	60568	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:09.892365932 CET	3778	60566	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:09.893237114 CET	60566	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:09.898782969 CET	3778	60566	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:10.558672905 CET	3778	60568	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:10.559308052 CET	60568	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:10.564770937 CET	3778	60568	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:10.899401903 CET	60570	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:10.905394077 CET	3778	60570	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:10.905751944 CET	60570	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:10.908206940 CET	60570	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:10.913742065 CET	3778	60570	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:10.914073944 CET	60570	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:10.919887066 CET	3778	60570	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:11.565681934 CET	60572	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:11.571223974 CET	3778	60572	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:11.571346045 CET	60572	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:11.573916912 CET	60572	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:11.579277992 CET	3778	60572	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:11.579597950 CET	60572	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:11.584600925 CET	3778	60572	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:12.554491997 CET	3778	60570	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:12.555351973 CET	60570	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:12.560908079 CET	3778	60570	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:13.210386038 CET	3778	60572	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:13.210902929 CET	60572	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:13.216308117 CET	3778	60572	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:13.562068939 CET	60574	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:13.567550898 CET	3778	60574	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:13.567987919 CET	60574	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:13.569678068 CET	60574	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:13.575059891 CET	3778	60574	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:13.575242043 CET	60574	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:13.580930948 CET	3778	60574	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:14.215948105 CET	60576	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:14.221122026 CET	3778	60576	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:14.221278906 CET	60576	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:14.223062992 CET	60576	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:14.228355885 CET	3778	60576	154.213.187.11	192.168.2.13
Jan 13, 2025 23:20:14.228566885 CET	60576	3778	192.168.2.13	154.213.187.11
Jan 13, 2025 23:20:14.234036922 CET	3778	60576	154.213.187.11	192.168.2.13

System Behavior

Analysis Process: camp.x86_64.elf PID: 5445, Parent PID: 5370

General

Start time (UTC):	22:18:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.x86_64.elf
Arguments:	/tmp/camp.x86_64.elf
File size:	36916 bytes
MD5 hash:	5872e361c75eb6d934fec4f7ae32dc70

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5446, Parent PID: 5445

General

Start time (UTC):	22:18:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.x86_64.elf
Arguments:	-
File size:	36916 bytes
MD5 hash:	5872e361c75eb6d934fec4f7ae32dc70

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5447, Parent PID: 5446

General

Start time (UTC):	22:18:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.x86_64.elf
Arguments:	-
File size:	36916 bytes
MD5 hash:	5872e361c75eb6d934fec4f7ae32dc70

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5448, Parent PID: 5446

General

Start time (UTC):	22:18:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.x86_64.elf
Arguments:	-
File size:	36916 bytes
MD5 hash:	5872e361c75eb6d934fec4f7ae32dc70

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5457, Parent PID: 5445

General

Start time (UTC):	22:18:07
Start date (UTC):	13/01/2025
Path:	/tmp/camp.x86_64.elf
Arguments:	-
File size:	36916 bytes
MD5 hash:	5872e361c75eb6d934fec4f7ae32dc70

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5458, Parent PID: 5445

General

Start time (UTC):	22:18:07
Start date (UTC):	13/01/2025
Path:	/tmp/camp.x86_64.elf
Arguments:	-
File size:	36916 bytes
MD5 hash:	5872e361c75eb6d934fec4f7ae32dc70

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report camp.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: camp.x86_64.elf PID: 5445, Parent PID: 5370

General

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5446, Parent PID: 5445

General

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5447, Parent PID: 5446

General

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5448, Parent PID: 5446

General

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5457, Parent PID: 5445

General

Chronological Activities

Analysis Process: camp.x86_64.elf PID: 5458, Parent PID: 5445

General

Chronological Activities

Linux Analysis Report
camp.x86_64.elf