Edit tour

Linux Analysis Report
camp.arm7.elf

Overview

General Information

Sample name:	camp.arm7.elf
Analysis ID:	1590315
MD5:	a1d8acd50352d19c0b991bc9ae10ffa1
SHA1:	df680fe26cb56d44506355ff773f9aed9210d6e4
SHA256:	b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590315
Start date and time:	2025-01-13 23:17:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	camp.arm7.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/camp.arm7.elf
PID:	5526
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

camp.arm7.elf (PID: 5526, Parent: 5444, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/camp.arm7.elf

camp.arm7.elf New Fork (PID: 5528, Parent: 5526)

camp.arm7.elf New Fork (PID: 5530, Parent: 5528)

camp.arm7.elf New Fork (PID: 5532, Parent: 5528)

camp.arm7.elf New Fork (PID: 5536, Parent: 5526)

camp.arm7.elf New Fork (PID: 5538, Parent: 5526)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5536.1.00007f2590017000.00007f259002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5536.1.00007f2590017000.00007f259002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5530.1.00007f2590017000.00007f259002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5530.1.00007f2590017000.00007f259002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5526.1.00007f2590017000.00007f259002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5526.1.00007f2590017000.00007f259002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5528.1.00007f2590017000.00007f259002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5528.1.00007f2590017000.00007f259002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.arm7.elf PID: 5526	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.arm7.elf PID: 5526	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x166cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x166e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x166f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1671c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1676c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x167f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1680c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1685c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.arm7.elf PID: 5528	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.arm7.elf PID: 5528	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1276e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12782:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12796:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1280e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12822:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12836:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1284a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1285e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12872:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12886:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1289a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.arm7.elf PID: 5530	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.arm7.elf PID: 5530	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1121:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1135:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1149:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1171:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1185:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1199:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1211:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1225:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1239:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.arm7.elf PID: 5536	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.arm7.elf PID: 5536	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x150c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15103:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15117:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1512b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1513f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15153:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15167:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1517b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1518f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15207:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1521b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1522f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: camp.arm7.elf	Virustotal: Detection: 39%			Perma Link
Source: camp.arm7.elf	ReversingLabs: Detection: 52%

Source: global traffic

TCP traffic: 192.168.2.15:56444 -> 154.213.187.11:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11

Source: camp.arm7.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5536.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5530.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5526.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5528.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.arm7.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.arm7.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.arm7.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.arm7.elf PID: 5536, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 5536.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5530.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5526.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5528.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.arm7.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.arm7.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.arm7.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.arm7.elf PID: 5536, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1333/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1695/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/911/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1591/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1585/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/804/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/3407/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1484/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/133/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1479/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/931/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1595/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/812/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/933/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/3419/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/265/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/145/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/266/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/267/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/268/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/3303/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/269/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1486/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/1806/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/3440/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/270/status	Jump to behavior
Source: /tmp/camp.arm7.elf (PID: 5526)	File opened: /proc/271/status	Jump to behavior

Source: camp.arm7.elf

Submission file: segment LOAD with 7.974 entropy (max. 8.0)

Source: /tmp/camp.arm7.elf (PID: 5526)

Queries kernel information via 'uname':

Jump to behavior

Source: camp.arm7.elf, 5526.1.0000561dcccd8000.0000561dccf27000.rw-.sdmp, camp.arm7.elf, 5528.1.0000561dcccd8000.0000561dccf06000.rw-.sdmp, camp.arm7.elf, 5530.1.0000561dcccd8000.0000561dccf06000.rw-.sdmp, camp.arm7.elf, 5536.1.0000561dcccd8000.0000561dccf27000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: camp.arm7.elf, 5526.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp, camp.arm7.elf, 5528.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp, camp.arm7.elf, 5530.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp, camp.arm7.elf, 5536.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: camp.arm7.elf, 5526.1.0000561dcccd8000.0000561dccf27000.rw-.sdmp, camp.arm7.elf, 5528.1.0000561dcccd8000.0000561dccf06000.rw-.sdmp, camp.arm7.elf, 5530.1.0000561dcccd8000.0000561dccf06000.rw-.sdmp, camp.arm7.elf, 5536.1.0000561dcccd8000.0000561dccf27000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: camp.arm7.elf, 5526.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp, camp.arm7.elf, 5528.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp, camp.arm7.elf, 5530.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp, camp.arm7.elf, 5536.1.00007fff1f3c4000.00007fff1f3e5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/camp.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/camp.arm7.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5536.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5530.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5530, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5536, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5536.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5530.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007f2590017000.00007f259002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5530, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.arm7.elf PID: 5536, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
camp.arm7.elf	40%	Virustotal		Browse
camp.arm7.elf	53%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	camp.arm7.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.213.187.11	unknown	Seychelles		22769	DDOSING-BGP-NETWORKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.213.187.11	camp.x86_64.elf	Get hash	malicious	Mirai	Browse
	camp.i686.elf	Get hash	malicious	Mirai	Browse
	camp.sh4.elf	Get hash	malicious	Mirai	Browse
	camp.spc.elf	Get hash	malicious	Mirai	Browse
	camp.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DDOSING-BGP-NETWORKUS	camp.x86_64.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.i686.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	hikarm4.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	hikarm7.elf	Get hash	malicious	Mirai	Browse	154.213.187.125
	hikarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	gx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	camp.sh4.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.spc.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.x86.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	mpsl.elf	Get hash	malicious	Unknown	Browse	154.213.187.125

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.984212928217546
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	camp.arm7.elf
File size:	61'840 bytes
MD5:	a1d8acd50352d19c0b991bc9ae10ffa1
SHA1:	df680fe26cb56d44506355ff773f9aed9210d6e4
SHA256:	b74251b247b4b23a86f55e243d619c890271a60dc95fe292774da59ce9abcc8d
SHA512:	180b51edd2ccd594fd4b1a25b3d1ada3b555315291f9bb9cec59273dbcec13869d66357bf043285bb9c4963f41c3cecd19cd224db85009caa25f521fc7e44fea
SSDEEP:	1536:Y7XduYshWhq/HIEy6Og3Nwz9hAyoELSM5Tfv83KJGTb6R4k:qdpssMPR9w4yLLXTX83K0Tb6R3
TLSH:	0553022298035878DA23BD777BE14EC3FA0D8F72B59D647E11252158F6F59222C713CA
File Content Preview:	.ELF..............(.....`...4...........4. ...(.....................M...M................6...6...6..................Q.td...............................OUPX!.........n...n......j..........?.E.h;....#..$...o....P.G.o.....X.*.V......f..T.qh...4.8........8.\|i

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x11c60
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xae4d	0xae4d	7.9740	0x5	R E	0x8000
LOAD	0x36c8	0x236c8	0x236c8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 23:18:05.361943960 CET	56444	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:05.367153883 CET	3778	56444	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:05.367216110 CET	56444	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:05.387502909 CET	56444	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:05.392424107 CET	3778	56444	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:05.392514944 CET	56444	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:05.397339106 CET	3778	56444	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:11.825119972 CET	56446	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:11.830332041 CET	3778	56446	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:11.830399990 CET	56446	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:11.879867077 CET	56446	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:11.885015011 CET	3778	56446	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:11.885071993 CET	56446	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:11.889935970 CET	3778	56446	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:12.410599947 CET	3778	56444	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:12.411279917 CET	56444	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:12.416623116 CET	3778	56444	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:13.415517092 CET	56448	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:13.425095081 CET	3778	56448	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:13.425215006 CET	56448	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:13.427505016 CET	56448	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:13.436835051 CET	3778	56448	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:13.436901093 CET	56448	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:13.445019960 CET	3778	56448	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:13.454404116 CET	3778	56446	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:13.455126047 CET	56446	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:13.464374065 CET	3778	56446	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:14.457811117 CET	56450	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:14.463411093 CET	3778	56450	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:14.463494062 CET	56450	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:14.464616060 CET	56450	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:14.469441891 CET	3778	56450	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:14.469588041 CET	56450	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:14.474440098 CET	3778	56450	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:15.063235998 CET	3778	56448	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:15.063587904 CET	56448	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:15.068803072 CET	3778	56448	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:16.065798998 CET	56452	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:16.070880890 CET	3778	56452	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:16.070944071 CET	56452	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:16.071783066 CET	56452	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:16.076621056 CET	3778	56452	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:16.076677084 CET	56452	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:16.081501961 CET	3778	56452	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:16.094429970 CET	3778	56450	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:16.094985962 CET	56450	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:16.100183010 CET	3778	56450	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:17.097594023 CET	56454	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:17.103039980 CET	3778	56454	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:17.103117943 CET	56454	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:17.104430914 CET	56454	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:17.109520912 CET	3778	56454	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:17.109599113 CET	56454	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:17.115016937 CET	3778	56454	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:17.687684059 CET	3778	56452	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:17.688107967 CET	56452	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:17.693227053 CET	3778	56452	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:18.692475080 CET	56456	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:18.697505951 CET	3778	56456	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:18.697707891 CET	56456	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:18.699105024 CET	56456	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:18.704020023 CET	3778	56456	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:18.704096079 CET	56456	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:18.709275007 CET	3778	56456	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:18.754369020 CET	3778	56454	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:18.754944086 CET	56454	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:18.759913921 CET	3778	56454	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:19.760915995 CET	56458	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:19.766385078 CET	3778	56458	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:19.766601086 CET	56458	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:19.769387960 CET	56458	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:19.774796009 CET	3778	56458	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:19.774893999 CET	56458	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:19.780292988 CET	3778	56458	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:20.334748030 CET	3778	56456	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:20.335197926 CET	56456	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:20.340523958 CET	3778	56456	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:21.339854002 CET	56460	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:21.344942093 CET	3778	56460	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:21.345029116 CET	56460	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:21.347249985 CET	56460	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:21.352188110 CET	3778	56460	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:21.352436066 CET	56460	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:21.357400894 CET	3778	56460	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:21.406971931 CET	3778	56458	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:21.407751083 CET	56458	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:21.412909985 CET	3778	56458	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:22.414380074 CET	56462	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:22.419879913 CET	3778	56462	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:22.420104027 CET	56462	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:22.422122002 CET	56462	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:22.427238941 CET	3778	56462	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:22.427596092 CET	56462	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:22.432826996 CET	3778	56462	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:23.003935099 CET	3778	56460	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:23.004484892 CET	56460	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:23.009433985 CET	3778	56460	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:24.007718086 CET	56464	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:24.784348965 CET	3778	56462	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:24.784487009 CET	3778	56462	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:24.784605026 CET	3778	56462	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:24.784794092 CET	56462	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:24.784794092 CET	56462	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:24.784794092 CET	56462	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:24.785792112 CET	3778	56464	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:24.785993099 CET	56464	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:24.787226915 CET	56464	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:24.789808989 CET	3778	56462	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:24.792069912 CET	3778	56464	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:24.792129040 CET	56464	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:24.796999931 CET	3778	56464	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:25.790271044 CET	56466	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:25.795831919 CET	3778	56466	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:25.796176910 CET	56466	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:25.798589945 CET	56466	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:25.803575039 CET	3778	56466	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:25.803772926 CET	56466	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:25.808732986 CET	3778	56466	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:26.410574913 CET	3778	56464	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:26.411159992 CET	56464	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:26.411159992 CET	56464	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:26.416363955 CET	3778	56464	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:27.415028095 CET	56468	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:27.419903994 CET	3778	56468	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:27.419990063 CET	56468	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:27.421437979 CET	56468	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:27.422292948 CET	3778	56466	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:27.422636032 CET	56466	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:27.426275015 CET	3778	56468	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:27.426333904 CET	56468	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:27.427524090 CET	3778	56466	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:27.431212902 CET	3778	56468	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:28.428036928 CET	56470	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:28.433814049 CET	3778	56470	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:28.434144020 CET	56470	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:28.437149048 CET	56470	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:28.442821980 CET	3778	56470	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:28.443021059 CET	56470	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:28.448702097 CET	3778	56470	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:29.101212025 CET	3778	56468	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:29.101777077 CET	56468	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:29.107234001 CET	3778	56468	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:30.044779062 CET	3778	56470	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:30.045516014 CET	56470	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:30.050440073 CET	3778	56470	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:30.106187105 CET	56472	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:30.111547947 CET	3778	56472	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:30.111716032 CET	56472	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:30.113503933 CET	56472	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:30.118464947 CET	3778	56472	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:30.118643999 CET	56472	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:30.124109030 CET	3778	56472	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:31.051947117 CET	56474	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:31.057209969 CET	3778	56474	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:31.057492018 CET	56474	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:31.059973955 CET	56474	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:31.065283060 CET	3778	56474	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:31.065450907 CET	56474	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:31.070811987 CET	3778	56474	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:31.715691090 CET	3778	56472	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:31.716116905 CET	56472	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:31.721168041 CET	3778	56472	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:32.688232899 CET	3778	56474	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:32.688649893 CET	56474	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:32.693581104 CET	3778	56474	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:32.721453905 CET	56476	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:32.726557016 CET	3778	56476	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:32.726995945 CET	56476	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:32.729408026 CET	56476	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:32.734410048 CET	3778	56476	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:32.734541893 CET	56476	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:32.739532948 CET	3778	56476	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:33.692437887 CET	56478	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:33.697700977 CET	3778	56478	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:33.697798967 CET	56478	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:33.699717999 CET	56478	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:33.704871893 CET	3778	56478	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:33.704948902 CET	56478	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:33.710262060 CET	3778	56478	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:34.377567053 CET	3778	56476	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:34.378017902 CET	56476	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:34.382956982 CET	3778	56476	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:35.333695889 CET	3778	56478	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:35.334198952 CET	56478	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:35.339229107 CET	3778	56478	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:35.382019997 CET	56480	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:35.386946917 CET	3778	56480	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:35.387037039 CET	56480	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:35.388573885 CET	56480	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:35.393531084 CET	3778	56480	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:35.393589020 CET	56480	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:35.398669958 CET	3778	56480	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:36.341110945 CET	56482	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:36.346816063 CET	3778	56482	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:36.347116947 CET	56482	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:36.350363970 CET	56482	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:36.355916977 CET	3778	56482	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:36.356374979 CET	56482	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:36.361788988 CET	3778	56482	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:37.018289089 CET	3778	56480	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:37.019015074 CET	56480	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:37.024082899 CET	3778	56480	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:37.971324921 CET	3778	56482	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:37.971510887 CET	56482	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:37.976888895 CET	3778	56482	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:38.023176908 CET	56484	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.028080940 CET	3778	56484	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:38.028146982 CET	56484	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.029315948 CET	56484	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.034111023 CET	3778	56484	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:38.034157038 CET	56484	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.039011002 CET	3778	56484	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:38.977154016 CET	56486	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.982639074 CET	3778	56486	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:38.982795000 CET	56486	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.985299110 CET	56486	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.990457058 CET	3778	56486	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:38.990787029 CET	56486	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:38.996186972 CET	3778	56486	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:39.656795979 CET	3778	56484	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:39.657095909 CET	56484	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:39.662080050 CET	3778	56484	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:40.626143932 CET	3778	56486	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:40.626915932 CET	56486	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:40.632199049 CET	3778	56486	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:40.662035942 CET	56488	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:40.667491913 CET	3778	56488	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:40.667764902 CET	56488	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:40.669740915 CET	56488	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:40.674715042 CET	3778	56488	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:40.674961090 CET	56488	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:40.680105925 CET	3778	56488	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:41.632386923 CET	56490	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:41.637949944 CET	3778	56490	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:41.638240099 CET	56490	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:41.640917063 CET	56490	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:41.646106958 CET	3778	56490	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:41.646328926 CET	56490	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:41.651882887 CET	3778	56490	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:42.282331944 CET	3778	56488	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:42.282877922 CET	56488	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:42.288235903 CET	3778	56488	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:43.250299931 CET	3778	56490	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:43.250828028 CET	56490	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:43.256418943 CET	3778	56490	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:43.289324999 CET	56492	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:43.294866085 CET	3778	56492	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:43.295094967 CET	56492	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:43.297488928 CET	56492	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:43.302876949 CET	3778	56492	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:43.303267002 CET	56492	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:43.308639050 CET	3778	56492	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:44.256972075 CET	56494	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:44.262016058 CET	3778	56494	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:44.262233973 CET	56494	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:44.264559031 CET	56494	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:44.269511938 CET	3778	56494	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:44.269730091 CET	56494	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:44.274837971 CET	3778	56494	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:44.924810886 CET	3778	56492	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:44.925432920 CET	56492	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:44.930903912 CET	3778	56492	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:45.893672943 CET	3778	56494	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:45.894300938 CET	56494	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:45.899864912 CET	3778	56494	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:45.931047916 CET	56496	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:45.937571049 CET	3778	56496	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:45.937958002 CET	56496	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:45.940084934 CET	56496	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:45.945178986 CET	3778	56496	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:45.945434093 CET	56496	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:45.950634003 CET	3778	56496	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:46.898689985 CET	56498	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:46.903836966 CET	3778	56498	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:46.904025078 CET	56498	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:46.905745029 CET	56498	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:46.910881042 CET	3778	56498	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:46.910950899 CET	56498	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:46.916030884 CET	3778	56498	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:47.568548918 CET	3778	56496	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:47.569205046 CET	56496	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:47.574376106 CET	3778	56496	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:48.550048113 CET	3778	56498	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:48.550529957 CET	56498	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:48.555610895 CET	3778	56498	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:48.572163105 CET	56500	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:48.576998949 CET	3778	56500	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:48.577073097 CET	56500	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:48.578334093 CET	56500	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:48.583579063 CET	3778	56500	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:48.583633900 CET	56500	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:48.588913918 CET	3778	56500	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:49.555258989 CET	56502	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:49.560647011 CET	3778	56502	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:49.560761929 CET	56502	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:49.562954903 CET	56502	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:49.568092108 CET	3778	56502	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:49.568295956 CET	56502	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:49.573251963 CET	3778	56502	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:50.204112053 CET	3778	56500	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:50.204617023 CET	56500	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:50.210136890 CET	3778	56500	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:51.173202991 CET	3778	56502	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:51.173666954 CET	56502	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:51.178937912 CET	3778	56502	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:51.209351063 CET	56504	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:51.214426994 CET	3778	56504	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:51.214534044 CET	56504	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:51.215919971 CET	56504	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:51.220865965 CET	3778	56504	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:51.220944881 CET	56504	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:51.226018906 CET	3778	56504	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:52.180581093 CET	56506	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:52.186077118 CET	3778	56506	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:52.186362028 CET	56506	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:52.188528061 CET	56506	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:52.193829060 CET	3778	56506	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:52.194164038 CET	56506	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:52.204498053 CET	3778	56506	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:52.830064058 CET	3778	56504	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:52.830730915 CET	56504	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:52.836107969 CET	3778	56504	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:53.814667940 CET	3778	56506	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:53.815428019 CET	56506	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:53.820816040 CET	3778	56506	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:53.836612940 CET	56508	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:53.842058897 CET	3778	56508	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:53.842187881 CET	56508	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:53.844979048 CET	56508	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:53.850327015 CET	3778	56508	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:53.850523949 CET	56508	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:53.856146097 CET	3778	56508	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:54.822915077 CET	56510	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:54.828583002 CET	3778	56510	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:54.829088926 CET	56510	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:54.831849098 CET	56510	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:54.837467909 CET	3778	56510	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:54.837959051 CET	56510	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:54.843620062 CET	3778	56510	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:55.472074032 CET	3778	56508	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:55.472805023 CET	56508	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:55.478168011 CET	3778	56508	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:56.471970081 CET	3778	56510	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:56.472997904 CET	56510	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:56.478096962 CET	56512	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:56.478518963 CET	3778	56510	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:56.483769894 CET	3778	56512	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:56.484323025 CET	56512	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:56.487148046 CET	56512	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:56.492618084 CET	3778	56512	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:56.492750883 CET	56512	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:56.498509884 CET	3778	56512	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:57.480948925 CET	56514	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:57.486820936 CET	3778	56514	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:57.487354994 CET	56514	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:57.490524054 CET	56514	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:57.495632887 CET	3778	56514	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:57.496047020 CET	56514	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:57.501451015 CET	3778	56514	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:58.108757973 CET	3778	56512	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:58.109383106 CET	56512	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:58.114629984 CET	3778	56512	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:59.116245985 CET	56516	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:59.418395042 CET	3778	56514	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:59.418447971 CET	3778	56514	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:59.419024944 CET	56514	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:59.419025898 CET	56514	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:59.419296980 CET	3778	56516	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:59.419676065 CET	56516	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:59.423707962 CET	56516	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:59.424213886 CET	3778	56514	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:59.428805113 CET	3778	56516	154.213.187.11	192.168.2.15
Jan 13, 2025 23:18:59.429321051 CET	56516	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:18:59.434410095 CET	3778	56516	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:00.427951097 CET	56518	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:00.433321953 CET	3778	56518	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:00.433665991 CET	56518	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:00.436655045 CET	56518	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:00.441653967 CET	3778	56518	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:00.441888094 CET	56518	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:00.447180033 CET	3778	56518	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:01.048237085 CET	3778	56516	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:01.048722029 CET	56516	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:01.053659916 CET	3778	56516	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:02.055546999 CET	56520	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:02.060981035 CET	3778	56520	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:02.061412096 CET	56520	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:02.064423084 CET	56520	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:02.065759897 CET	3778	56518	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:02.066153049 CET	56518	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:02.069742918 CET	3778	56520	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:02.069983006 CET	56520	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:02.071089983 CET	3778	56518	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:02.075118065 CET	3778	56520	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:03.071398973 CET	56522	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:03.077151060 CET	3778	56522	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:03.077599049 CET	56522	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:03.080065966 CET	56522	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:03.085407019 CET	3778	56522	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:03.085645914 CET	56522	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:03.091362000 CET	3778	56522	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:03.706991911 CET	3778	56520	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:03.707596064 CET	56520	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:03.713099003 CET	3778	56520	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:04.712394953 CET	56524	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:04.717670918 CET	3778	56524	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:04.717962980 CET	56524	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:04.720380068 CET	56524	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:04.725730896 CET	3778	56524	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:04.725960016 CET	56524	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:04.731745958 CET	3778	56524	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:04.959809065 CET	3778	56522	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:04.960592031 CET	56522	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:04.966319084 CET	3778	56522	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:05.968168974 CET	56526	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:05.973351002 CET	3778	56526	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:05.973808050 CET	56526	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:05.975960970 CET	56526	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:05.980953932 CET	3778	56526	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:05.981198072 CET	56526	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:05.986438990 CET	3778	56526	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:06.372220993 CET	3778	56524	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:06.373161077 CET	56524	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:06.378210068 CET	3778	56524	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:07.380127907 CET	56528	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:07.385837078 CET	3778	56528	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:07.386008978 CET	56528	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:07.388781071 CET	56528	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:07.394269943 CET	3778	56528	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:07.394742966 CET	56528	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:07.400453091 CET	3778	56528	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:07.642873049 CET	3778	56526	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:07.643774033 CET	56526	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:07.648956060 CET	3778	56526	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:08.652492046 CET	56530	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:08.657959938 CET	3778	56530	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:08.658451080 CET	56530	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:08.661269903 CET	56530	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:08.666460037 CET	3778	56530	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:08.666790009 CET	56530	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:08.672372103 CET	3778	56530	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:09.033119917 CET	3778	56528	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:09.033647060 CET	56528	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:09.039433002 CET	3778	56528	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:10.040052891 CET	56532	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:10.045680046 CET	3778	56532	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:10.046056986 CET	56532	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:10.049143076 CET	56532	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:10.054455042 CET	3778	56532	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:10.054884911 CET	56532	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:10.060431004 CET	3778	56532	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:10.284837008 CET	3778	56530	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:10.285418987 CET	56530	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:10.290730953 CET	3778	56530	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:11.292959929 CET	56534	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:11.298695087 CET	3778	56534	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:11.298791885 CET	56534	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:11.302439928 CET	56534	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:11.307836056 CET	3778	56534	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:11.308212042 CET	56534	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:11.313992977 CET	3778	56534	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:11.655944109 CET	3778	56532	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:11.656673908 CET	56532	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:11.661962032 CET	3778	56532	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:12.665267944 CET	56536	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:12.670892000 CET	3778	56536	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:12.671158075 CET	56536	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:12.673887014 CET	56536	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:12.679413080 CET	3778	56536	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:12.679738045 CET	56536	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:12.685344934 CET	3778	56536	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:12.928301096 CET	3778	56534	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:12.929044008 CET	56534	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:12.934216022 CET	3778	56534	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:13.937834024 CET	56538	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:13.943197966 CET	3778	56538	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:13.943342924 CET	56538	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:13.946748018 CET	56538	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:13.952163935 CET	3778	56538	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:13.952548027 CET	56538	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:13.958075047 CET	3778	56538	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:14.333121061 CET	3778	56536	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:14.333900928 CET	56536	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:14.339265108 CET	3778	56536	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:15.342180014 CET	56540	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:15.347671986 CET	3778	56540	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:15.348138094 CET	56540	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:15.351382017 CET	56540	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:15.356611967 CET	3778	56540	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:15.357055902 CET	56540	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:15.362376928 CET	3778	56540	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:15.568156958 CET	3778	56538	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:15.568912029 CET	56538	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:15.575237036 CET	3778	56538	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:16.576366901 CET	56542	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:16.582066059 CET	3778	56542	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:16.582499981 CET	56542	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:16.584988117 CET	56542	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:16.590328932 CET	3778	56542	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:16.590708971 CET	56542	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:16.596369028 CET	3778	56542	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:16.951286077 CET	3778	56540	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:16.952061892 CET	56540	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:16.957813025 CET	3778	56540	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:17.958479881 CET	56544	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:17.963736057 CET	3778	56544	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:17.964015007 CET	56544	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:17.966021061 CET	56544	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:17.971106052 CET	3778	56544	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:17.971189976 CET	56544	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:17.976340055 CET	3778	56544	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:18.240397930 CET	3778	56542	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:18.241100073 CET	56542	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:18.245984077 CET	3778	56542	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:19.248838902 CET	56546	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:19.254590988 CET	3778	56546	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:19.254939079 CET	56546	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:19.257689953 CET	56546	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:19.263160944 CET	3778	56546	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:19.263391018 CET	56546	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:19.269258022 CET	3778	56546	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:19.614790916 CET	3778	56544	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:19.615732908 CET	56544	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:19.621629953 CET	3778	56544	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:20.623615980 CET	56548	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:20.628508091 CET	3778	56548	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:20.628606081 CET	56548	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:20.631905079 CET	56548	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:20.636868000 CET	3778	56548	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:20.636944056 CET	56548	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:20.641904116 CET	3778	56548	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:20.877506971 CET	3778	56546	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:20.878423929 CET	56546	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:20.883492947 CET	3778	56546	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:21.885869026 CET	56550	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:21.891163111 CET	3778	56550	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:21.891349077 CET	56550	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:21.893583059 CET	56550	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:21.898493052 CET	3778	56550	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:21.898683071 CET	56550	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:21.903810024 CET	3778	56550	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:22.288338900 CET	3778	56548	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:22.288734913 CET	56548	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:22.293734074 CET	3778	56548	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:23.294313908 CET	56552	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:23.299751043 CET	3778	56552	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:23.299922943 CET	56552	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:23.302948952 CET	56552	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:23.308325052 CET	3778	56552	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:23.308924913 CET	56552	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:23.314322948 CET	3778	56552	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:24.909111023 CET	3778	56552	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:24.910011053 CET	56552	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:24.915416956 CET	3778	56552	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:25.916059971 CET	56554	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:25.921350002 CET	3778	56554	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:25.921475887 CET	56554	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:25.923666954 CET	3778	56550	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:25.923794985 CET	56554	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:25.923845053 CET	56550	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:25.928771019 CET	3778	56554	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:25.928806067 CET	3778	56550	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:25.929011106 CET	56554	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:25.933959961 CET	3778	56554	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:26.929965019 CET	56556	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:26.935779095 CET	3778	56556	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:26.936029911 CET	56556	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:26.939148903 CET	56556	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:26.944664001 CET	3778	56556	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:26.944902897 CET	56556	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:26.950572968 CET	3778	56556	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:28.595638990 CET	3778	56556	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:28.596364975 CET	56556	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:28.601819038 CET	3778	56556	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:29.604741096 CET	56558	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:29.610861063 CET	3778	56558	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:29.611002922 CET	56558	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:29.614069939 CET	56558	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:29.619201899 CET	3778	56558	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:29.619334936 CET	56558	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:29.624984026 CET	3778	56558	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:31.220499039 CET	3778	56558	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:31.221153021 CET	56558	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:31.226512909 CET	3778	56558	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:32.228477001 CET	56560	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:32.233969927 CET	3778	56560	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:32.234395027 CET	56560	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:32.237143040 CET	56560	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:32.242347002 CET	3778	56560	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:32.242917061 CET	56560	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:32.248418093 CET	3778	56560	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:32.958780050 CET	3778	56554	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:32.959489107 CET	56554	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:32.965141058 CET	3778	56554	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:33.845524073 CET	3778	56560	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:33.846101999 CET	56560	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:33.851371050 CET	3778	56560	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:33.967565060 CET	56562	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:33.973412037 CET	3778	56562	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:33.973803043 CET	56562	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:33.976995945 CET	56562	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:33.982443094 CET	3778	56562	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:33.982742071 CET	56562	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:33.988347054 CET	3778	56562	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:34.854839087 CET	56564	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:34.860687971 CET	3778	56564	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:34.861054897 CET	56564	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:34.864712000 CET	56564	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:34.870294094 CET	3778	56564	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:34.870537043 CET	56564	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:34.876126051 CET	3778	56564	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:35.591880083 CET	3778	56562	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:35.592211962 CET	56562	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:35.597629070 CET	3778	56562	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:36.596561909 CET	56566	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:36.600363016 CET	3778	56564	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:36.600575924 CET	56564	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:36.601567030 CET	3778	56566	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:36.601667881 CET	56566	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:36.603409052 CET	56566	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:36.605531931 CET	3778	56564	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:36.608350039 CET	3778	56566	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:36.608519077 CET	56566	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:36.613442898 CET	3778	56566	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:37.605437994 CET	56568	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:37.611020088 CET	3778	56568	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:37.611264944 CET	56568	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:37.614240885 CET	56568	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:37.619811058 CET	3778	56568	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:37.620332956 CET	56568	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:37.625775099 CET	3778	56568	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:38.241545916 CET	3778	56566	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:38.242297888 CET	56566	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:38.247505903 CET	3778	56566	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:39.218822956 CET	3778	56568	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:39.219412088 CET	56568	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:39.224742889 CET	3778	56568	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:39.246643066 CET	56570	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:39.251482010 CET	3778	56570	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:39.251595974 CET	56570	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:39.253614902 CET	56570	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:39.258505106 CET	3778	56570	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:39.258707047 CET	56570	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:39.263597965 CET	3778	56570	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:40.227730989 CET	56572	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:40.412364960 CET	3778	56572	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:40.413050890 CET	56572	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:40.416579962 CET	56572	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:40.421922922 CET	3778	56572	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:40.422049999 CET	56572	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:40.427095890 CET	3778	56572	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:40.861749887 CET	3778	56570	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:40.862512112 CET	56570	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:40.867774963 CET	3778	56570	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:41.867690086 CET	56574	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:41.872827053 CET	3778	56574	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:41.873253107 CET	56574	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:41.875683069 CET	56574	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:41.880507946 CET	3778	56574	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:41.880839109 CET	56574	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:41.885740995 CET	3778	56574	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:42.033781052 CET	3778	56572	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:42.034483910 CET	56572	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:42.039741039 CET	3778	56572	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:43.041584015 CET	56576	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:43.047117949 CET	3778	56576	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:43.047751904 CET	56576	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:43.051079035 CET	56576	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:43.056374073 CET	3778	56576	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:43.056668997 CET	56576	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:43.061925888 CET	3778	56576	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:43.487170935 CET	3778	56574	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:43.487847090 CET	56574	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:43.493125916 CET	3778	56574	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:44.492971897 CET	56578	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:44.498487949 CET	3778	56578	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:44.498676062 CET	56578	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:44.500827074 CET	56578	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:44.505662918 CET	3778	56578	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:44.505748034 CET	56578	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:44.510584116 CET	3778	56578	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:44.693540096 CET	3778	56576	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:44.694442034 CET	56576	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:44.700045109 CET	3778	56576	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:45.700764894 CET	56580	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:45.706249952 CET	3778	56580	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:45.706578016 CET	56580	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:45.708796978 CET	56580	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:45.713828087 CET	3778	56580	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:45.714266062 CET	56580	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:45.925127983 CET	56580	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:45.930501938 CET	3778	56580	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:45.930619955 CET	3778	56580	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:46.108012915 CET	3778	56578	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:46.108764887 CET	56578	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:46.114151955 CET	3778	56578	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:47.115973949 CET	56582	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:47.121444941 CET	3778	56582	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:47.121892929 CET	56582	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:47.124030113 CET	56582	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:47.129590988 CET	3778	56582	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:47.129988909 CET	56582	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:47.135010958 CET	3778	56582	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:47.349925041 CET	3778	56580	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:47.350816011 CET	56580	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:47.356595993 CET	3778	56580	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:48.357434988 CET	56584	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:48.362513065 CET	3778	56584	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:48.362734079 CET	56584	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:48.365077019 CET	56584	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:48.369951963 CET	3778	56584	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:48.370194912 CET	56584	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:48.375051975 CET	3778	56584	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:48.733082056 CET	3778	56582	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:48.733829021 CET	56582	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:48.739747047 CET	3778	56582	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:49.741110086 CET	56586	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:49.746478081 CET	3778	56586	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:49.746659040 CET	56586	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:49.748976946 CET	56586	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:49.754224062 CET	3778	56586	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:49.754601955 CET	56586	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:49.760225058 CET	3778	56586	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:49.991117954 CET	3778	56584	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:49.992135048 CET	56584	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:49.997546911 CET	3778	56584	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:50.999762058 CET	56588	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:51.005870104 CET	3778	56588	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:51.006359100 CET	56588	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:51.008377075 CET	56588	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:51.013953924 CET	3778	56588	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:51.014509916 CET	56588	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:51.020014048 CET	3778	56588	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:51.424504995 CET	3778	56586	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:51.425273895 CET	56586	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:51.430638075 CET	3778	56586	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:52.431392908 CET	56590	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:52.437278032 CET	3778	56590	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:52.437752008 CET	56590	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:52.441179037 CET	56590	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:52.446571112 CET	3778	56590	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:52.447038889 CET	56590	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:52.452482939 CET	3778	56590	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:54.047792912 CET	3778	56590	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:54.048603058 CET	56590	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:54.053906918 CET	3778	56590	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:55.057269096 CET	56592	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:55.063086987 CET	3778	56592	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:55.063411951 CET	56592	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:55.066239119 CET	56592	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:55.072470903 CET	3778	56592	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:55.072668076 CET	56592	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:55.078238964 CET	3778	56592	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:56.674355984 CET	3778	56592	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:56.675362110 CET	56592	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:56.680847883 CET	3778	56592	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:57.682646036 CET	56594	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:57.688440084 CET	3778	56594	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:57.688891888 CET	56594	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:57.691478014 CET	56594	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:57.697066069 CET	3778	56594	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:57.697370052 CET	56594	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:57.702999115 CET	3778	56594	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:59.331501961 CET	3778	56594	154.213.187.11	192.168.2.15
Jan 13, 2025 23:19:59.332412958 CET	56594	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:19:59.337989092 CET	3778	56594	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:00.340311050 CET	56596	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:00.559992075 CET	3778	56596	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:00.560527086 CET	56596	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:00.564836979 CET	56596	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:00.569770098 CET	3778	56596	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:00.570045948 CET	56596	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:00.575182915 CET	3778	56596	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:01.018824100 CET	56588	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:01.024486065 CET	3778	56588	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:02.190511942 CET	3778	56596	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:02.190990925 CET	56596	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:02.196248055 CET	3778	56596	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:03.196604013 CET	56598	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:03.201956987 CET	3778	56598	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:03.202059984 CET	56598	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:03.204802036 CET	56598	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:03.210180044 CET	3778	56598	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:03.210644960 CET	56598	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:03.216150045 CET	3778	56598	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:04.676954985 CET	3778	56588	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:04.677519083 CET	56588	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:04.683002949 CET	3778	56588	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:04.815572023 CET	3778	56598	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:04.815769911 CET	56598	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:04.823487043 CET	3778	56598	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:05.683439016 CET	56600	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.688939095 CET	3778	56600	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:05.689246893 CET	56600	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.692064047 CET	56600	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.697458029 CET	3778	56600	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:05.697680950 CET	56600	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.703167915 CET	3778	56600	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:05.821289062 CET	56602	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.826719046 CET	3778	56602	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:05.827090979 CET	56602	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.829329967 CET	56602	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.834479094 CET	3778	56602	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:05.835108042 CET	56602	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:05.840265989 CET	3778	56602	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:07.381580114 CET	3778	56600	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:07.382642031 CET	56600	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:07.388220072 CET	3778	56600	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:07.539489985 CET	3778	56602	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:07.540419102 CET	56602	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:07.545975924 CET	3778	56602	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:08.390739918 CET	56604	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.396547079 CET	3778	56604	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:08.396887064 CET	56604	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.399533033 CET	56604	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.404990911 CET	3778	56604	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:08.405486107 CET	56604	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.411132097 CET	3778	56604	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:08.548748016 CET	56606	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.690196037 CET	3778	56606	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:08.690706968 CET	56606	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.695385933 CET	56606	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.700644970 CET	3778	56606	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:08.701128960 CET	56606	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:08.706701040 CET	3778	56606	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:10.112261057 CET	3778	56604	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:10.113002062 CET	56604	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:10.118443012 CET	3778	56604	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:10.554836035 CET	3778	56606	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:10.555119991 CET	56606	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:10.560389042 CET	3778	56606	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:11.119363070 CET	56608	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.125185966 CET	3778	56608	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:11.125354052 CET	56608	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.127046108 CET	56608	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.132400036 CET	3778	56608	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:11.132677078 CET	56608	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.138288975 CET	3778	56608	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:11.561269999 CET	56610	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.566745043 CET	3778	56610	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:11.566832066 CET	56610	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.569524050 CET	56610	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.574558020 CET	3778	56610	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:11.574764967 CET	56610	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:11.579648018 CET	3778	56610	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:12.718030930 CET	3778	56608	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:12.718621969 CET	56608	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:12.724262953 CET	3778	56608	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:13.187897921 CET	3778	56610	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:13.188508987 CET	56610	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:13.194324017 CET	3778	56610	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:13.725514889 CET	56612	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:13.731090069 CET	3778	56612	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:13.731374979 CET	56612	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:13.734098911 CET	56612	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:13.739547014 CET	3778	56612	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:13.740130901 CET	56612	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:13.745790005 CET	3778	56612	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:14.195233107 CET	56614	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:14.201261044 CET	3778	56614	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:14.201632977 CET	56614	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:14.204258919 CET	56614	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:14.209706068 CET	3778	56614	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:14.210114002 CET	56614	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:14.215692997 CET	3778	56614	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:15.381514072 CET	3778	56612	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:15.382325888 CET	56612	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:15.387598038 CET	3778	56612	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:15.842864037 CET	3778	56614	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:15.843780041 CET	56614	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:15.849435091 CET	3778	56614	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:16.389370918 CET	56616	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:16.394665003 CET	3778	56616	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:16.394932032 CET	56616	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:16.397542953 CET	56616	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:16.402719975 CET	3778	56616	154.213.187.11	192.168.2.15
Jan 13, 2025 23:20:16.403078079 CET	56616	3778	192.168.2.15	154.213.187.11
Jan 13, 2025 23:20:16.408643961 CET	3778	56616	154.213.187.11	192.168.2.15

System Behavior

Analysis Process: camp.arm7.elf PID: 5526, Parent PID: 5444

General

Start time (UTC):	22:18:03
Start date (UTC):	13/01/2025
Path:	/tmp/camp.arm7.elf
Arguments:	/tmp/camp.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5528, Parent PID: 5526

General

Start time (UTC):	22:18:03
Start date (UTC):	13/01/2025
Path:	/tmp/camp.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5530, Parent PID: 5528

General

Start time (UTC):	22:18:04
Start date (UTC):	13/01/2025
Path:	/tmp/camp.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5532, Parent PID: 5528

General

Start time (UTC):	22:18:04
Start date (UTC):	13/01/2025
Path:	/tmp/camp.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5536, Parent PID: 5526

General

Start time (UTC):	22:18:10
Start date (UTC):	13/01/2025
Path:	/tmp/camp.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5538, Parent PID: 5526

General

Start time (UTC):	22:18:10
Start date (UTC):	13/01/2025
Path:	/tmp/camp.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report camp.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: camp.arm7.elf PID: 5526, Parent PID: 5444

General

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5528, Parent PID: 5526

General

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5530, Parent PID: 5528

General

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5532, Parent PID: 5528

General

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5536, Parent PID: 5526

General

Chronological Activities

Analysis Process: camp.arm7.elf PID: 5538, Parent PID: 5526

General

Chronological Activities

Linux Analysis Report
camp.arm7.elf