Edit tour

Linux Analysis Report
camp.ppc.elf

Overview

General Information

Sample name:	camp.ppc.elf
Analysis ID:	1590316
MD5:	4019c549aa881ed8e5bd7132a1a5b0c0
SHA1:	9d97745232e78c62192ce23b6ffc76aa7ecb1351
SHA256:	96d3d6b3fd50dbac7866231a3175bdfa5151a1fb7a683bf0d29b1ea165de7add
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590316
Start date and time:	2025-01-13 23:21:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	camp.ppc.elf
Detection:	MAL
Classification:	mal76.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/camp.ppc.elf
PID:	6251
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

camp.ppc.elf (PID: 6251, Parent: 6176, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/camp.ppc.elf

camp.ppc.elf New Fork (PID: 6253, Parent: 6251)

camp.ppc.elf New Fork (PID: 6255, Parent: 6253)

camp.ppc.elf New Fork (PID: 6257, Parent: 6253)

camp.ppc.elf New Fork (PID: 6264, Parent: 6251)

camp.ppc.elf New Fork (PID: 6266, Parent: 6251)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6255.1.00007f83e400f000.00007f83e4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6251.1.00007f83e4005000.00007f83e4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb54c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb59c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb63c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb68c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6253.1.00007f83e400f000.00007f83e4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6264.1.00007f83e4005000.00007f83e4011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb54c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb59c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb63c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb68c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.ppc.elf PID: 6251	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.ppc.elf PID: 6251	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4ed3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ee7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4efb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4faf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4feb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5013:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5027:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x503b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x504f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5063:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.ppc.elf PID: 6253	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.ppc.elf PID: 6253	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x62b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x62cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x62e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x62f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x631d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x636d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6381:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6395:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x63a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x63bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x63d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x63e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x63f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x640d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6421:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6435:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6449:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: camp.ppc.elf PID: 6255	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: camp.ppc.elf PID: 6255	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x122b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1253:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1267:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1307:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x131b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1343:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1357:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x136b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x137f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1393:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: camp.ppc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: camp.ppc.elf	Virustotal: Detection: 47%			Perma Link
Source: camp.ppc.elf	ReversingLabs: Detection: 52%

Source: global traffic

TCP traffic: 192.168.2.23:47524 -> 154.213.187.11:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.11

Source: camp.ppc.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6255.1.00007f83e400f000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6251.1.00007f83e4005000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6253.1.00007f83e400f000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6264.1.00007f83e4005000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.ppc.elf PID: 6251, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.ppc.elf PID: 6253, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: camp.ppc.elf PID: 6255, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x100000

Source: 6255.1.00007f83e400f000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6251.1.00007f83e4005000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6253.1.00007f83e400f000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6264.1.00007f83e4005000.00007f83e4011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.ppc.elf PID: 6251, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.ppc.elf PID: 6253, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: camp.ppc.elf PID: 6255, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/6234/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/6226/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/6237/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/6251/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/6257/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/4501/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/4503/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/camp.ppc.elf (PID: 6251)	File opened: /proc/2208/status	Jump to behavior

Source: camp.ppc.elf

Submission file: segment LOAD with 7.9567 entropy (max. 8.0)

Source: /tmp/camp.ppc.elf (PID: 6251)

Queries kernel information via 'uname':

Jump to behavior

Source: camp.ppc.elf, 6253.1.00005651dafea000.00005651db09a000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: camp.ppc.elf, 6251.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp, camp.ppc.elf, 6253.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp, camp.ppc.elf, 6255.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp, camp.ppc.elf, 6264.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/camp.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/camp.ppc.elf
Source: camp.ppc.elf, 6251.1.00005651dafea000.00005651db0bb000.rw-.sdmp, camp.ppc.elf, 6255.1.00005651dafea000.00005651db09a000.rw-.sdmp, camp.ppc.elf, 6264.1.00005651dafea000.00005651db0bb000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: camp.ppc.elf, 6251.1.00005651dafea000.00005651db0bb000.rw-.sdmp, camp.ppc.elf, 6253.1.00005651dafea000.00005651db09a000.rw-.sdmp, camp.ppc.elf, 6255.1.00005651dafea000.00005651db09a000.rw-.sdmp, camp.ppc.elf, 6264.1.00005651dafea000.00005651db0bb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: camp.ppc.elf, 6251.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp, camp.ppc.elf, 6253.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp, camp.ppc.elf, 6255.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp, camp.ppc.elf, 6264.1.00007fff7c0b3000.00007fff7c0d4000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: camp.ppc.elf PID: 6251, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.ppc.elf PID: 6253, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.ppc.elf PID: 6255, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: camp.ppc.elf PID: 6251, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.ppc.elf PID: 6253, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: camp.ppc.elf PID: 6255, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
camp.ppc.elf	48%	Virustotal		Browse
camp.ppc.elf	53%	ReversingLabs	Linux.Trojan.Mirai
camp.ppc.elf	100%	Avira	EXP/ELF.Agent.F.118

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	camp.ppc.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
154.213.187.11	unknown	Seychelles	22769	DDOSING-BGP-NETWORKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	camp.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	dlr.x86.elf	Get hash	malicious	Unknown	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
91.189.91.42	camp.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	dlr.x86.elf	Get hash	malicious	Unknown	Browse
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
154.213.187.11	camp.arm7.elf	Get hash	malicious	Mirai	Browse
	camp.x86_64.elf	Get hash	malicious	Mirai	Browse
	camp.i686.elf	Get hash	malicious	Mirai	Browse
	camp.sh4.elf	Get hash	malicious	Mirai	Browse
	camp.spc.elf	Get hash	malicious	Mirai	Browse
	camp.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	camp.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
CANONICAL-ASGB	camp.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
INIT7CH	camp.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dlr.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
DDOSING-BGP-NETWORKUS	camp.arm7.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.x86_64.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.i686.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	hikarm4.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	hikarm7.elf	Get hash	malicious	Mirai	Browse	154.213.187.125
	hikarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	gx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	camp.sh4.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.spc.elf	Get hash	malicious	Mirai	Browse	154.213.187.11
	camp.x86.elf	Get hash	malicious	Mirai	Browse	154.213.187.11

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.95401863835498
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	camp.ppc.elf
File size:	35'140 bytes
MD5:	4019c549aa881ed8e5bd7132a1a5b0c0
SHA1:	9d97745232e78c62192ce23b6ffc76aa7ecb1351
SHA256:	96d3d6b3fd50dbac7866231a3175bdfa5151a1fb7a683bf0d29b1ea165de7add
SHA512:	0bc1228455464c9416f83ef873170ba51cc0a13ef0dcb6275edfcc50c2f59c303424bdd0a9d0e82eec3a9e9cd9bac9941a2edae2b743acf9fb5fe51f8adc78c0
SSDEEP:	768:seDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2i6TG14uVcqgw09N:sCRocD0Lu/PWUWr/iurJ4u+qgw09N
TLSH:	BCF2E174C1E84FD7ED9A8EF42AD067EABBEC0E4B1711CC9231018F819B02926459BDD6
File Content Preview:	.ELF......................v`...4.........4. ...(.......................H...H..............I...I...I.................dt.Q................................UPX!..........%...%........V.......?.E.h4...@b..............i...[.Q.........4+j..xUs.].......6....)....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x107660
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x8848	0x8848	7.9567	0x5	R E	0x10000
LOAD	0x49a4	0x100249a4	0x100249a4	0x0	0x0	0.0000	0x6	RW	0x10000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 23:22:02.449634075 CET	43928	443	192.168.2.23	91.189.91.42
Jan 13, 2025 23:22:03.721870899 CET	47524	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:03.726852894 CET	3778	47524	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:03.726907015 CET	47524	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:03.768013954 CET	47524	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:03.772883892 CET	3778	47524	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:03.772943020 CET	47524	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:03.777744055 CET	3778	47524	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:05.329649925 CET	3778	47524	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:05.329828024 CET	47524	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:05.334789991 CET	3778	47524	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:06.332397938 CET	47526	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:06.337356091 CET	3778	47526	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:06.337400913 CET	47526	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:06.338074923 CET	47526	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:06.342866898 CET	3778	47526	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:06.342910051 CET	47526	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:06.347702026 CET	3778	47526	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:07.942488909 CET	3778	47526	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:07.942709923 CET	47526	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:07.947632074 CET	3778	47526	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:08.080979109 CET	42836	443	192.168.2.23	91.189.91.43
Jan 13, 2025 23:22:08.944087982 CET	47528	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:08.949146032 CET	3778	47528	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:08.949223042 CET	47528	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:08.950294971 CET	47528	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:08.955166101 CET	3778	47528	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:08.955221891 CET	47528	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:08.960118055 CET	3778	47528	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:09.104792118 CET	42516	80	192.168.2.23	109.202.202.202
Jan 13, 2025 23:22:10.463584900 CET	47530	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:10.468540907 CET	3778	47530	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:10.468672991 CET	47530	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:10.531522989 CET	47530	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:10.536334991 CET	3778	47530	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:10.536387920 CET	47530	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:10.541115999 CET	3778	47530	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:10.566644907 CET	3778	47528	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:10.566731930 CET	47528	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:10.571599007 CET	3778	47528	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:11.569768906 CET	47532	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:11.574848890 CET	3778	47532	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:11.574913025 CET	47532	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:11.577030897 CET	47532	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:11.581914902 CET	3778	47532	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:11.582005978 CET	47532	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:11.586829901 CET	3778	47532	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:12.127023935 CET	3778	47530	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:12.127681017 CET	47530	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:12.132618904 CET	3778	47530	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:13.131594896 CET	47534	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:13.136750937 CET	3778	47534	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:13.136923075 CET	47534	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:13.138114929 CET	47534	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:13.143006086 CET	3778	47534	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:13.143063068 CET	47534	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:13.148027897 CET	3778	47534	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:13.192715883 CET	3778	47532	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:13.192972898 CET	47532	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:13.197843075 CET	3778	47532	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:14.196317911 CET	47536	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:14.201293945 CET	3778	47536	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:14.201494932 CET	47536	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:14.202661037 CET	47536	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:14.207444906 CET	3778	47536	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:14.207500935 CET	47536	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:14.212306023 CET	3778	47536	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:14.735702991 CET	3778	47534	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:14.736037970 CET	47534	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:14.736037970 CET	47534	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:14.742403030 CET	3778	47534	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:15.738325119 CET	47538	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:15.743555069 CET	3778	47538	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:15.743671894 CET	47538	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:15.744985104 CET	47538	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:15.749938965 CET	3778	47538	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:15.750030994 CET	47538	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:15.754899025 CET	3778	47538	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:15.850223064 CET	3778	47536	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:15.850409031 CET	47536	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:15.855231047 CET	3778	47536	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:16.854902983 CET	47540	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:16.859824896 CET	3778	47540	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:16.859941006 CET	47540	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:16.863529921 CET	47540	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:16.868376970 CET	3778	47540	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:16.868455887 CET	47540	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:16.877752066 CET	3778	47540	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:18.490793943 CET	3778	47540	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:18.491220951 CET	47540	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:18.496103048 CET	3778	47540	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:19.501255989 CET	47542	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:19.567090034 CET	3778	47542	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:19.567439079 CET	47542	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:19.577081919 CET	47542	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:19.581873894 CET	3778	47542	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:19.581938982 CET	47542	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:19.586723089 CET	3778	47542	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:21.194667101 CET	3778	47542	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:21.195127010 CET	47542	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:21.200494051 CET	3778	47542	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:22.198334932 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:22.203845024 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:22.203967094 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:22.204832077 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:22.209673882 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:22.209745884 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:22.214539051 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:22.770262957 CET	3778	47538	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:22.770729065 CET	47538	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:22.776120901 CET	3778	47538	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:23.776396990 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:23.781718016 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:23.781821012 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:23.783535957 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:23.789000034 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:23.789187908 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:23.794563055 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:23.799218893 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:23.799665928 CET	47544	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:23.805021048 CET	3778	47544	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:24.206700087 CET	43928	443	192.168.2.23	91.189.91.42
Jan 13, 2025 23:22:24.803597927 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:24.808720112 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:24.808965921 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:24.810419083 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:24.815407991 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:24.815485001 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:24.820487022 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:25.413295031 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:25.413748026 CET	47546	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:25.418972015 CET	3778	47546	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:26.419454098 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:26.424766064 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:26.424846888 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:26.426080942 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:26.428963900 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:26.429163933 CET	47548	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:26.430934906 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:26.430991888 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:26.434092045 CET	3778	47548	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:26.435854912 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:27.431514025 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:27.436918974 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:27.437083960 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:27.438342094 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:27.443249941 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:27.443382978 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:27.448225975 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:28.050385952 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:28.050869942 CET	47550	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:28.055861950 CET	3778	47550	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:29.052244902 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:29.052795887 CET	47552	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:29.055501938 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:29.058608055 CET	3778	47552	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:29.060643911 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:29.060739994 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:29.062273979 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:29.068113089 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:29.068316936 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:29.073821068 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:30.056344032 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:30.061853886 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:30.061949015 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:30.063112020 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:30.068239927 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:30.068459988 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:30.073476076 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:30.682180882 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:30.682702065 CET	47554	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:30.688221931 CET	3778	47554	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:31.677527905 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:31.678240061 CET	47556	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:31.683481932 CET	3778	47556	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:31.685899019 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:31.691143990 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:31.691404104 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:31.693309069 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:31.698374033 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:31.698575974 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:31.703907967 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:32.684171915 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:32.689861059 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:32.690154076 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:32.693327904 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:32.698612928 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:32.699137926 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:32.704488993 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:33.303781033 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:33.304764986 CET	47558	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:33.310267925 CET	3778	47558	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:34.313962936 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:34.318283081 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:34.318718910 CET	47560	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:34.319591045 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:34.319869041 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:34.323133945 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:34.324263096 CET	3778	47560	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:34.328423977 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:34.328979969 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:34.334259987 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:34.445405006 CET	42836	443	192.168.2.23	91.189.91.43
Jan 13, 2025 23:22:35.323120117 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:35.328825951 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:35.329391956 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:35.332381964 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:35.337613106 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:35.338195086 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:35.343751907 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:36.975368977 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:36.975924015 CET	47564	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:36.981420994 CET	3778	47564	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:37.982515097 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:37.988097906 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:37.988564014 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:37.990999937 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:37.996527910 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:37.996767044 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:38.002260923 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:38.540791035 CET	42516	80	192.168.2.23	109.202.202.202
Jan 13, 2025 23:22:39.618448019 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:39.619169950 CET	47566	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:39.625025988 CET	3778	47566	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:40.625386000 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:40.631138086 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:40.631680012 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:40.633554935 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:40.639216900 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:40.639565945 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:40.645051956 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:42.255729914 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:42.256294012 CET	47568	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:42.261663914 CET	3778	47568	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:43.262128115 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:43.267950058 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:43.268454075 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:43.271055937 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:43.276740074 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:43.277074099 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:43.282210112 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:44.332354069 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:44.338166952 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:44.880275011 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:44.880997896 CET	47570	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:44.885907888 CET	3778	47570	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:45.886863947 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:45.891917944 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:45.892160892 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:45.893819094 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:45.898696899 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:45.898914099 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:45.903772116 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:47.487543106 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:47.488320112 CET	47572	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:47.494050026 CET	3778	47572	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:48.495934010 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:48.502033949 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:48.502523899 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:48.504961014 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:48.510520935 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:48.510972977 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:48.516472101 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:50.126080036 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:50.127111912 CET	47574	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:50.132945061 CET	3778	47574	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:51.133841038 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:51.139691114 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:51.139986038 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:51.143781900 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:51.149410963 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:51.149777889 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:51.155431032 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:52.739145041 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:52.740005970 CET	47576	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:52.745208979 CET	3778	47576	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:53.299854994 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:53.300755024 CET	47562	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:53.306109905 CET	3778	47562	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:53.747699976 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:53.753154039 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:53.753429890 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:53.756607056 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:53.761805058 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:53.761938095 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:53.766973019 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:54.309240103 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:54.314882994 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:54.315112114 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:54.318469048 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:54.324115038 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:54.324357033 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:54.329744101 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:55.399869919 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:55.400588989 CET	47578	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:55.406223059 CET	3778	47578	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:55.924320936 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:55.925076962 CET	47580	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:55.930810928 CET	3778	47580	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:56.407980919 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.413880110 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:56.414308071 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.416760921 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.422406912 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:56.422863960 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.428376913 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:56.932812929 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.938426971 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:56.938925982 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.941802979 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.947263002 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:56.947741985 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:56.953306913 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:58.060214043 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:58.061269999 CET	47582	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:58.067157984 CET	3778	47582	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:58.565037966 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:58.565769911 CET	47584	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:58.571465015 CET	3778	47584	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:59.069447994 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.075375080 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:59.075650930 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.078053951 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.083580017 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:59.083787918 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.089451075 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:59.573287964 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.579195023 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:59.579565048 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.582597017 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.587836981 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:22:59.588244915 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:22:59.593660116 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:00.693325043 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:00.693907022 CET	47586	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:00.699279070 CET	3778	47586	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:01.226696968 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:01.227441072 CET	47588	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:01.232750893 CET	3778	47588	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:01.701335907 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:01.707405090 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:01.707633018 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:01.710362911 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:01.716021061 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:01.716273069 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:01.730065107 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:02.235053062 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:02.241074085 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:02.241370916 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:02.244725943 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:02.250345945 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:02.250833035 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:02.256268024 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:03.354537010 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:03.355124950 CET	47590	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:03.360208035 CET	3778	47590	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:03.881861925 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:03.882688046 CET	47592	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:03.888426065 CET	3778	47592	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:04.362432003 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.368580103 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:04.369077921 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.371870041 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.377516031 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:04.377883911 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.383533955 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:04.889988899 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.895642996 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:04.896164894 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.898639917 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.904098988 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:04.904459000 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:04.909996033 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:05.161194086 CET	43928	443	192.168.2.23	91.189.91.42
Jan 13, 2025 23:23:05.971080065 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:05.971792936 CET	47594	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:05.977262974 CET	3778	47594	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:06.522272110 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:06.523102999 CET	47596	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:06.528533936 CET	3778	47596	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:06.976778030 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:06.982871056 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:06.983186007 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:06.985435009 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:06.991372108 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:06.991667986 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:06.999511003 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:07.530234098 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:07.535864115 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:07.536173105 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:07.539323092 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:07.544765949 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:07.545190096 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:07.550648928 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:08.604260921 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:08.604827881 CET	47598	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:08.610780954 CET	3778	47598	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:09.198447943 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:09.199199915 CET	47600	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:09.204735994 CET	3778	47600	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:09.609267950 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:09.614980936 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:09.615195990 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:09.617358923 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:09.622823000 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:09.622997046 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:09.628528118 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:10.206315041 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:10.211733103 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:10.211885929 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:10.214574099 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:10.220110893 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:10.220475912 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:10.225951910 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:11.870429993 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:11.871206045 CET	47604	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:11.876633883 CET	3778	47604	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:12.880667925 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:12.886137009 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:12.886513948 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:12.889246941 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:12.894675016 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:12.895001888 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:12.900469065 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:14.553677082 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:14.554555893 CET	47606	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:14.560081005 CET	3778	47606	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:15.562446117 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:15.567905903 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:15.568202019 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:15.571846008 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:15.577056885 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:15.577212095 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:15.582166910 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:16.646059036 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:16.647043943 CET	47602	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:16.652379990 CET	3778	47602	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:17.174191952 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:17.175036907 CET	47608	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:17.181346893 CET	3778	47608	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:17.654977083 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:17.660311937 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:17.660738945 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:17.664091110 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:17.669473886 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:17.669996977 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:17.675031900 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:18.182184935 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:18.187532902 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:18.188030958 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:18.191205978 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:18.196314096 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:18.196610928 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:18.201682091 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:19.271548033 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:19.272399902 CET	47610	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:19.278143883 CET	3778	47610	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:19.839169979 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:19.839905977 CET	47612	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:19.845767975 CET	3778	47612	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:20.280270100 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.285439968 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:20.285751104 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.288563013 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.293675900 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:20.294146061 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.299101114 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:20.848225117 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.853858948 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:20.854371071 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.857639074 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.863069057 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:20.863326073 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:20.868360043 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:21.897155046 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:21.898049116 CET	47614	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:21.903575897 CET	3778	47614	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:22.455631018 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:22.456187010 CET	47616	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:22.461153030 CET	3778	47616	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:22.904026031 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:22.909446001 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:22.910116911 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:22.912417889 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:22.917629004 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:22.918086052 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:22.923223019 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:23.461781979 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:23.467194080 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:23.467541933 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:23.469536066 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:23.474838018 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:23.475106955 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:23.480570078 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:24.532967091 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:24.533849001 CET	47618	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:24.539578915 CET	3778	47618	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:25.102417946 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:25.103261948 CET	47620	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:25.109051943 CET	3778	47620	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:25.542640924 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:25.548671007 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:25.549412012 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:25.552417040 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:25.557831049 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:25.558418036 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:25.563985109 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:26.111427069 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:26.118072987 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:26.118721008 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:26.122042894 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:26.127499104 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:26.128081083 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:26.133878946 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:27.178898096 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:27.179665089 CET	47622	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:27.185254097 CET	3778	47622	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:27.748223066 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:27.748800993 CET	47624	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:27.753937006 CET	3778	47624	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:28.186398983 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.191996098 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:28.192260981 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.194596052 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.200196981 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:28.200458050 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.205853939 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:28.754575014 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.760082960 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:28.760391951 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.762686014 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.768029928 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:28.768379927 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:28.773947001 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:29.801295042 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:29.802041054 CET	47626	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:29.807768106 CET	3778	47626	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:30.362200022 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:30.362785101 CET	47628	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:30.368325949 CET	3778	47628	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:30.807215929 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:30.812798023 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:30.813144922 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:30.815412998 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:30.820395947 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:30.820513964 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:30.825854063 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:31.370717049 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:31.376348972 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:31.376560926 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:31.379065037 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:31.384432077 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:31.384608984 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:31.390234947 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:32.428591013 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:32.429475069 CET	47630	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:32.435450077 CET	3778	47630	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:32.998991013 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:32.999712944 CET	47632	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:33.005235910 CET	3778	47632	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:33.434928894 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:33.440206051 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:33.440304041 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:33.441328049 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:33.446299076 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:33.446479082 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:33.451356888 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:34.005042076 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:34.011555910 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:34.011776924 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:34.013231993 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:34.018471956 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:34.018657923 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:34.023947954 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:35.648024082 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:35.648624897 CET	47636	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:35.653605938 CET	3778	47636	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:36.653979063 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:37.605969906 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:37.606515884 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:37.609355927 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:37.614204884 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:37.614558935 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:37.619481087 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:39.208218098 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:39.208957911 CET	47638	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:39.214643955 CET	3778	47638	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:40.215553999 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:40.221402884 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:40.221820116 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:40.224858999 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:40.230662107 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:40.230983019 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:40.236584902 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:40.459816933 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:40.460160017 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:40.460160971 CET	47634	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:40.465636015 CET	3778	47634	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:41.466141939 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:41.471690893 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:41.471935034 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:41.474273920 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:41.479504108 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:41.479690075 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:41.485066891 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:41.919142008 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:41.920058012 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:41.920058966 CET	47640	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:41.925893068 CET	3778	47640	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:42.928747892 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:42.934510946 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:42.934887886 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:42.937978983 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:42.943483114 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:42.943888903 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:42.949518919 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:43.104399920 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:43.105029106 CET	47642	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:43.110398054 CET	3778	47642	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:44.112256050 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:44.118062973 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:44.118475914 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:44.121529102 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:44.126940966 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:44.127177000 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:44.132525921 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:44.586332083 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:44.587066889 CET	47644	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:44.592133999 CET	3778	47644	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:45.594343901 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:45.599607944 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:45.599698067 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:45.602109909 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:45.606981039 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:45.607060909 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:45.611999035 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:45.722893953 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:45.723376989 CET	47646	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:45.728403091 CET	3778	47646	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:46.729520082 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:46.734549999 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:46.734687090 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:46.736814976 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:46.741784096 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:46.741903067 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:46.746783018 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:48.368535042 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:48.369472027 CET	47650	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:48.375215054 CET	3778	47650	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:49.374612093 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:49.379955053 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:49.380038023 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:49.381521940 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:49.386447906 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:49.386599064 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:49.391500950 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:49.613055944 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:49.613496065 CET	47648	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:49.618530989 CET	3778	47648	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:50.620542049 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:50.626271963 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:50.626497984 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:50.629610062 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:50.635139942 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:50.635400057 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:50.640542984 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:51.007230043 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:51.008107901 CET	47652	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:51.013689041 CET	3778	47652	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:52.015010118 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:52.020710945 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:52.020910978 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:52.024146080 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:52.029303074 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:52.029481888 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:52.034631014 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:52.276557922 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:52.277371883 CET	47654	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:52.282764912 CET	3778	47654	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:53.285007954 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:53.290528059 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:53.290957928 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:53.293977976 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:53.299293041 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:53.299700022 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:53.304889917 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:53.646204948 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:53.646970034 CET	47656	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:53.652429104 CET	3778	47656	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:54.653852940 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:54.659363985 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:54.659897089 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:54.662200928 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:54.667310953 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:54.667678118 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:54.672872066 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:54.934576988 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:54.935369968 CET	47658	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:54.940504074 CET	3778	47658	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:55.942048073 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:55.947587967 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:55.947897911 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:55.950968027 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:55.956361055 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:55.956759930 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:55.962119102 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:56.293056965 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:56.293642998 CET	47660	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:56.298815966 CET	3778	47660	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:57.300383091 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:57.305818081 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:57.306060076 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:57.308495045 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:57.313446999 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:57.313676119 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:57.318614006 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:57.569983006 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:57.570599079 CET	47662	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:57.575802088 CET	3778	47662	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:58.577557087 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:58.582850933 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:58.583184958 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:58.585472107 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:58.590661049 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:58.591130972 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:58.596704006 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:58.930372000 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:58.931133986 CET	47664	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:58.936952114 CET	3778	47664	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:59.939657927 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:59.945481062 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:59.945915937 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:59.948784113 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:59.954301119 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:23:59.954655886 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:23:59.960325003 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:00.195240974 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:00.195986032 CET	47666	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:00.201150894 CET	3778	47666	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:01.203239918 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:01.208787918 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:01.209148884 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:01.211673975 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:01.217359066 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:01.217694044 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:01.223246098 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:01.584609985 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:01.585206032 CET	47668	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:01.590776920 CET	3778	47668	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:02.590054035 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:02.596285105 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:02.596386909 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:02.598598957 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:02.604032993 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:02.604259968 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:02.610110998 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:02.799957991 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:02.800694942 CET	47670	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:02.806399107 CET	3778	47670	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:03.807995081 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:03.813111067 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:03.813220978 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:03.815242052 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:03.820175886 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:03.820267916 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:03.825109959 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:04.191294909 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:04.192030907 CET	47672	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:04.197686911 CET	3778	47672	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:05.198601007 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:05.205452919 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:05.205672979 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:05.208328962 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:05.213716030 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:05.214221954 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:05.219683886 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:05.461361885 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:05.462055922 CET	47674	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:05.467499971 CET	3778	47674	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:06.470910072 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:06.476938963 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:06.477252960 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:06.480631113 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:06.485946894 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:06.486337900 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:06.491384983 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:06.837126970 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:06.837770939 CET	47676	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:06.843031883 CET	3778	47676	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:07.845789909 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:07.851222992 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:07.851640940 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:07.854643106 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:07.859869003 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:07.860244036 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:07.865525007 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:08.066323042 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:08.066970110 CET	47678	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:08.072582006 CET	3778	47678	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:09.075654030 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:09.081636906 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:09.081959009 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:09.084924936 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:09.090616941 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:09.091000080 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:09.096627951 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:09.492592096 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:09.493395090 CET	47680	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:09.498985052 CET	3778	47680	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:10.501285076 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:10.506979942 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:10.507286072 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:10.510626078 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:10.515770912 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:10.515917063 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:10.521466017 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:10.726063013 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:10.726620913 CET	47682	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:10.732006073 CET	3778	47682	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:11.735625982 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:11.741513014 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:11.741776943 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:11.744879961 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:11.750256062 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:11.750832081 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:11.756279945 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:12.132597923 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:12.133471966 CET	47684	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:12.139027119 CET	3778	47684	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:13.139692068 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:13.760684967 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:13.761037111 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:13.761725903 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:13.761843920 CET	47686	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:13.764136076 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:13.764238119 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:13.765585899 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:13.766222000 CET	3778	47686	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:13.770737886 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:13.770890951 CET	47688	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:13.775895119 CET	3778	47688	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:14.768183947 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:14.774604082 CET	3778	47690	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:14.775041103 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:14.777957916 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:14.783488035 CET	3778	47690	154.213.187.11	192.168.2.23
Jan 13, 2025 23:24:14.783935070 CET	47690	3778	192.168.2.23	154.213.187.11
Jan 13, 2025 23:24:14.788983107 CET	3778	47690	154.213.187.11	192.168.2.23

System Behavior

Analysis Process: camp.ppc.elf PID: 6251, Parent PID: 6176

General

Start time (UTC):	22:22:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.ppc.elf
Arguments:	/tmp/camp.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6253, Parent PID: 6251

General

Start time (UTC):	22:22:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6255, Parent PID: 6253

General

Start time (UTC):	22:22:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6257, Parent PID: 6253

General

Start time (UTC):	22:22:02
Start date (UTC):	13/01/2025
Path:	/tmp/camp.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6264, Parent PID: 6251

General

Start time (UTC):	22:22:09
Start date (UTC):	13/01/2025
Path:	/tmp/camp.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6266, Parent PID: 6251

General

Start time (UTC):	22:22:09
Start date (UTC):	13/01/2025
Path:	/tmp/camp.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report camp.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: camp.ppc.elf PID: 6251, Parent PID: 6176

General

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6253, Parent PID: 6251

General

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6255, Parent PID: 6253

General

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6257, Parent PID: 6253

General

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6264, Parent PID: 6251

General

Chronological Activities

Analysis Process: camp.ppc.elf PID: 6266, Parent PID: 6251

General

Chronological Activities

Linux Analysis Report
camp.ppc.elf