Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.x86.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.x86.elf
Analysis ID:	1617256
MD5:	6d4875d3f1faf8581f71a0e743585054
SHA1:	37f2480d990e21abdf27078a50ed634b54945d09
SHA256:	ad9c490813f5002cda86d665c6dd31f8df2a42abedc3cb10cefcae13e934930d
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1617256
Start date and time:	2025-02-17 17:12:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.x86.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
PID:	6238
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238, Parent: 6160, MD5: 6d4875d3f1faf8581f71a0e743585054) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6239, Parent: 6238)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6240, Parent: 6239)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6241, Parent: 6239)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6244, Parent: 6238)

ub8ehJSePAfc9FYqZIT6.x86.elf New Fork (PID: 6245, Parent: 6238)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6239.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6239.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6239.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6239.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6244.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6244.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6244.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6244.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6240.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6238.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1089c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1093c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1098c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_3a56423b	unknown	unknown	0x8f3b:$a: 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00
6238.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_dab39a25	unknown	unknown	0x7726:$a: 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00
6238.1.0000000008048000.000000000805b000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7052:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6239	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1133:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1147:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1183:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1197:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1223:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1237:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x125f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1273:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1287:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xcab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdaf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdeb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6244	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1276:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x129e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1302:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1316:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1352:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1366:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x137a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x138e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1406:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ub8ehJSePAfc9FYqZIT6.x86.elf	Virustotal: Detection: 43%			Perma Link
Source: ub8ehJSePAfc9FYqZIT6.x86.elf	ReversingLabs: Detection: 44%

Source: global traffic

TCP traffic: 192.168.2.23:34670 -> 61.7.209.115:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115
Source: unknown	TCP traffic detected without corresponding DNS query: 61.7.209.115

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6244.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6244, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal60.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1582/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/3088/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1579/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1699/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1335/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1698/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1334/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1576/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/2302/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/910/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/912/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/2307/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/918/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/6241/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1594/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1349/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1344/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1465/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1586/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1463/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/6238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1900/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/491/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/4508/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1477/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/379/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1476/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/2208/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1809/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/1494/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.x86.elf (PID: 6238)	File opened: /proc/260/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.x86.elf

Submission file: segment LOAD with 7.9649 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.x86.elf	43%	Virustotal		Browse
ub8ehJSePAfc9FYqZIT6.x86.elf	44%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
61.7.209.115	unknown	Thailand	9931	CAT-APTheCommunicationAuthoityofThailandCATTH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	QBPATWb3X7	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	enVDLZ8dqX.elf	Get hash	malicious	Akira	Browse
	openssh.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	QBPATWb3X7	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	wget.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	enVDLZ8dqX.elf	Get hash	malicious	Akira	Browse
	openssh.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	QBPATWb3X7	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	wget.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	enVDLZ8dqX.elf	Get hash	malicious	Akira	Browse	91.189.91.42
	openssh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
CANONICAL-ASGB	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	91.189.91.42
	QBPATWb3X7	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	wget.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	enVDLZ8dqX.elf	Get hash	malicious	Akira	Browse	91.189.91.42
	openssh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
CAT-APTheCommunicationAuthoityofThailandCATTH	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	122.155.121.49
	.Sarm5.elf	Get hash	malicious	Mirai	Browse	61.19.165.82
	https://storage.thaicarecloud.org/Package4273221/step1.php?id=98204537	Get hash	malicious	Unknown	Browse	61.19.254.8
	m68k.elf	Get hash	malicious	Unknown	Browse	122.155.121.43
	3.elf	Get hash	malicious	Unknown	Browse	122.155.39.113
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	122.155.121.187
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	202.129.40.184
	spc.elf	Get hash	malicious	Mirai	Browse	110.78.81.185
	botx.spc.elf	Get hash	malicious	Mirai	Browse	122.155.39.115
	nabmips.elf	Get hash	malicious	Unknown	Browse	61.7.214.196
INIT7CH	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	QBPATWb3X7	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	wget.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	enVDLZ8dqX.elf	Get hash	malicious	Akira	Browse	109.202.202.202
	openssh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.963105996052281
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ub8ehJSePAfc9FYqZIT6.x86.elf
File size:	38'732 bytes
MD5:	6d4875d3f1faf8581f71a0e743585054
SHA1:	37f2480d990e21abdf27078a50ed634b54945d09
SHA256:	ad9c490813f5002cda86d665c6dd31f8df2a42abedc3cb10cefcae13e934930d
SHA512:	14c7bf154eda33a8b599e7f420db7d3ac35088cdf78142d7e03b0d26dfc85f7aac573e82ca8e07ae6cbb88e7f66fb13410f31866c286418b65142de4ed2e8d19
SSDEEP:	768:7a+BWS+ZPwIIBPG/LxuBY3S6BsMbqcIP+B93GUakyzKTNMBI3nbcuyD7UrQRjI:7a+BH+hKBwLUqS61qco+BRGP5KBoKno8
TLSH:	9203E0A854ED8961FBAE423815DEFD07A189F227DD05DA87BD84341789C2FF30B1C296
File Content Preview:	.ELF....................`...4...........4. ...(.....................T...T...........................................Q.td.............................-..UPX!.........2...2......W..........?..k.I/.j....\.R......)..n.4go.\|.>#.....{~o....8.F.^...MFL.f.5 ..I.r

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc09460
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x9654	0x9654	7.9649	0x5	R E	0x1000
LOAD	0xc08	0x805bc08	0x805bc08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 749
• 3778 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2025 17:13:40.437570095 CET	43928	443	192.168.2.23	91.189.91.42
Feb 17, 2025 17:13:40.848494053 CET	34670	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:40.854338884 CET	3778	34670	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:40.854408026 CET	34670	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:40.854506016 CET	34670	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:40.860593081 CET	3778	34670	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:40.860645056 CET	34670	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:40.865582943 CET	3778	34670	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:41.837574005 CET	3778	34670	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:41.837765932 CET	34670	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:41.837765932 CET	34670	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:41.837804079 CET	34672	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:41.843337059 CET	3778	34672	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:41.843477964 CET	34672	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:41.843477964 CET	34672	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:41.848365068 CET	3778	34672	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:41.848448992 CET	34672	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:41.853255987 CET	3778	34672	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:42.815176010 CET	3778	34672	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:42.815318108 CET	34672	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:42.815346956 CET	34672	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:42.815382957 CET	34674	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:42.820200920 CET	3778	34674	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:42.820274115 CET	34674	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:42.820303917 CET	34674	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:42.825170040 CET	3778	34674	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:42.825217962 CET	34674	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:42.830070972 CET	3778	34674	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:43.795192003 CET	3778	34674	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:43.795376062 CET	34674	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:43.795411110 CET	34674	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:43.795439005 CET	34676	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:43.800327063 CET	3778	34676	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:43.800398111 CET	34676	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:43.800421953 CET	34676	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:43.805279970 CET	3778	34676	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:43.805341005 CET	34676	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:43.810195923 CET	3778	34676	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:44.786890984 CET	3778	34676	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:44.787035942 CET	34676	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:44.787117958 CET	34676	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:44.787194014 CET	34678	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:44.792087078 CET	3778	34678	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:44.792182922 CET	34678	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:44.792247057 CET	34678	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:44.797770977 CET	3778	34678	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:44.797821999 CET	34678	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:44.804519892 CET	3778	34678	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:45.789729118 CET	3778	34678	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:45.789958000 CET	34678	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:45.790004015 CET	34678	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:45.790065050 CET	34680	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:45.794864893 CET	3778	34680	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:45.794931889 CET	34680	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:45.794945955 CET	34680	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:45.799757957 CET	3778	34680	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:45.799803972 CET	34680	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:45.805095911 CET	3778	34680	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:45.812761068 CET	42836	443	192.168.2.23	91.189.91.43
Feb 17, 2025 17:13:46.327625036 CET	34682	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.334089041 CET	3778	34682	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:46.334156036 CET	34682	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.334374905 CET	34682	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.339236975 CET	3778	34682	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:46.339287043 CET	34682	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.344182014 CET	3778	34682	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:46.799572945 CET	3778	34680	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:46.799707890 CET	34680	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.799755096 CET	34680	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.799839973 CET	34684	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.804673910 CET	3778	34684	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:46.804743052 CET	34684	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.804757118 CET	34684	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.809699059 CET	3778	34684	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:46.809757948 CET	34684	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:46.814791918 CET	3778	34684	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.333348989 CET	3778	34682	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.333534956 CET	34682	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.333534956 CET	34682	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.333585978 CET	34686	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.339270115 CET	3778	34686	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.339416027 CET	34686	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.339416027 CET	34686	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.345983982 CET	3778	34686	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.346048117 CET	34686	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.348577023 CET	42516	80	192.168.2.23	109.202.202.202
Feb 17, 2025 17:13:47.351794004 CET	3778	34686	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.796982050 CET	3778	34684	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.797154903 CET	34684	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.797182083 CET	34684	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.797218084 CET	34688	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.802220106 CET	3778	34688	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.802336931 CET	34688	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.802336931 CET	34688	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.807317019 CET	3778	34688	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:47.807403088 CET	34688	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:47.812633991 CET	3778	34688	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.300314903 CET	3778	34686	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.300497055 CET	34686	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.300579071 CET	34686	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.300637007 CET	34690	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.306196928 CET	3778	34690	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.306266069 CET	34690	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.306323051 CET	34690	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.311479092 CET	3778	34690	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.311532021 CET	34690	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.316303968 CET	3778	34690	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.807552099 CET	3778	34688	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.807708979 CET	34688	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.807708979 CET	34688	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.807734966 CET	34692	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.812664986 CET	3778	34692	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.812726021 CET	34692	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.812747002 CET	34692	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.817568064 CET	3778	34692	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:48.817626953 CET	34692	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:48.822432041 CET	3778	34692	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.294972897 CET	3778	34690	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.295101881 CET	34690	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.295191050 CET	34690	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.295277119 CET	34694	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.301861048 CET	3778	34694	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.301975012 CET	34694	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.302037001 CET	34694	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.306982040 CET	3778	34694	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.307053089 CET	34694	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.311963081 CET	3778	34694	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.789449930 CET	3778	34692	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.789593935 CET	34692	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.789629936 CET	34692	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.789733887 CET	34696	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.794673920 CET	3778	34696	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.794747114 CET	34696	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.794836044 CET	34696	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.799710035 CET	3778	34696	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:49.799875975 CET	34696	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:49.804719925 CET	3778	34696	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.270457029 CET	3778	34694	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.270647049 CET	34694	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.270647049 CET	34694	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.270698071 CET	34698	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.276257038 CET	3778	34698	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.276339054 CET	34698	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.276376009 CET	34698	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.281219006 CET	3778	34698	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.281279087 CET	34698	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.286087990 CET	3778	34698	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.783606052 CET	3778	34696	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.783755064 CET	34696	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.783909082 CET	34696	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.784007072 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.788944006 CET	3778	34700	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.789237022 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.789365053 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.794302940 CET	3778	34700	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:50.794531107 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:50.799410105 CET	3778	34700	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:51.249286890 CET	3778	34698	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:51.249691963 CET	34702	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:51.249712944 CET	34698	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:51.249712944 CET	34698	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:51.254582882 CET	3778	34702	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:51.254637003 CET	34702	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:51.254672050 CET	34702	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:51.259483099 CET	3778	34702	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:51.259557009 CET	34702	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:51.264386892 CET	3778	34702	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:52.265347004 CET	3778	34702	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:52.265505075 CET	34702	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:52.265549898 CET	34702	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:52.265583992 CET	34704	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:52.270411968 CET	3778	34704	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:52.270545959 CET	34704	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:52.270580053 CET	34704	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:52.275427103 CET	3778	34704	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:52.275523901 CET	34704	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:52.280299902 CET	3778	34704	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:53.270194054 CET	3778	34704	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:53.270437002 CET	34704	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:53.270437002 CET	34704	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:53.270539999 CET	34706	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:53.275377989 CET	3778	34706	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:53.275496960 CET	34706	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:53.275532007 CET	34706	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:53.280320883 CET	3778	34706	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:53.280389071 CET	34706	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:53.285218954 CET	3778	34706	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:54.227751017 CET	3778	34706	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:54.228483915 CET	34706	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:54.228483915 CET	34706	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:54.228634119 CET	34708	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:54.233530045 CET	3778	34708	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:54.233619928 CET	34708	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:54.233619928 CET	34708	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:54.238450050 CET	3778	34708	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:54.238759041 CET	34708	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:54.243541002 CET	3778	34708	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:55.209588051 CET	3778	34708	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:55.209830999 CET	34708	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:55.209830999 CET	34708	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:55.209944963 CET	34710	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:55.214808941 CET	3778	34710	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:55.214975119 CET	34710	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:55.215046883 CET	34710	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:55.219903946 CET	3778	34710	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:55.220006943 CET	34710	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:55.224817991 CET	3778	34710	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:56.218156099 CET	3778	34710	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:56.218360901 CET	34710	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:56.218447924 CET	34712	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:56.218487978 CET	34710	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:56.223285913 CET	3778	34712	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:56.223352909 CET	34712	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:56.223392010 CET	34712	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:56.228198051 CET	3778	34712	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:56.228240013 CET	34712	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:56.233130932 CET	3778	34712	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:57.202461958 CET	3778	34712	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:57.202667952 CET	34712	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:57.202667952 CET	34712	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:57.202667952 CET	34714	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:57.207578897 CET	3778	34714	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:57.207627058 CET	34714	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:57.207643032 CET	34714	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:57.212404013 CET	3778	34714	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:57.212446928 CET	34714	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:57.217227936 CET	3778	34714	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:58.188302994 CET	3778	34714	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:58.188421965 CET	34714	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:58.188421965 CET	34714	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:58.188472033 CET	34716	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:58.193293095 CET	3778	34716	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:58.193353891 CET	34716	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:58.193396091 CET	34716	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:58.198144913 CET	3778	34716	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:58.198196888 CET	34716	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:58.202984095 CET	3778	34716	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:59.160537004 CET	3778	34716	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:59.160696983 CET	34716	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:59.160697937 CET	34716	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:59.160744905 CET	34718	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:59.165647030 CET	3778	34718	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:59.165766001 CET	34718	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:59.165807962 CET	34718	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:59.170614958 CET	3778	34718	61.7.209.115	192.168.2.23
Feb 17, 2025 17:13:59.170681000 CET	34718	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:13:59.175517082 CET	3778	34718	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:00.149957895 CET	3778	34718	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:00.150110960 CET	34718	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:00.150111914 CET	34718	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:00.150162935 CET	34720	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:00.155016899 CET	3778	34720	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:00.155158043 CET	34720	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:00.155205965 CET	34720	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:00.159982920 CET	3778	34720	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:00.160049915 CET	34720	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:00.164870024 CET	3778	34720	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:00.402756929 CET	43928	443	192.168.2.23	91.189.91.42
Feb 17, 2025 17:14:00.797991037 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:00.977302074 CET	3778	34700	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:01.132793903 CET	3778	34720	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:01.133063078 CET	34720	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:01.133137941 CET	34720	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:01.133137941 CET	34722	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:01.137976885 CET	3778	34722	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:01.138127089 CET	34722	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:01.138127089 CET	34722	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:01.143065929 CET	3778	34722	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:01.143177032 CET	34722	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:01.148072004 CET	3778	34722	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:01.339308023 CET	3778	34700	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:01.339571953 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:02.133816004 CET	3778	34722	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:02.134018898 CET	34722	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:02.134018898 CET	34722	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:02.134161949 CET	34724	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:02.139071941 CET	3778	34724	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:02.139173985 CET	34724	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:02.139199972 CET	34724	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:02.144001007 CET	3778	34724	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:02.144057989 CET	34724	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:02.148921967 CET	3778	34724	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:03.113099098 CET	3778	34724	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:03.113240957 CET	34724	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:03.113272905 CET	34724	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:03.113296986 CET	34726	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:03.118103981 CET	3778	34726	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:03.118176937 CET	34726	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:03.118216038 CET	34726	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:03.123002052 CET	3778	34726	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:03.123061895 CET	34726	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:03.127928972 CET	3778	34726	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:04.092511892 CET	3778	34726	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:04.092657089 CET	34726	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:04.092730045 CET	34726	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:04.092842102 CET	34728	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:04.097668886 CET	3778	34728	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:04.097732067 CET	34728	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:04.097790003 CET	34728	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:04.102529049 CET	3778	34728	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:04.102602959 CET	34728	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:04.107382059 CET	3778	34728	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:05.077779055 CET	3778	34728	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:05.077893972 CET	34728	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:05.077954054 CET	34728	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:05.077954054 CET	34730	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:05.082797050 CET	3778	34730	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:05.082907915 CET	34730	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:05.082962036 CET	34730	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:05.087762117 CET	3778	34730	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:05.087831974 CET	34730	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:05.092609882 CET	3778	34730	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:06.089607000 CET	3778	34730	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:06.089750051 CET	34730	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:06.089886904 CET	34730	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:06.089972019 CET	34732	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:06.094866037 CET	3778	34732	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:06.094969988 CET	34732	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:06.095016003 CET	34732	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:06.099854946 CET	3778	34732	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:06.099914074 CET	34732	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:06.104698896 CET	3778	34732	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:07.079760075 CET	3778	34732	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:07.079916000 CET	34732	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:07.079983950 CET	34732	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:07.080065012 CET	34734	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:07.084980965 CET	3778	34734	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:07.085045099 CET	34734	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:07.085170984 CET	34734	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:07.090111017 CET	3778	34734	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:07.090215921 CET	34734	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:07.095029116 CET	3778	34734	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:08.077342987 CET	3778	34734	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:08.077701092 CET	34734	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:08.077790022 CET	34734	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:08.077851057 CET	34736	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:08.082735062 CET	3778	34736	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:08.082864046 CET	34736	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:08.082911968 CET	34736	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:08.087807894 CET	3778	34736	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:08.087913036 CET	34736	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:08.092750072 CET	3778	34736	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:09.086862087 CET	3778	34736	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:09.087047100 CET	34736	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:09.087047100 CET	34736	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:09.087135077 CET	34738	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:09.092143059 CET	3778	34738	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:09.092272997 CET	34738	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:09.092418909 CET	34738	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:09.097167969 CET	3778	34738	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:09.097234964 CET	34738	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:09.102035999 CET	3778	34738	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:10.081710100 CET	3778	34738	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:10.081907034 CET	34738	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:10.081976891 CET	34738	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:10.082071066 CET	34740	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:10.086945057 CET	3778	34740	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:10.087049007 CET	34740	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:10.087104082 CET	34740	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:10.092000008 CET	3778	34740	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:10.092068911 CET	34740	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:10.096935034 CET	3778	34740	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:11.083717108 CET	3778	34740	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:11.083909035 CET	34740	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:11.083947897 CET	34740	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:11.084182024 CET	34742	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:11.089087009 CET	3778	34742	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:11.089215040 CET	34742	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:11.089287043 CET	34742	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:11.094161034 CET	3778	34742	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:11.094270945 CET	34742	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:11.099077940 CET	3778	34742	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:12.096162081 CET	3778	34742	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:12.096282005 CET	34742	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:12.096323967 CET	34742	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:12.096339941 CET	34744	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:12.101183891 CET	3778	34744	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:12.101236105 CET	34744	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:12.101262093 CET	34744	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:12.106003046 CET	3778	34744	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:12.106045008 CET	34744	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:12.110845089 CET	3778	34744	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:12.689078093 CET	42836	443	192.168.2.23	91.189.91.43
Feb 17, 2025 17:14:13.079402924 CET	3778	34744	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:13.079660892 CET	34744	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:13.079660892 CET	34744	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:13.079699993 CET	34746	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:13.085609913 CET	3778	34746	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:13.085717916 CET	34746	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:13.085809946 CET	34746	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:13.091572046 CET	3778	34746	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:13.091738939 CET	34746	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:13.098633051 CET	3778	34746	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:14.049443007 CET	3778	34746	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:14.049618959 CET	34748	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:14.049632072 CET	34746	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:14.049632072 CET	34746	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:14.054495096 CET	3778	34748	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:14.054543972 CET	34748	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:14.054569960 CET	34748	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:14.059601068 CET	3778	34748	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:14.059643984 CET	34748	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:14.064469099 CET	3778	34748	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:15.051454067 CET	3778	34748	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:15.051625967 CET	34748	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:15.051625967 CET	34748	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:15.051678896 CET	34750	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:15.056561947 CET	3778	34750	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:15.056612968 CET	34750	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:15.056641102 CET	34750	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:15.061431885 CET	3778	34750	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:15.061486959 CET	34750	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:15.066200018 CET	3778	34750	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:16.056699991 CET	3778	34750	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:16.056823015 CET	34750	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:16.056823015 CET	34750	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:16.056868076 CET	34752	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:16.061685085 CET	3778	34752	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:16.061794996 CET	34752	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:16.061820030 CET	34752	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:16.066574097 CET	3778	34752	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:16.066648960 CET	34752	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:16.071444988 CET	3778	34752	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:16.784589052 CET	42516	80	192.168.2.23	109.202.202.202
Feb 17, 2025 17:14:17.050031900 CET	3778	34752	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:17.050178051 CET	34752	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:17.050213099 CET	34752	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:17.050246954 CET	34754	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:17.055068970 CET	3778	34754	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:17.055125952 CET	34754	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:17.055167913 CET	34754	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:17.059961081 CET	3778	34754	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:17.060004950 CET	34754	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:17.064779997 CET	3778	34754	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:18.078660011 CET	3778	34754	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:18.078794003 CET	34754	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:18.078835011 CET	34754	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:18.079092979 CET	34756	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:18.083940983 CET	3778	34756	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:18.084086895 CET	34756	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:18.084088087 CET	34756	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:18.088876963 CET	3778	34756	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:18.089010000 CET	34756	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:18.093910933 CET	3778	34756	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:19.049170971 CET	3778	34756	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:19.049329042 CET	34756	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:19.049520969 CET	34756	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:19.049627066 CET	34758	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:19.054405928 CET	3778	34758	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:19.054507971 CET	34758	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:19.054553986 CET	34758	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:19.059303999 CET	3778	34758	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:19.059369087 CET	34758	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:19.064150095 CET	3778	34758	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:20.085625887 CET	3778	34758	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:20.085840940 CET	34758	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:20.085979939 CET	34758	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:20.086062908 CET	34760	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:20.090835094 CET	3778	34760	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:20.090929985 CET	34760	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:20.090992928 CET	34760	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:20.095803022 CET	3778	34760	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:20.095876932 CET	34760	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:20.100616932 CET	3778	34760	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:21.079336882 CET	3778	34760	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:21.079479933 CET	34760	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:21.079560041 CET	34760	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:21.079642057 CET	34762	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:21.084511042 CET	3778	34762	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:21.084578991 CET	34762	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:21.084649086 CET	34762	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:21.089441061 CET	3778	34762	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:21.089529037 CET	34762	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:21.094412088 CET	3778	34762	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:22.087167978 CET	3778	34762	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:22.087367058 CET	34762	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:22.087367058 CET	34762	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:22.087428093 CET	34764	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:22.092621088 CET	3778	34764	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:22.092684031 CET	34764	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:22.092701912 CET	34764	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:22.097929001 CET	3778	34764	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:22.098004103 CET	34764	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:22.102988005 CET	3778	34764	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:23.086215019 CET	3778	34764	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:23.086409092 CET	34764	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:23.086410046 CET	34764	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:23.086509943 CET	34766	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:23.091334105 CET	3778	34766	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:23.091449022 CET	34766	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:23.091449976 CET	34766	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:23.096358061 CET	3778	34766	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:23.096492052 CET	34766	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:23.101300955 CET	3778	34766	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:24.079032898 CET	3778	34766	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:24.079200983 CET	34766	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:24.079243898 CET	34766	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:24.079353094 CET	34768	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:24.084281921 CET	3778	34768	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:24.084407091 CET	34768	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:24.084476948 CET	34768	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:24.089251041 CET	3778	34768	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:24.089334011 CET	34768	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:24.094207048 CET	3778	34768	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:25.057317019 CET	3778	34768	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:25.057560921 CET	34768	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:25.057594061 CET	34768	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:25.057619095 CET	34770	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:25.062514067 CET	3778	34770	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:25.062597990 CET	34770	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:25.062669992 CET	34770	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:25.067480087 CET	3778	34770	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:25.067543983 CET	34770	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:25.072314024 CET	3778	34770	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:26.080553055 CET	3778	34770	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:26.080681086 CET	34770	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:26.080725908 CET	34770	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:26.080761909 CET	34772	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:26.086838007 CET	3778	34772	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:26.086910009 CET	34772	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:26.086955070 CET	34772	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:26.092761040 CET	3778	34772	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:26.092861891 CET	34772	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:26.098324060 CET	3778	34772	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:27.051539898 CET	3778	34772	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:27.051879883 CET	34772	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:27.051879883 CET	34772	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:27.051879883 CET	34774	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:27.056818962 CET	3778	34774	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:27.056924105 CET	34774	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:27.056979895 CET	34774	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:27.061880112 CET	3778	34774	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:27.061963081 CET	34774	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:27.066757917 CET	3778	34774	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:28.046094894 CET	3778	34774	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:28.046211958 CET	34774	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:28.046257019 CET	34774	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:28.046271086 CET	34776	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:28.051115990 CET	3778	34776	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:28.051181078 CET	34776	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:28.051255941 CET	34776	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:28.056005955 CET	3778	34776	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:28.056041002 CET	34776	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:28.060769081 CET	3778	34776	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:29.038944960 CET	3778	34776	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:29.039103985 CET	34776	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:29.039174080 CET	34776	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:29.039267063 CET	34778	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:29.044116020 CET	3778	34778	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:29.044214010 CET	34778	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:29.044270039 CET	34778	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:29.049012899 CET	3778	34778	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:29.049102068 CET	34778	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:29.054071903 CET	3778	34778	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:30.050898075 CET	3778	34778	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:30.051044941 CET	34778	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:30.051079035 CET	34778	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:30.051143885 CET	34780	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:30.055960894 CET	3778	34780	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:30.056044102 CET	34780	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:30.056092978 CET	34780	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:30.060866117 CET	3778	34780	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:30.060929060 CET	34780	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:30.065711975 CET	3778	34780	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:31.051069021 CET	3778	34780	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:31.051211119 CET	34780	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:31.051248074 CET	34780	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:31.051309109 CET	34782	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:31.056130886 CET	3778	34782	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:31.056221962 CET	34782	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:31.056252003 CET	34782	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:31.061110973 CET	3778	34782	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:31.061197996 CET	34782	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:31.065994024 CET	3778	34782	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:32.054970980 CET	3778	34782	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:32.055285931 CET	34782	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:32.055341959 CET	34782	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:32.055427074 CET	34784	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:32.060339928 CET	3778	34784	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:32.060429096 CET	34784	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:32.060482979 CET	34784	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:32.065249920 CET	3778	34784	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:32.065310955 CET	34784	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:32.070147038 CET	3778	34784	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:33.035501957 CET	3778	34784	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:33.035732985 CET	34784	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:33.035829067 CET	34784	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:33.035870075 CET	34786	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:33.040698051 CET	3778	34786	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:33.040783882 CET	34786	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:33.040818930 CET	34786	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:33.045625925 CET	3778	34786	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:33.045691013 CET	34786	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:33.050544977 CET	3778	34786	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:34.019958019 CET	3778	34786	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:34.020198107 CET	34786	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:34.020230055 CET	34786	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:34.020275116 CET	34788	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:34.025111914 CET	3778	34788	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:34.025199890 CET	34788	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:34.025223017 CET	34788	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:34.030049086 CET	3778	34788	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:34.030123949 CET	34788	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:34.034931898 CET	3778	34788	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:35.016019106 CET	3778	34788	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:35.016199112 CET	34788	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:35.016242981 CET	34788	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:35.016242981 CET	34790	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:35.021096945 CET	3778	34790	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:35.021190882 CET	34790	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:35.021884918 CET	34790	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:35.026861906 CET	3778	34790	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:35.026952982 CET	34790	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:35.031845093 CET	3778	34790	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.019830942 CET	3778	34790	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.020071030 CET	34790	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.020071030 CET	34790	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.020124912 CET	34792	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.024983883 CET	3778	34792	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.025058985 CET	34792	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.025131941 CET	34792	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.029911041 CET	3778	34792	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.029963017 CET	34792	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.034703970 CET	3778	34792	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.986779928 CET	3778	34792	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.987035990 CET	34792	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.987092972 CET	34792	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.987157106 CET	34794	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.992171049 CET	3778	34794	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.992279053 CET	34794	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.992316961 CET	34794	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:36.997071981 CET	3778	34794	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:36.997131109 CET	34794	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:37.002441883 CET	3778	34794	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:37.975370884 CET	3778	34794	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:37.975531101 CET	34794	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:37.975555897 CET	34794	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:37.975603104 CET	34796	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:37.980474949 CET	3778	34796	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:37.980556965 CET	34796	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:37.980581045 CET	34796	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:37.985377073 CET	3778	34796	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:37.985434055 CET	34796	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:37.990204096 CET	3778	34796	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:38.988380909 CET	3778	34796	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:38.988533020 CET	34796	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:38.988724947 CET	34796	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:38.988825083 CET	34798	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:38.993638039 CET	3778	34798	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:38.993710995 CET	34798	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:38.993767977 CET	34798	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:38.998529911 CET	3778	34798	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:38.998600006 CET	34798	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:39.003448009 CET	3778	34798	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:40.076694012 CET	3778	34798	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:40.076849937 CET	34798	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:40.077023983 CET	34798	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:40.077109098 CET	34800	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:40.085457087 CET	3778	34800	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:40.085558891 CET	34800	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:40.085623026 CET	34800	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:40.090373039 CET	3778	34800	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:40.090467930 CET	34800	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:40.095287085 CET	3778	34800	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:41.086829901 CET	3778	34800	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:41.087166071 CET	34800	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:41.087284088 CET	34800	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:41.087366104 CET	34802	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:41.092124939 CET	3778	34802	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:41.092209101 CET	34802	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:41.092277050 CET	34802	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:41.097054005 CET	3778	34802	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:41.097112894 CET	34802	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:41.101910114 CET	3778	34802	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:41.357148886 CET	43928	443	192.168.2.23	91.189.91.42
Feb 17, 2025 17:14:42.084662914 CET	3778	34802	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:42.084983110 CET	34802	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:42.085061073 CET	34802	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:42.085150957 CET	34804	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:42.090572119 CET	3778	34804	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:42.090642929 CET	34804	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:42.090718031 CET	34804	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:42.096215963 CET	3778	34804	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:42.096290112 CET	34804	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:42.101216078 CET	3778	34804	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:43.098097086 CET	3778	34804	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:43.098215103 CET	34804	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:43.098258018 CET	34804	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:43.098325968 CET	34806	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:43.104630947 CET	3778	34806	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:43.104702950 CET	34806	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:43.104731083 CET	34806	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:43.109472990 CET	3778	34806	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:43.109560013 CET	34806	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:43.116019011 CET	3778	34806	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:44.100099087 CET	3778	34806	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:44.100330114 CET	34806	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:44.100330114 CET	34806	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:44.100374937 CET	34808	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:44.105226040 CET	3778	34808	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:44.105325937 CET	34808	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:44.105397940 CET	34808	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:44.110183001 CET	3778	34808	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:44.110249996 CET	34808	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:44.115084887 CET	3778	34808	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:45.085561037 CET	3778	34808	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:45.085736990 CET	34808	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:45.085808039 CET	34808	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:45.085895061 CET	34810	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:45.090797901 CET	3778	34810	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:45.090909958 CET	34810	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:45.090981007 CET	34810	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:45.095802069 CET	3778	34810	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:45.095870972 CET	34810	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:45.100667953 CET	3778	34810	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:46.082865953 CET	3778	34810	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:46.083256960 CET	34812	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:46.083275080 CET	34810	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:46.083276033 CET	34810	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:46.089349031 CET	3778	34812	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:46.089407921 CET	34812	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:46.089443922 CET	34812	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:46.094377995 CET	3778	34812	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:46.094434023 CET	34812	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:46.102380037 CET	3778	34812	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:47.056731939 CET	3778	34812	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:47.057234049 CET	34812	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:47.057277918 CET	34812	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:47.057353973 CET	34814	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:47.063769102 CET	3778	34814	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:47.063885927 CET	34814	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:47.063934088 CET	34814	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:47.070333958 CET	3778	34814	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:47.070396900 CET	34814	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:47.076447010 CET	3778	34814	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:48.082257032 CET	3778	34814	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:48.082480907 CET	34814	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:48.082480907 CET	34814	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:48.082489967 CET	34816	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:48.087433100 CET	3778	34816	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:48.087496996 CET	34816	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:48.087553024 CET	34816	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:48.092367887 CET	3778	34816	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:48.092430115 CET	34816	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:48.097244978 CET	3778	34816	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:49.085057020 CET	3778	34816	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:49.085218906 CET	34816	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:49.085218906 CET	34816	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:49.085268021 CET	34818	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:49.090286016 CET	3778	34818	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:49.090356112 CET	34818	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:49.090389967 CET	34818	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:49.095295906 CET	3778	34818	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:49.095354080 CET	34818	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:49.100238085 CET	3778	34818	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:50.082901001 CET	3778	34818	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:50.083106041 CET	34818	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:50.083153963 CET	34818	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:50.083178043 CET	34820	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:50.090176105 CET	3778	34820	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:50.090274096 CET	34820	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:50.090301991 CET	34820	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:50.098948956 CET	3778	34820	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:50.099006891 CET	34820	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:50.105426073 CET	3778	34820	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:51.089103937 CET	3778	34820	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:51.089447021 CET	34820	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:51.089548111 CET	34820	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:51.089548111 CET	34822	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:51.094373941 CET	3778	34822	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:51.094496012 CET	34822	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:51.094556093 CET	34822	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:51.099325895 CET	3778	34822	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:51.099401951 CET	34822	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:51.104144096 CET	3778	34822	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:52.054555893 CET	3778	34822	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:52.054697990 CET	34822	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:52.054869890 CET	34822	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:52.054953098 CET	34824	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:52.061526060 CET	3778	34824	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:52.061589003 CET	34824	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:52.061651945 CET	34824	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:52.066446066 CET	3778	34824	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:52.066498995 CET	34824	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:52.071343899 CET	3778	34824	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:53.083941936 CET	3778	34824	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:53.084300995 CET	34824	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:53.084331036 CET	34824	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:53.084373951 CET	34826	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:53.089237928 CET	3778	34826	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:53.089370966 CET	34826	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:53.089405060 CET	34826	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:53.094222069 CET	3778	34826	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:53.094297886 CET	34826	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:53.099107027 CET	3778	34826	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:54.126853943 CET	3778	34826	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:54.127268076 CET	34826	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:54.127268076 CET	34826	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:54.127330065 CET	34828	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:54.133089066 CET	3778	34828	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:54.133189917 CET	34828	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:54.133331060 CET	34828	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:54.138097048 CET	3778	34828	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:54.138170004 CET	34828	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:54.142932892 CET	3778	34828	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:55.129018068 CET	3778	34828	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:55.129131079 CET	34828	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:55.129131079 CET	34828	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:55.129172087 CET	34830	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:55.136375904 CET	3778	34830	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:55.136487961 CET	34830	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:55.136487961 CET	34830	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:55.142463923 CET	3778	34830	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:55.142509937 CET	34830	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:55.150286913 CET	3778	34830	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:56.132540941 CET	3778	34830	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:56.132838964 CET	34830	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:56.132872105 CET	34830	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:56.132910967 CET	34832	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:56.137706041 CET	3778	34832	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:56.137820959 CET	34832	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:56.137821913 CET	34832	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:56.142676115 CET	3778	34832	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:56.142740965 CET	34832	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:56.147577047 CET	3778	34832	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:57.125972986 CET	3778	34832	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:57.126269102 CET	34832	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:57.126312971 CET	34832	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:57.126363039 CET	34834	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:57.131181002 CET	3778	34834	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:57.131282091 CET	34834	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:57.131392956 CET	34834	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:57.136133909 CET	3778	34834	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:57.136204958 CET	34834	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:57.141041040 CET	3778	34834	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:58.125585079 CET	3778	34834	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:58.125734091 CET	34834	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:58.125777960 CET	34834	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:58.125844002 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:58.130780935 CET	3778	34836	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:58.130855083 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:58.130914927 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:58.137531996 CET	3778	34836	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:58.137583971 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:58.143822908 CET	3778	34836	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:59.863806009 CET	3778	34836	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:59.863851070 CET	3778	34836	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:59.863873959 CET	3778	34836	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:59.863989115 CET	3778	34836	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:59.864092112 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.864151001 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.864173889 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.864212990 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.864273071 CET	34836	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.864273071 CET	34838	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.869404078 CET	3778	34838	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:59.869498968 CET	34838	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.869534016 CET	34838	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.874779940 CET	3778	34838	61.7.209.115	192.168.2.23
Feb 17, 2025 17:14:59.874859095 CET	34838	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:14:59.879652977 CET	3778	34838	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:00.846225023 CET	3778	34838	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:00.846462965 CET	34838	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:00.846462965 CET	34838	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:00.846508980 CET	34840	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:00.851577997 CET	3778	34840	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:00.851691961 CET	34840	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:00.851728916 CET	34840	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:00.856528044 CET	3778	34840	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:00.856693029 CET	34840	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:00.861942053 CET	3778	34840	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:01.380346060 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.385371923 CET	3778	34700	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:01.869843006 CET	3778	34700	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:01.870023966 CET	34700	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.870923042 CET	3778	34840	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:01.871012926 CET	34840	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.871057034 CET	34840	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.871114969 CET	34842	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.879946947 CET	3778	34842	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:01.880055904 CET	34842	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.880103111 CET	34842	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.884934902 CET	3778	34842	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:01.885010958 CET	34842	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:01.890055895 CET	3778	34842	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:02.846932888 CET	3778	34842	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:02.847275972 CET	34842	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:02.847275972 CET	34842	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:02.847290039 CET	34844	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:02.852109909 CET	3778	34844	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:02.852209091 CET	34844	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:02.852253914 CET	34844	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:02.857001066 CET	3778	34844	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:02.857074976 CET	34844	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:02.861912966 CET	3778	34844	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:03.834966898 CET	3778	34844	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:03.835186958 CET	34844	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:03.835187912 CET	34844	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:03.835237026 CET	34846	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:03.840032101 CET	3778	34846	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:03.840123892 CET	34846	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:03.840145111 CET	34846	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:03.844922066 CET	3778	34846	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:03.844968081 CET	34846	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:03.849786043 CET	3778	34846	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:04.822889090 CET	3778	34846	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:04.823154926 CET	34846	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:04.823203087 CET	34846	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:04.823297024 CET	34848	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:04.829112053 CET	3778	34848	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:04.829216003 CET	34848	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:04.829262972 CET	34848	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:04.833997011 CET	3778	34848	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:04.834075928 CET	34848	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:04.838869095 CET	3778	34848	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:05.822586060 CET	3778	34848	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:05.822915077 CET	34848	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:05.822947979 CET	34848	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:05.823024988 CET	34850	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:05.829741955 CET	3778	34850	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:05.829858065 CET	34850	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:05.829904079 CET	34850	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:05.836668968 CET	3778	34850	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:05.836750984 CET	34850	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:05.844929934 CET	3778	34850	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:06.803769112 CET	3778	34850	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:06.804060936 CET	34850	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:06.804107904 CET	34850	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:06.804193974 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:06.808989048 CET	3778	34852	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:06.809076071 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:06.809135914 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:06.813941956 CET	3778	34852	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:06.814008951 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:06.818749905 CET	3778	34852	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:08.175002098 CET	3778	34852	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:08.175110102 CET	3778	34852	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:08.175137043 CET	3778	34852	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:08.175139904 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.175188065 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.175188065 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.175189018 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.175276041 CET	34854	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.175415039 CET	3778	34852	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:08.175460100 CET	34852	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.180643082 CET	3778	34854	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:08.180702925 CET	34854	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.180763960 CET	34854	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.185519934 CET	3778	34854	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:08.185578108 CET	34854	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:08.190361023 CET	3778	34854	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:09.184340954 CET	3778	34854	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:09.184500933 CET	34854	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:09.184592962 CET	34854	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:09.184658051 CET	34856	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:09.189861059 CET	3778	34856	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:09.189934969 CET	34856	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:09.189984083 CET	34856	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:09.195070982 CET	3778	34856	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:09.195125103 CET	34856	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:09.199907064 CET	3778	34856	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:10.194691896 CET	3778	34856	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:10.194972038 CET	34856	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:10.195064068 CET	34856	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:10.195064068 CET	34858	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:10.199873924 CET	3778	34858	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:10.199973106 CET	34858	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:10.200030088 CET	34858	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:10.205163956 CET	3778	34858	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:10.205236912 CET	34858	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:10.210134983 CET	3778	34858	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:11.210530996 CET	3778	34858	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:11.210846901 CET	34858	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:11.210848093 CET	34858	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:11.210855961 CET	34860	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:11.215747118 CET	3778	34860	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:11.215836048 CET	34860	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:11.215857983 CET	34860	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:11.220640898 CET	3778	34860	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:11.220709085 CET	34860	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:11.227595091 CET	3778	34860	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:12.211911917 CET	3778	34860	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:12.212070942 CET	34860	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:12.212129116 CET	34860	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:12.212182045 CET	34862	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:12.216974974 CET	3778	34862	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:12.217042923 CET	34862	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:12.217094898 CET	34862	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:12.221976042 CET	3778	34862	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:12.222028017 CET	34862	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:12.226778984 CET	3778	34862	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:13.206943989 CET	3778	34862	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:13.207160950 CET	34862	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:13.207210064 CET	34862	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:13.207216978 CET	34864	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:13.215282917 CET	3778	34864	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:13.215369940 CET	34864	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:13.215415955 CET	34864	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:13.222992897 CET	3778	34864	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:13.223062038 CET	34864	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:13.230710030 CET	3778	34864	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:14.210072041 CET	3778	34864	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:14.210230112 CET	34864	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:14.210273027 CET	34864	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:14.210283995 CET	34866	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:14.215097904 CET	3778	34866	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:14.215198040 CET	34866	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:14.215223074 CET	34866	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:14.220024109 CET	3778	34866	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:14.220088959 CET	34866	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:14.224967957 CET	3778	34866	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:15.179034948 CET	3778	34866	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:15.179215908 CET	34866	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:15.179265022 CET	34866	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:15.179326057 CET	34868	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:15.185189009 CET	3778	34868	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:15.185307980 CET	34868	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:15.185347080 CET	34868	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:15.190499067 CET	3778	34868	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:15.190563917 CET	34868	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:15.196078062 CET	3778	34868	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:16.168898106 CET	3778	34868	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:16.169115067 CET	34868	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:16.169162035 CET	34868	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:16.169198990 CET	34870	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:16.174211025 CET	3778	34870	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:16.174314976 CET	34870	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:16.174350023 CET	34870	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:16.179198980 CET	3778	34870	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:16.179341078 CET	34870	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:16.184169054 CET	3778	34870	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:17.179207087 CET	3778	34870	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:17.179621935 CET	34872	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:17.179630041 CET	34870	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:17.179630041 CET	34870	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:17.184520006 CET	3778	34872	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:17.184618950 CET	34872	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:17.184676886 CET	34872	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:17.189424992 CET	3778	34872	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:17.189492941 CET	34872	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:17.194338083 CET	3778	34872	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:18.166420937 CET	3778	34872	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:18.166832924 CET	34872	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:18.166832924 CET	34872	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:18.166906118 CET	34874	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:18.171709061 CET	3778	34874	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:18.171777010 CET	34874	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:18.171821117 CET	34874	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:18.176641941 CET	3778	34874	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:18.176721096 CET	34874	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:18.181591034 CET	3778	34874	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:19.155369997 CET	3778	34874	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:19.155585051 CET	34874	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:19.155791044 CET	34874	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:19.155832052 CET	34876	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:19.160712957 CET	3778	34876	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:19.160809994 CET	34876	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:19.160868883 CET	34876	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:19.165699005 CET	3778	34876	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:19.165766954 CET	34876	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:19.170598984 CET	3778	34876	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:20.151443005 CET	3778	34876	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:20.151583910 CET	34876	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:20.151678085 CET	34876	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:20.151753902 CET	34878	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:20.156558037 CET	3778	34878	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:20.156646013 CET	34878	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:20.156698942 CET	34878	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:20.161422014 CET	3778	34878	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:20.161483049 CET	34878	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:20.166318893 CET	3778	34878	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:21.127904892 CET	3778	34878	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:21.128145933 CET	34878	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:21.128201008 CET	34878	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:21.128288031 CET	34880	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:21.133104086 CET	3778	34880	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:21.133193016 CET	34880	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:21.133240938 CET	34880	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:21.138180971 CET	3778	34880	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:21.138247013 CET	34880	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:21.143122911 CET	3778	34880	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:22.167696953 CET	3778	34880	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:22.167947054 CET	34880	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:22.167947054 CET	34880	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:22.168006897 CET	34882	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:22.173060894 CET	3778	34882	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:22.173252106 CET	34882	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:22.173305035 CET	34882	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:22.178221941 CET	3778	34882	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:22.178306103 CET	34882	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:22.183135986 CET	3778	34882	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:23.162758112 CET	3778	34882	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:23.163049936 CET	34882	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:23.163110971 CET	34882	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:23.163122892 CET	34884	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:23.167929888 CET	3778	34884	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:23.168020964 CET	34884	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:23.168060064 CET	34884	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:23.172868967 CET	3778	34884	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:23.172940969 CET	34884	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:23.177707911 CET	3778	34884	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:24.276942968 CET	3778	34884	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:24.277127981 CET	34884	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:24.277188063 CET	34884	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:24.277272940 CET	34886	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:24.282109976 CET	3778	34886	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:24.283058882 CET	34886	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:24.283189058 CET	34886	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:24.287967920 CET	3778	34886	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:24.288064003 CET	34886	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:24.292881012 CET	3778	34886	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:25.258380890 CET	3778	34886	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:25.258496046 CET	34886	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:25.258527994 CET	34886	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:25.258615017 CET	34888	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:25.263459921 CET	3778	34888	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:25.263555050 CET	34888	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:25.263555050 CET	34888	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:25.268403053 CET	3778	34888	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:25.268455982 CET	34888	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:25.273346901 CET	3778	34888	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:26.234230042 CET	3778	34888	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:26.234469891 CET	34888	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:26.234517097 CET	34888	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:26.234595060 CET	34890	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:26.239360094 CET	3778	34890	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:26.239425898 CET	34890	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:26.239483118 CET	34890	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:26.244261026 CET	3778	34890	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:26.244340897 CET	34890	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:26.249136925 CET	3778	34890	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:27.225780010 CET	3778	34890	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:27.226049900 CET	34890	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:27.226149082 CET	34890	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:27.226195097 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:27.231054068 CET	3778	34892	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:27.231152058 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:27.231205940 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:27.235971928 CET	3778	34892	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:27.236054897 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:27.240859985 CET	3778	34892	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:28.440519094 CET	3778	34892	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:28.440738916 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.440783024 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.440793991 CET	34894	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.441555977 CET	3778	34892	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:28.441638947 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.441823006 CET	3778	34892	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:28.441901922 CET	34892	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.445745945 CET	3778	34894	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:28.445835114 CET	34894	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.445851088 CET	34894	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.450618029 CET	3778	34894	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:28.450685978 CET	34894	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:28.455423117 CET	3778	34894	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:29.441610098 CET	3778	34894	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:29.441915035 CET	34894	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:29.441915035 CET	34894	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:29.441958904 CET	34896	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:29.447074890 CET	3778	34896	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:29.447160006 CET	34896	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:29.447204113 CET	34896	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:29.451944113 CET	3778	34896	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:29.452020884 CET	34896	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:29.456823111 CET	3778	34896	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:30.438596964 CET	3778	34896	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:30.438760996 CET	34896	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:30.438874960 CET	34896	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:30.438874960 CET	34898	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:30.443809032 CET	3778	34898	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:30.443912029 CET	34898	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:30.443948030 CET	34898	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:30.448718071 CET	3778	34898	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:30.448779106 CET	34898	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:30.453569889 CET	3778	34898	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:31.444442987 CET	3778	34898	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:31.444768906 CET	34898	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:31.444770098 CET	34898	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:31.444822073 CET	34900	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:31.451488018 CET	3778	34900	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:31.451611996 CET	34900	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:31.451656103 CET	34900	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:31.458553076 CET	3778	34900	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:31.458621979 CET	34900	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:31.463401079 CET	3778	34900	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:32.437402964 CET	3778	34900	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:32.437613964 CET	34900	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:32.437707901 CET	34900	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:32.437707901 CET	34902	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:32.442765951 CET	3778	34902	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:32.442866087 CET	34902	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:32.442917109 CET	34902	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:32.447798967 CET	3778	34902	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:32.447870970 CET	34902	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:32.452811956 CET	3778	34902	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:33.435022116 CET	3778	34902	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:33.435221910 CET	34902	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:33.435293913 CET	34902	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:33.435292006 CET	34904	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:33.440367937 CET	3778	34904	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:33.440462112 CET	34904	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:33.440524101 CET	34904	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:33.445311069 CET	3778	34904	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:33.445379019 CET	34904	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:33.450226068 CET	3778	34904	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:34.453475952 CET	3778	34904	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:34.453799009 CET	34904	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:34.453857899 CET	34904	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:34.453911066 CET	34906	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:34.458743095 CET	3778	34906	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:34.458894968 CET	34906	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:34.458947897 CET	34906	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:34.463747025 CET	3778	34906	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:34.463825941 CET	34906	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:34.468640089 CET	3778	34906	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:35.438199997 CET	3778	34906	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:35.438420057 CET	34906	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:35.438457012 CET	34906	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:35.438503027 CET	34908	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:35.443666935 CET	3778	34908	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:35.443779945 CET	34908	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:35.443826914 CET	34908	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:35.448760033 CET	3778	34908	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:35.448838949 CET	34908	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:35.453880072 CET	3778	34908	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:36.443973064 CET	3778	34908	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:36.444277048 CET	34908	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:36.444329977 CET	34908	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:36.444346905 CET	34910	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:36.449444056 CET	3778	34910	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:36.449615002 CET	34910	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:36.449664116 CET	34910	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:36.454571962 CET	3778	34910	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:36.454657078 CET	34910	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:36.460474014 CET	3778	34910	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:37.451956034 CET	3778	34910	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:37.452259064 CET	34910	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:37.452373028 CET	34910	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:37.452366114 CET	34912	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:37.457310915 CET	3778	34912	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:37.457467079 CET	34912	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:37.457506895 CET	34912	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:37.462389946 CET	3778	34912	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:37.462466002 CET	34912	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:37.467363119 CET	3778	34912	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:47.466320038 CET	34912	3778	192.168.2.23	61.7.209.115
Feb 17, 2025 17:15:47.471383095 CET	3778	34912	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:47.824805975 CET	3778	34912	61.7.209.115	192.168.2.23
Feb 17, 2025 17:15:47.825186968 CET	34912	3778	192.168.2.23	61.7.209.115

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6238, Parent PID: 6160

General

Start time (UTC):	16:13:39
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
File size:	38732 bytes
MD5 hash:	6d4875d3f1faf8581f71a0e743585054

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6239, Parent PID: 6238

General

Start time (UTC):	16:13:39
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38732 bytes
MD5 hash:	6d4875d3f1faf8581f71a0e743585054

Process Activities

Process Forked

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, Parent PID: 6239

General

Start time (UTC):	16:13:39
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38732 bytes
MD5 hash:	6d4875d3f1faf8581f71a0e743585054

File Activities

File Opened

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6241, Parent PID: 6239

General

Start time (UTC):	16:13:39
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38732 bytes
MD5 hash:	6d4875d3f1faf8581f71a0e743585054

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6244, Parent PID: 6238

General

Start time (UTC):	16:13:45
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38732 bytes
MD5 hash:	6d4875d3f1faf8581f71a0e743585054

File Activities

File Opened

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6245, Parent PID: 6238

General

Start time (UTC):	16:13:45
Start date (UTC):	17/02/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.x86.elf
Arguments:	-
File size:	38732 bytes
MD5 hash:	6d4875d3f1faf8581f71a0e743585054

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6238, Parent PID: 6160

General

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6239, Parent PID: 6238

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6240, Parent PID: 6239

General

File Activities

File Opened

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6241, Parent PID: 6239

General

Analysis Process: ub8ehJSePAfc9FYqZIT6.x86.elf PID: 6244, Parent PID: 6238

General

File Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.x86.elf