Edit tour

Linux Analysis Report
wind.m68k.elf

Overview

General Information

Sample name:	wind.m68k.elf
Analysis ID:	1586979
MD5:	ff13644127fe6c566ef31ac2d9644a0f
SHA1:	fb6cc4d4df031034b37517f380d8779f666832f8
SHA256:	6e13983e6373c409b04053c166bde638a0343b13a72ec55807d57fcd489159b7
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586979
Start date and time:	2025-01-09 20:22:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wind.m68k.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: wind.m68k.elf

Runtime Messages

Command:	/tmp/wind.m68k.elf
PID:	5526
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

wind.m68k.elf (PID: 5526, Parent: 5448, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/wind.m68k.elf

wind.m68k.elf New Fork (PID: 5528, Parent: 5526)

wind.m68k.elf New Fork (PID: 5529, Parent: 5526)

wind.m68k.elf New Fork (PID: 5531, Parent: 5526)

xfce4-panel New Fork (PID: 5542, Parent: 3235)

wrapper-2.0 (PID: 5542, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5545, Parent: 3235)

wrapper-2.0 (PID: 5545, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5546, Parent: 3235)

wrapper-2.0 (PID: 5546, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5549, Parent: 3235)

wrapper-2.0 (PID: 5549, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5568, Parent: 5549)

xfpm-power-backlight-helper (PID: 5568, Parent: 5549, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5550, Parent: 3235)

wrapper-2.0 (PID: 5550, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5551, Parent: 3235)

wrapper-2.0 (PID: 5551, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5567, Parent: 5566)

xfconfd (PID: 5567, Parent: 5566, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5577, Parent: 3044)

xfce4-notifyd (PID: 5577, Parent: 3044, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wind.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wind.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe60f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe623:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe637:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe64b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe673:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe687:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe69b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe713:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe727:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe73b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe763:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe777:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe78b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
wind.m68k.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeb60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5526.1.00007fda78001000.00007fda78011000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5526.1.00007fda78001000.00007fda78011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe60f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe623:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe637:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe64b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe673:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe687:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe69b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe713:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe727:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe73b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe763:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe777:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe78b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5526.1.00007fda78001000.00007fda78011000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeb60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5529.1.00007fda78001000.00007fda78011000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5529.1.00007fda78001000.00007fda78011000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe60f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe623:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe637:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe64b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe65f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe673:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe687:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe69b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe713:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe727:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe73b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe74f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe763:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe777:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe78b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe79f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5529.1.00007fda78001000.00007fda78011000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeb60:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: wind.m68k.elf PID: 5526	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: wind.m68k.elf PID: 5526	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wind.m68k.elf PID: 5526	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x334b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x335f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3373:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3387:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x339b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3413:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3427:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x343b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x344f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3463:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3477:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x348b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x349f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wind.m68k.elf PID: 5526	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3c48:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: wind.m68k.elf PID: 5529	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: wind.m68k.elf PID: 5529	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wind.m68k.elf PID: 5529	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wind.m68k.elf PID: 5529	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x148d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wind.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: wind.m68k.elf

ReversingLabs: Detection: 65%

Source: global traffic

TCP traffic: 192.168.2.15:53486 -> 154.216.19.169:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.19.169

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5526.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5526.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5529.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5529.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wind.m68k.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wind.m68k.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: wind.m68k.elf PID: 5529, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wind.m68k.elf PID: 5529, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3298, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5542, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5546, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5549, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5577, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3192, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3249, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3250, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3251, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3252, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3253, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3255, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3272, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3274, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 3298, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5542, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5546, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5549, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5567, result: successful	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	SIGKILL sent: pid: 5577, result: successful	Jump to behavior

Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: wind.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5526.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5526.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5529.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5529.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wind.m68k.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wind.m68k.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: wind.m68k.elf PID: 5529, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wind.m68k.elf PID: 5529, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@2/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5542)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5545)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5546)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5549)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5551)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5567)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5567)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5567)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5567)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5542/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1185/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3241/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3483/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1732/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1730/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3234/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/515/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1617/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1615/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5550/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5551/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3255/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3253/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3252/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3251/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3250/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3803/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3249/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/764/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3368/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3488/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/766/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5545/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5666/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1509/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5546/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3800/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5549/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3801/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1867/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3802/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1514/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1634/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3379/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/779/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3275/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3274/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3273/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3394/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3272/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/782/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1762/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3027/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5567/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5580/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5581/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5582/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5583/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5584/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5585/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5586/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/5587/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1660/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/794/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3316/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/796/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/675/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/676/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1498/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1497/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/1496/cmdline	Jump to behavior
Source: /tmp/wind.m68k.elf (PID: 5528)	File opened: /proc/3157/cmdline	Jump to behavior

Source: /tmp/wind.m68k.elf (PID: 5526)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5542)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5545)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5546)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5549)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5550)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5577)	Queries kernel information via 'uname':	Jump to behavior

Source: wind.m68k.elf, 5526.1.00007ffebf4da000.00007ffebf4fb000.rw-.sdmp, wind.m68k.elf, 5529.1.00007ffebf4da000.00007ffebf4fb000.rw-.sdmp	Binary or memory string: L+M%HVx86_64/usr/bin/qemu-m68k/tmp/wind.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wind.m68k.elf
Source: wind.m68k.elf, 5526.1.00007ffebf4da000.00007ffebf4fb000.rw-.sdmp, wind.m68k.elf, 5529.1.00007ffebf4da000.00007ffebf4fb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: wind.m68k.elf, 5526.1.0000563be68a0000.0000563be6925000.rw-.sdmp, wind.m68k.elf, 5529.1.0000563be68a0000.0000563be6925000.rw-.sdmp	Binary or memory string: ;V!/etc/qemu-binfmt/m68k
Source: wind.m68k.elf, 5526.1.0000563be68a0000.0000563be6925000.rw-.sdmp, wind.m68k.elf, 5529.1.0000563be68a0000.0000563be6925000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: wind.m68k.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wind.m68k.elf PID: 5529, type: MEMORYSTR
Source: Yara match	File source: wind.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5526.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5529.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: wind.m68k.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wind.m68k.elf PID: 5529, type: MEMORYSTR
Source: Yara match	File source: wind.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5526.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5529.1.00007fda78001000.00007fda78011000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wind.m68k.elf	66%	ReversingLabs	Linux.Trojan.Mirai
wind.m68k.elf	100%	Avira	EXP/ELF.Gafgyt.Z.F

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.19.169	unknown	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	wind.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	2.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	new.bat	Get hash	malicious	Unknown	Browse	154.216.17.175
	army7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.20.70
	gigganiggax86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.20.70
	army4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.20.70
	army6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.20.70
	mippytippy.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.20.70
	mippywippy.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.20.70
	army5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.216.20.70
	gompsl.elf	Get hash	malicious	Mirai	Browse	156.254.70.172
	garm.elf	Get hash	malicious	Mirai	Browse	156.241.11.50

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.360532849433493
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wind.m68k.elf
File size:	65'072 bytes
MD5:	ff13644127fe6c566ef31ac2d9644a0f
SHA1:	fb6cc4d4df031034b37517f380d8779f666832f8
SHA256:	6e13983e6373c409b04053c166bde638a0343b13a72ec55807d57fcd489159b7
SHA512:	b2485cebb85e710bb8811391b4ebb610de1943a464d8f64b794cdc262eeeeca60234f62ed80a405ae816a563ec79ab4e25877b1b0a7652e9f47dbd5df10cc11d
SSDEEP:	1536:TO76X79qRw/eeTh2yw8E6Mw0n8XDZKRlr:SzG/eeTh1xMoD0RN
TLSH:	80531BE9B8025E3CF91B9ABA44164E0ABD6177C152830F27677BFDD37C720A59D02C85
File Content Preview:	.ELF.......................D...4.........4. ...(.......................2...2...... ........8...8...8...(.......... .dt.Q............................NV..a....da.....N^NuNV..J9...`f>"y...P QJ.g.X.#....PN."y...P QJ.f.A.....J.g.Hy...4N.X........`N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	64672
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xe502	0x0	0x6	AX	4
.fini	PROGBITS	0x8000e5aa	0xe5aa	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000e5b8	0xe5b8	0x147a	0x0	0x2	A	2
.ctors	PROGBITS	0x80011a38	0xfa38	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80011a40	0xfa40	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80011a4c	0xfa4c	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x80011c60	0xfc60	0x2e8	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xfc60	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0xfa32	0xfa32	6.3913	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0xfa38	0x80011a38	0x80011a38	0x228	0x510	3.0777	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 20:23:04.627947092 CET	53486	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:04.633002996 CET	3778	53486	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:04.633097887 CET	53486	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:04.665975094 CET	53486	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:04.670861959 CET	3778	53486	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:04.670913935 CET	53486	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:04.675820112 CET	3778	53486	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.292498112 CET	3778	53486	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.292747021 CET	53486	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.292915106 CET	53486	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.294159889 CET	53488	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.299005032 CET	3778	53488	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.299109936 CET	53488	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.300005913 CET	53488	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.304826021 CET	3778	53488	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.304887056 CET	53488	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.309695959 CET	3778	53488	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.985256910 CET	3778	53488	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.985377073 CET	53488	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.985420942 CET	53488	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.985982895 CET	53490	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.990803003 CET	3778	53490	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.990873098 CET	53490	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.991797924 CET	53490	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:05.996617079 CET	3778	53490	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:05.996673107 CET	53490	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:06.002162933 CET	3778	53490	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:06.647341013 CET	3778	53490	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:06.647588015 CET	53490	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:06.647588015 CET	53490	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:06.651910067 CET	53492	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:06.656661034 CET	3778	53492	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:06.656815052 CET	53492	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:06.669250011 CET	53492	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:06.674107075 CET	3778	53492	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:06.674165010 CET	53492	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:06.679065943 CET	3778	53492	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:07.333188057 CET	3778	53492	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:07.333363056 CET	53492	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.333385944 CET	53492	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.333909035 CET	53494	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.338721037 CET	3778	53494	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:07.338771105 CET	53494	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.339642048 CET	53494	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.344381094 CET	3778	53494	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:07.344444990 CET	53494	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.349230051 CET	3778	53494	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:07.998938084 CET	3778	53494	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:07.999061108 CET	53494	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.999114037 CET	53494	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:07.999663115 CET	53496	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.004590034 CET	3778	53496	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:08.004673958 CET	53496	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.005383968 CET	53496	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.010135889 CET	3778	53496	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:08.010184050 CET	53496	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.014962912 CET	3778	53496	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:08.693572998 CET	3778	53496	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:08.693898916 CET	53496	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.694014072 CET	53496	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.694634914 CET	53498	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.699426889 CET	3778	53498	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:08.699531078 CET	53498	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.700227022 CET	53498	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.704998970 CET	3778	53498	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:08.705071926 CET	53498	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:08.709920883 CET	3778	53498	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:09.378233910 CET	3778	53498	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:09.378540993 CET	53498	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:09.378540993 CET	53498	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:09.379112959 CET	53500	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:09.383907080 CET	3778	53500	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:09.383976936 CET	53500	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:09.384680033 CET	53500	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:09.389513016 CET	3778	53500	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:09.389596939 CET	53500	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:09.394416094 CET	3778	53500	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.081377983 CET	3778	53500	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.082071066 CET	53500	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.082071066 CET	53500	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.083234072 CET	53502	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.088053942 CET	3778	53502	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.088299036 CET	53502	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.091988087 CET	53502	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.096842051 CET	3778	53502	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.096942902 CET	53502	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.101746082 CET	3778	53502	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.749157906 CET	3778	53502	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.749231100 CET	53502	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.749231100 CET	53502	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.773400068 CET	53504	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.778311968 CET	3778	53504	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.778371096 CET	53504	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.784991026 CET	53504	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.789738894 CET	3778	53504	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:10.789793968 CET	53504	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:10.794543028 CET	3778	53504	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:11.482259035 CET	3778	53504	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:11.482338905 CET	53504	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:11.482392073 CET	53504	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:11.484982014 CET	53506	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:11.489914894 CET	3778	53506	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:11.489958048 CET	53506	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:11.496011972 CET	53506	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:11.500864029 CET	3778	53506	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:11.500910044 CET	53506	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:11.505801916 CET	3778	53506	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.161626101 CET	3778	53506	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.161681890 CET	53506	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.161712885 CET	53506	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.175802946 CET	53508	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.180680990 CET	3778	53508	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.180793047 CET	53508	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.190498114 CET	53508	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.195369005 CET	3778	53508	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.198390007 CET	53508	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.203167915 CET	3778	53508	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.841664076 CET	3778	53508	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.841758013 CET	53508	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.841758013 CET	53508	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.844757080 CET	53510	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.849571943 CET	3778	53510	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.849649906 CET	53510	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.855372906 CET	53510	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.860117912 CET	3778	53510	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:12.860169888 CET	53510	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:12.864969015 CET	3778	53510	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:13.528714895 CET	3778	53510	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:13.528779030 CET	53510	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:13.528883934 CET	53510	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:13.531569958 CET	53512	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:13.536365986 CET	3778	53512	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:13.536417961 CET	53512	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:13.542444944 CET	53512	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:13.547256947 CET	3778	53512	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:13.547307014 CET	53512	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:13.552088022 CET	3778	53512	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.254009008 CET	3778	53512	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.254100084 CET	53512	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.254100084 CET	53512	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.291500092 CET	53514	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.296376944 CET	3778	53514	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.296446085 CET	53514	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.349163055 CET	53514	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.353919983 CET	3778	53514	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.354015112 CET	53514	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.358797073 CET	3778	53514	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.955482006 CET	3778	53514	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.955583096 CET	53514	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.955627918 CET	53514	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.958352089 CET	53516	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.963222027 CET	3778	53516	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.963293076 CET	53516	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.969465017 CET	53516	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.974301100 CET	3778	53516	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:14.974422932 CET	53516	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:14.979259014 CET	3778	53516	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:15.622689009 CET	3778	53516	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:15.622796059 CET	53516	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:15.622828960 CET	53516	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:15.627307892 CET	53518	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:15.633385897 CET	3778	53518	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:15.633470058 CET	53518	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:15.639919043 CET	53518	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:15.645998001 CET	3778	53518	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:15.646097898 CET	53518	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:15.652095079 CET	3778	53518	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:16.291414022 CET	3778	53518	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:16.293266058 CET	53518	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.293266058 CET	53518	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.303766966 CET	53520	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.308862925 CET	3778	53520	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:16.308933020 CET	53520	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.331231117 CET	53520	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.337197065 CET	3778	53520	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:16.337264061 CET	53520	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.343364954 CET	3778	53520	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:16.966814995 CET	3778	53520	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:16.966892004 CET	53520	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.966947079 CET	53520	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.973368883 CET	53522	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.978195906 CET	3778	53522	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:16.978247881 CET	53522	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:16.996136904 CET	53522	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.001554012 CET	3778	53522	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:17.001648903 CET	53522	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.006421089 CET	3778	53522	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:17.649837017 CET	3778	53522	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:17.649904966 CET	53522	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.649952888 CET	53522	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.657380104 CET	53524	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.662312984 CET	3778	53524	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:17.662373066 CET	53524	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.680565119 CET	53524	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.685813904 CET	3778	53524	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:17.685868979 CET	53524	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:17.690845966 CET	3778	53524	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:18.349328041 CET	3778	53524	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:18.349438906 CET	53524	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:18.349438906 CET	53524	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:18.373270988 CET	53526	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:18.378099918 CET	3778	53526	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:18.378998995 CET	53526	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:18.444576979 CET	53526	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:18.449420929 CET	3778	53526	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:18.449511051 CET	53526	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:18.454263926 CET	3778	53526	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.039839983 CET	3778	53526	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.039921045 CET	53526	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.039967060 CET	53526	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.042177916 CET	53528	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.046971083 CET	3778	53528	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.047027111 CET	53528	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.054867983 CET	53528	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.059762955 CET	3778	53528	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.059797049 CET	53528	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.064557076 CET	3778	53528	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.711286068 CET	3778	53528	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.713295937 CET	53528	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.713330984 CET	53528	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.716341019 CET	53530	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.721101999 CET	3778	53530	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.721143961 CET	53530	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.728708982 CET	53530	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.733490944 CET	3778	53530	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:19.733524084 CET	53530	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:19.738337994 CET	3778	53530	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:20.386502981 CET	3778	53530	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:20.386612892 CET	53530	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:20.386612892 CET	53530	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:20.396208048 CET	53532	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:20.401019096 CET	3778	53532	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:20.401103020 CET	53532	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:20.407757044 CET	53532	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:20.412504911 CET	3778	53532	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:20.412643909 CET	53532	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:20.417402029 CET	3778	53532	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.059933901 CET	3778	53532	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.060055017 CET	53532	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.060055017 CET	53532	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.065171003 CET	53534	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.071425915 CET	3778	53534	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.071711063 CET	53534	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.081463099 CET	53534	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.087553978 CET	3778	53534	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.087647915 CET	53534	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.093892097 CET	3778	53534	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.755302906 CET	3778	53534	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.755388021 CET	53534	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.755461931 CET	53534	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.758097887 CET	53536	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.762950897 CET	3778	53536	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.763014078 CET	53536	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.770204067 CET	53536	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.774966002 CET	3778	53536	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:21.775026083 CET	53536	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:21.779819965 CET	3778	53536	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:23.417407036 CET	3778	53536	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:23.417500973 CET	53536	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:23.417536020 CET	53536	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:23.420911074 CET	53538	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:23.425698996 CET	3778	53538	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:23.425760031 CET	53538	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:23.447438002 CET	53538	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:23.452277899 CET	3778	53538	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:23.452325106 CET	53538	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:23.457066059 CET	3778	53538	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.105508089 CET	3778	53538	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.105586052 CET	53538	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.105618000 CET	53538	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.109601021 CET	53540	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.114443064 CET	3778	53540	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.114495039 CET	53540	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.127547026 CET	53540	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.132477045 CET	3778	53540	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.132527113 CET	53540	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.137300968 CET	3778	53540	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.799880981 CET	3778	53540	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.799949884 CET	53540	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.799995899 CET	53540	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.805659056 CET	53542	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.810549974 CET	3778	53542	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.810622931 CET	53542	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.825293064 CET	53542	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.830159903 CET	3778	53542	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:24.830529928 CET	53542	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:24.835443974 CET	3778	53542	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:25.484555006 CET	3778	53542	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:25.484704971 CET	53542	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:25.484704971 CET	53542	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:25.485270977 CET	53544	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:25.490082979 CET	3778	53544	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:25.490174055 CET	53544	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:25.491353035 CET	53544	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:25.496114969 CET	3778	53544	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:25.496170998 CET	53544	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:25.500999928 CET	3778	53544	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.207488060 CET	3778	53544	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.207622051 CET	53544	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.207636118 CET	53544	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.208102942 CET	53546	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.212865114 CET	3778	53546	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.212928057 CET	53546	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.213532925 CET	53546	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.218291044 CET	3778	53546	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.218341112 CET	53546	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.223094940 CET	3778	53546	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.870347023 CET	3778	53546	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.870502949 CET	53546	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.870563984 CET	53546	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.871114016 CET	53548	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.875986099 CET	3778	53548	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.876040936 CET	53548	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.876648903 CET	53548	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.881472111 CET	3778	53548	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:27.881521940 CET	53548	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:27.886288881 CET	3778	53548	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:28.539036989 CET	3778	53548	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:28.539330959 CET	53548	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:28.539330959 CET	53548	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:28.540049076 CET	53550	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:28.545306921 CET	3778	53550	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:28.545383930 CET	53550	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:28.546406984 CET	53550	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:28.551220894 CET	3778	53550	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:28.551281929 CET	53550	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:28.556072950 CET	3778	53550	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.250880957 CET	3778	53550	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.251233101 CET	53550	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.251233101 CET	53550	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.252022028 CET	53552	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.256942034 CET	3778	53552	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.257023096 CET	53552	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.257674932 CET	53552	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.262432098 CET	3778	53552	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.262551069 CET	53552	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.267333031 CET	3778	53552	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.939910889 CET	3778	53552	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.940110922 CET	53552	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.940262079 CET	53552	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.940867901 CET	53554	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.945673943 CET	3778	53554	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.945740938 CET	53554	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.946409941 CET	53554	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.951206923 CET	3778	53554	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:29.951282978 CET	53554	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:29.956111908 CET	3778	53554	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:30.604547024 CET	3778	53554	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:30.604715109 CET	53554	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:30.604743958 CET	53554	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:30.605273962 CET	53556	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:30.610093117 CET	3778	53556	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:30.610158920 CET	53556	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:30.610816956 CET	53556	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:30.615567923 CET	3778	53556	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:30.615621090 CET	53556	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:30.621779919 CET	3778	53556	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.279021978 CET	3778	53556	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.279246092 CET	53556	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.279283047 CET	53556	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.279767036 CET	53558	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.287336111 CET	3778	53558	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.287403107 CET	53558	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.288144112 CET	53558	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.292964935 CET	3778	53558	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.293020010 CET	53558	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.299037933 CET	3778	53558	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.953329086 CET	3778	53558	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.953669071 CET	53558	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.953744888 CET	53558	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.954687119 CET	53560	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.959515095 CET	3778	53560	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.959611893 CET	53560	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.960582018 CET	53560	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.965321064 CET	3778	53560	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:31.965377092 CET	53560	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:31.971359015 CET	3778	53560	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:32.616942883 CET	3778	53560	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:32.617245913 CET	53560	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:32.617245913 CET	53560	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:32.617954016 CET	53562	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:32.622721910 CET	3778	53562	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:32.622788906 CET	53562	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:32.623733997 CET	53562	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:32.628515005 CET	3778	53562	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:32.628619909 CET	53562	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:32.633482933 CET	3778	53562	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:33.361987114 CET	3778	53562	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:33.362164974 CET	53562	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:33.362196922 CET	53562	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:33.362728119 CET	53564	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:33.367614985 CET	3778	53564	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:33.367675066 CET	53564	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:33.368422985 CET	53564	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:33.373178959 CET	3778	53564	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:33.373228073 CET	53564	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:33.380186081 CET	3778	53564	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:35.697746992 CET	3778	53564	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:35.697896004 CET	53564	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:35.697928905 CET	53564	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:35.698605061 CET	53566	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:35.703439951 CET	3778	53566	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:35.703490019 CET	53566	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:35.704454899 CET	53566	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:35.709252119 CET	3778	53566	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:35.709295988 CET	53566	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:35.714045048 CET	3778	53566	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:36.388890028 CET	3778	53566	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:36.389065027 CET	53566	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:36.389090061 CET	53566	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:36.390072107 CET	53568	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:36.395059109 CET	3778	53568	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:36.395296097 CET	53568	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:36.396261930 CET	53568	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:36.401004076 CET	3778	53568	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:36.401058912 CET	53568	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:36.407015085 CET	3778	53568	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.095999956 CET	3778	53568	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.096174955 CET	53568	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.096242905 CET	53568	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.097245932 CET	53570	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.102194071 CET	3778	53570	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.102303028 CET	53570	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.103269100 CET	53570	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.108273029 CET	3778	53570	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.108413935 CET	53570	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.113240004 CET	3778	53570	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.785530090 CET	3778	53570	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.785907984 CET	53570	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.785907984 CET	53570	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.787125111 CET	53572	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.792036057 CET	3778	53572	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.792124033 CET	53572	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.793181896 CET	53572	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.798018932 CET	3778	53572	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:37.798151016 CET	53572	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:37.803034067 CET	3778	53572	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:38.468312979 CET	3778	53572	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:38.468445063 CET	53572	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:38.468481064 CET	53572	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:38.469407082 CET	53574	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:38.474224091 CET	3778	53574	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:38.474307060 CET	53574	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:38.475691080 CET	53574	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:38.480460882 CET	3778	53574	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:38.480531931 CET	53574	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:38.485306025 CET	3778	53574	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.155441999 CET	3778	53574	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.155755043 CET	53574	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.155755043 CET	53574	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.156155109 CET	53576	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.160983086 CET	3778	53576	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.161071062 CET	53576	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.161716938 CET	53576	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.166522980 CET	3778	53576	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.166579962 CET	53576	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.171380043 CET	3778	53576	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.838644028 CET	3778	53576	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.838881969 CET	53576	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.838882923 CET	53576	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.839814901 CET	53578	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.844626904 CET	3778	53578	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.844723940 CET	53578	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.845706940 CET	53578	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.850517035 CET	3778	53578	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:39.850579023 CET	53578	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:39.855386019 CET	3778	53578	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:40.503891945 CET	3778	53578	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:40.504168987 CET	53578	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:40.504288912 CET	53578	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:40.505619049 CET	53580	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:40.510513067 CET	3778	53580	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:40.510597944 CET	53580	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:40.512121916 CET	53580	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:40.516927004 CET	3778	53580	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:40.517052889 CET	53580	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:40.521929026 CET	3778	53580	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.192233086 CET	3778	53580	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.192555904 CET	53580	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.192640066 CET	53580	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.193365097 CET	53582	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.198421001 CET	3778	53582	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.198487997 CET	53582	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.199054956 CET	53582	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.204128027 CET	3778	53582	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.204195023 CET	53582	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.209482908 CET	3778	53582	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.886270046 CET	3778	53582	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.886528969 CET	53582	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.886622906 CET	53582	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.887572050 CET	53584	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.892366886 CET	3778	53584	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.892570019 CET	53584	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.893898964 CET	53584	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.898679018 CET	3778	53584	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:41.898761034 CET	53584	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:41.903666019 CET	3778	53584	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:42.568850994 CET	3778	53584	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:42.569077969 CET	53584	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:42.569164991 CET	53584	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:42.569956064 CET	53586	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:42.574965954 CET	3778	53586	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:42.575081110 CET	53586	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:42.576136112 CET	53586	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:42.581209898 CET	3778	53586	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:42.581309080 CET	53586	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:42.586522102 CET	3778	53586	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.272748947 CET	3778	53586	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.272852898 CET	53586	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.272901058 CET	53586	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.273389101 CET	53588	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.278275013 CET	3778	53588	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.278326035 CET	53588	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.278903961 CET	53588	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.283755064 CET	3778	53588	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.283807993 CET	53588	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.288569927 CET	3778	53588	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.949295998 CET	3778	53588	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.949400902 CET	53588	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.949429989 CET	53588	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.950207949 CET	53590	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.955022097 CET	3778	53590	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.955071926 CET	53590	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.956012964 CET	53590	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.960875034 CET	3778	53590	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:43.960928917 CET	53590	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:43.965689898 CET	3778	53590	154.216.19.169	192.168.2.15
Jan 9, 2025 20:23:53.966047049 CET	53590	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:23:53.971815109 CET	3778	53590	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:13.333175898 CET	3778	53590	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:13.333451033 CET	53590	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:13.338294983 CET	3778	53590	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:14.336338997 CET	53592	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:14.341362000 CET	3778	53592	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:14.341497898 CET	53592	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:14.342933893 CET	53592	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:14.347693920 CET	3778	53592	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:14.347742081 CET	53592	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:14.352559090 CET	3778	53592	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:35.726372957 CET	3778	53592	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:35.726824999 CET	53592	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:35.731750011 CET	3778	53592	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:36.729883909 CET	53594	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:36.734890938 CET	3778	53594	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:36.735033989 CET	53594	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:36.736306906 CET	53594	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:36.741132975 CET	3778	53594	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:36.741223097 CET	53594	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:36.746057034 CET	3778	53594	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:58.133142948 CET	3778	53594	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:58.133605957 CET	53594	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:58.138905048 CET	3778	53594	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:59.135799885 CET	53596	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:59.140935898 CET	3778	53596	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:59.141026974 CET	53596	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:59.142235041 CET	53596	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:59.147078037 CET	3778	53596	154.216.19.169	192.168.2.15
Jan 9, 2025 20:24:59.147144079 CET	53596	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:24:59.151993990 CET	3778	53596	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:09.152193069 CET	53596	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:09.157026052 CET	3778	53596	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:20.504247904 CET	3778	53596	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:20.504637003 CET	53596	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:20.509542942 CET	3778	53596	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:21.507313967 CET	53598	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:21.512291908 CET	3778	53598	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:21.512392044 CET	53598	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:21.513560057 CET	53598	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:21.518467903 CET	3778	53598	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:21.518527031 CET	53598	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:21.523391962 CET	3778	53598	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:42.864156008 CET	3778	53598	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:42.864669085 CET	53598	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:42.869532108 CET	3778	53598	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:43.870600939 CET	53600	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:43.875847101 CET	3778	53600	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:43.875941992 CET	53600	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:43.878170967 CET	53600	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:43.883135080 CET	3778	53600	154.216.19.169	192.168.2.15
Jan 9, 2025 20:25:43.883213043 CET	53600	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:25:43.888067961 CET	3778	53600	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:05.241385937 CET	3778	53600	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:05.241971016 CET	53600	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:05.246949911 CET	3778	53600	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:06.244692087 CET	53602	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:06.249598980 CET	3778	53602	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:06.249679089 CET	53602	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:06.251029015 CET	53602	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:06.255834103 CET	3778	53602	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:06.255892992 CET	53602	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:06.260663033 CET	3778	53602	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:16.261115074 CET	53602	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:16.267848969 CET	3778	53602	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:27.630192041 CET	3778	53602	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:27.630552053 CET	53602	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:27.635622025 CET	3778	53602	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:28.633392096 CET	53604	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:28.640069962 CET	3778	53604	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:28.640223026 CET	53604	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:28.641107082 CET	53604	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:28.647389889 CET	3778	53604	154.216.19.169	192.168.2.15
Jan 9, 2025 20:26:28.647475004 CET	53604	3778	192.168.2.15	154.216.19.169
Jan 9, 2025 20:26:28.653801918 CET	3778	53604	154.216.19.169	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 20:25:47.014302015 CET	42397	53	192.168.2.15	1.1.1.1
Jan 9, 2025 20:25:47.014375925 CET	53045	53	192.168.2.15	1.1.1.1
Jan 9, 2025 20:25:47.021445990 CET	53	53045	1.1.1.1	192.168.2.15
Jan 9, 2025 20:25:47.021981955 CET	53	42397	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 20:25:47.014302015 CET	192.168.2.15	1.1.1.1	0x825	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 20:25:47.014375925 CET	192.168.2.15	1.1.1.1	0x8f1d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 20:25:47.021981955 CET	1.1.1.1	192.168.2.15	0x825	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 9, 2025 20:25:47.021981955 CET	1.1.1.1	192.168.2.15	0x825	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: wind.m68k.elf PID: 5526, Parent PID: 5448

General

Start time (UTC):	19:23:03
Start date (UTC):	09/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	/tmp/wind.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5528, Parent PID: 5526

General

Start time (UTC):	19:23:03
Start date (UTC):	09/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5529, Parent PID: 5526

General

Start time (UTC):	19:23:03
Start date (UTC):	09/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5531, Parent PID: 5526

General

Start time (UTC):	19:23:03
Start date (UTC):	09/01/2025
Path:	/tmp/wind.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: xfce4-panel PID: 5542, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5542, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5545, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5545, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5546, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5546, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5549, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5549, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5568, Parent PID: 5549

General

Start time (UTC):	19:23:16
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 5568, Parent PID: 5549

General

Start time (UTC):	19:23:16
Start date (UTC):	09/01/2025
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

Chronological Activities

Analysis Process: xfce4-panel PID: 5550, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5550, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 5551, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5551, Parent PID: 3235

General

Start time (UTC):	19:23:09
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: dbus-daemon PID: 5567, Parent PID: 5566

General

Start time (UTC):	19:23:16
Start date (UTC):	09/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: xfconfd PID: 5567, Parent PID: 5566

General

Start time (UTC):	19:23:16
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Chronological Activities

Analysis Process: systemd PID: 5577, Parent PID: 3044

General

Start time (UTC):	19:23:20
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: xfce4-notifyd PID: 5577, Parent PID: 3044

General

Start time (UTC):	19:23:20
Start date (UTC):	09/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wind.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: wind.m68k.elf PID: 5526, Parent PID: 5448

General

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5528, Parent PID: 5526

General

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5529, Parent PID: 5526

General

Chronological Activities

Analysis Process: wind.m68k.elf PID: 5531, Parent PID: 5526

General

Chronological Activities

Analysis Process: xfce4-panel PID: 5542, Parent PID: 3235

General

Chronological Activities

Analysis Process: wrapper-2.0 PID: 5542, Parent PID: 3235

Linux Analysis Report
wind.m68k.elf