Edit tour

Linux Analysis Report
morte.m68k.elf

Overview

General Information

Sample name:	morte.m68k.elf
Analysis ID:	1635845
MD5:	8a69ddb33f34bdd9678a1c1d0071e7e2
SHA1:	60bcccc1a26c3ce82e5021073ff795b78133e9e4
SHA256:	4ce45208595c7b9c6e463ca607ff3a6e20c5d37042ed12a91585513f5fe6b141
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635845
Start date and time:	2025-03-12 02:50:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	morte.m68k.elf
Detection:	MAL
Classification:	mal56.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/morte.m68k.elf
PID:	5509
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

morte.m68k.elf (PID: 5509, Parent: 5434, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/morte.m68k.elf

morte.m68k.elf New Fork (PID: 5511, Parent: 5509)

morte.m68k.elf New Fork (PID: 5513, Parent: 5511)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: morte.m68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: morte.m68k.elf	Virustotal: Detection: 47%			Perma Link
Source: morte.m68k.elf	ReversingLabs: Detection: 47%

Source: global traffic

TCP traffic: 192.168.2.13:38726 -> 176.65.134.62:7777

Source: /tmp/morte.m68k.elf (PID: 5511)

Socket: 127.0.0.1:9116

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.linELF@0/0@0/0

Source: /tmp/morte.m68k.elf (PID: 5509)

Queries kernel information via 'uname':

Jump to behavior

Source: morte.m68k.elf, 5509.1.00007fffe6405000.00007fffe6426000.rw-.sdmp, morte.m68k.elf, 5513.1.00007fffe6405000.00007fffe6426000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/morte.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/morte.m68k.elf
Source: morte.m68k.elf, 5509.1.00007fffe6405000.00007fffe6426000.rw-.sdmp, morte.m68k.elf, 5513.1.00007fffe6405000.00007fffe6426000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: morte.m68k.elf, 5509.1.0000563988760000.00005639887e5000.rw-.sdmp, morte.m68k.elf, 5513.1.0000563988760000.00005639887e5000.rw-.sdmp	Binary or memory string: 9V!/etc/qemu-binfmt/m68k
Source: morte.m68k.elf, 5509.1.0000563988760000.00005639887e5000.rw-.sdmp, morte.m68k.elf, 5513.1.0000563988760000.00005639887e5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
morte.m68k.elf	48%	Virustotal		Browse
morte.m68k.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
morte.m68k.elf	100%	Avira	EXP/ELF.Mirai.N

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.134.62	unknown	Germany		56325	DIOGELO-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
176.65.134.62	morte.mips.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Unknown	Browse
	morte.x86.elf	Get hash	malicious	Unknown	Browse
	morte.ppc.elf	Get hash	malicious	Unknown	Browse
	morte.sh4.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	morte.ppc.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Unknown	Browse
	morte.mips.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIOGELO-ASGB	morte.mips.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.x86.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.mips.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	176.65.134.62

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.58683463162861
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	morte.m68k.elf
File size:	135'744 bytes
MD5:	8a69ddb33f34bdd9678a1c1d0071e7e2
SHA1:	60bcccc1a26c3ce82e5021073ff795b78133e9e4
SHA256:	4ce45208595c7b9c6e463ca607ff3a6e20c5d37042ed12a91585513f5fe6b141
SHA512:	3ce41975f3a72cb66defff25560995e3a7053679e1b02934d951a14a096097f30f0164b20280e6bdc7374baac2e793e33215b7740373c029e20b42113a65d104
SSDEEP:	3072:xdd7Gkh496ig+RPZU66Vvjbi+LolxNiGy+aP7C://496ig+fU6cLojy+ajC
TLSH:	3ED319CBF900DAB9F80AE33748534809B130BBA149925E377257356FED3A1D90577E8A
File Content Preview:	.ELF.......................D...4.........4. ...(......................."..."...... ........(...(...(..HH.......... .dt.Q............................NV..a....da....dN^NuNV..J9..0pf>"y...D QJ.g.X.#....DN."y...D QJ.f.A.....J.g.Hy...$N.X.......0pN^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	135344
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x1ab8e	0x0	0x6	AX	4
.fini	PROGBITS	0x8001ac36	0x1ac36	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8001ac44	0x1ac44	0x1bde	0x0	0x2	A	2
.ctors	PROGBITS	0x8001e828	0x1c828	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x8001e834	0x1c834	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8001e840	0x1c840	0x4830	0x0	0x3	WA	32
.bss	NOBITS	0x80023070	0x21070	0x4640	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x21070	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1c822	0x1c822	6.0630	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x1c828	0x8001e828	0x8001e828	0x4848	0x8e88	0.3429	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2025 02:51:31.477164984 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:31.482129097 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:31.482203960 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:31.485233068 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:31.489949942 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:31.489998102 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:31.494673967 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:32.336462975 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:32.336595058 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:32.336939096 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:32.337429047 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:32.342093945 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:32.342152119 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:32.342844963 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:32.347887993 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:32.347923994 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:32.352960110 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.047435999 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.047538042 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.047677040 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.048547983 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.053186893 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.053236961 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.054034948 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.058659077 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.058700085 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.063394070 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.729597092 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.729795933 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.729846001 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.730369091 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.735256910 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.735317945 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.736064911 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.740956068 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:33.740997076 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:33.745858908 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:34.413829088 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:34.414043903 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:34.414149046 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:34.414685965 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:34.419425011 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:34.419473886 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:34.420293093 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:34.424928904 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:34.424968004 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:34.429606915 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.122369051 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.122474909 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.122515917 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.123017073 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.127651930 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.127695084 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.128391027 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.133678913 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.133718014 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.139303923 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.808209896 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.808397055 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.808449030 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.808991909 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.813648939 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.813730955 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.814460993 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.819143057 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:35.819190979 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:35.823790073 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:36.507920027 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:36.508033991 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:36.508094072 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:36.508697987 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:36.513391972 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:36.513439894 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:36.514151096 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:36.518812895 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:36.518853903 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:36.523533106 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.186248064 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.186399937 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.186436892 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.186995029 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.191658974 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.191745996 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.192487955 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.197092056 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.197149038 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.201823950 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.872170925 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.872236013 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.872370958 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.872860909 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.877918959 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.877974987 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.878680944 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.883409977 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:37.883471012 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:37.888149977 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:38.566210985 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:38.566345930 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:38.566384077 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:38.567024946 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:38.571732044 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:38.571777105 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:38.572603941 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:38.577244043 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:38.577284098 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:38.581918001 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:39.257636070 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:39.257756948 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:39.257811069 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:39.258539915 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:39.263242960 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:39.263309002 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:39.264216900 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:39.268932104 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:39.268997908 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:39.273664951 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.002465010 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.002620935 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.002665997 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.003243923 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.007947922 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.008003950 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.008917093 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.013551950 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.013602972 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.018275976 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.692688942 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.692761898 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.692801952 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.693232059 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.698930979 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.698983908 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.700016975 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.704684019 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:40.704754114 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:40.709428072 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:41.398883104 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:41.399096012 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:41.399189949 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:41.400001049 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:41.404781103 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:41.404881954 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:41.406002045 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:41.410645962 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:41.410700083 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:41.415340900 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.085628033 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.085781097 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.085880041 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.086369991 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.091094971 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.091147900 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.091880083 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.096529961 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.096580982 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.101281881 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.909739017 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.909929037 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.909965992 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.910587072 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.915304899 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.915400982 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.916191101 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.920804024 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:42.920857906 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:42.925533056 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:43.597939968 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:43.598197937 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:43.598303080 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:43.598999977 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:43.603631973 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:43.603710890 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:43.604415894 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:43.609391928 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:43.609441042 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:43.614075899 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:44.293591976 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:44.293809891 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:44.293811083 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:44.294226885 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:44.298912048 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:44.298962116 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:44.299546957 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:44.304254055 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:44.304292917 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:44.308944941 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.009437084 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.009855032 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.009855032 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.010307074 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.015038967 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.015125990 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.015835047 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.020680904 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.020730019 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.025682926 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.737896919 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.738162994 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.738162994 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.738821030 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.743715048 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.743798018 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.744482040 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.749327898 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:45.749388933 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:45.754542112 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:46.446294069 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:46.446423054 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:46.446423054 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:46.446932077 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:46.451644897 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:46.451721907 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:46.452279091 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:46.457015991 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:46.457061052 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:46.461738110 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.127368927 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.127502918 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.127582073 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.128186941 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.132878065 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.132951021 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.133694887 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.138350010 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.138402939 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.143107891 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.824815035 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.825086117 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.825124025 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.825860023 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.830991030 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.831083059 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.832178116 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.836942911 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:47.837006092 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:47.841753960 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:48.542510033 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:48.542802095 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:48.542876959 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:48.543663025 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:48.548388958 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:48.548475981 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:48.549586058 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:48.554261923 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:48.554330111 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:48.558998108 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.255434990 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.255600929 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.255676031 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.256514072 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.261236906 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.261329889 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.262444019 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.267196894 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.267263889 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.271985054 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.975162983 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.975424051 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.975424051 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.976000071 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.980678082 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.980763912 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.981543064 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.986183882 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:49.986244917 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:49.990936041 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:50.658750057 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:50.659097910 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:50.659097910 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:50.659643888 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:50.664356947 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:50.664419889 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:50.665138006 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:50.669792891 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:50.669845104 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:50.674577951 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:51.344435930 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:51.344681978 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:51.344681978 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:51.345309019 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:51.350038052 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:51.350121975 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:51.350928068 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:51.355882883 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:51.355946064 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:51.360671997 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.075720072 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.076056957 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.076056957 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.076576948 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.081244946 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.081329107 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.082144022 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.086812019 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.086864948 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.091608047 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.777446985 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.777565002 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.777595997 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.778166056 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.784317970 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.784398079 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.785147905 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.789896965 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:52.789958954 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:52.794583082 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:53.480238914 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:53.480645895 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:53.480645895 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:53.481161118 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:53.485831022 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:53.485886097 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:53.486596107 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:53.491276979 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:53.491323948 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:53.496004105 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:54.183754921 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:54.183983088 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:54.183983088 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:54.184732914 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:54.191610098 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:54.191700935 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:54.192405939 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:54.199460983 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 02:51:54.199508905 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:51:54.205914021 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 02:52:04.202732086 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:52:04.207379103 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 02:52:04.411355019 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 02:52:04.411614895 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:53:04.455950022 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 02:53:04.460923910 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 02:53:04.664453983 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 02:53:04.664633036 CET	38790	7777	192.168.2.13	176.65.134.62

System Behavior

Analysis Process: morte.m68k.elf PID: 5509, Parent PID: 5434

General

Start time (UTC):	01:51:30
Start date (UTC):	12/03/2025
Path:	/tmp/morte.m68k.elf
Arguments:	/tmp/morte.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: morte.m68k.elf PID: 5511, Parent PID: 5509

General

Start time (UTC):	01:51:31
Start date (UTC):	12/03/2025
Path:	/tmp/morte.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: morte.m68k.elf PID: 5513, Parent PID: 5511

General

Start time (UTC):	01:51:31
Start date (UTC):	12/03/2025
Path:	/tmp/morte.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report morte.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

TCP Packets

System Behavior

Analysis Process: morte.m68k.elf PID: 5509, Parent PID: 5434

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: morte.m68k.elf PID: 5511, Parent PID: 5509

General

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: morte.m68k.elf PID: 5513, Parent PID: 5511

General

File Activities

File Opened

Process Activities

Linux Analysis Report
morte.m68k.elf