Edit tour

Linux Analysis Report
boatnet.spc.elf

Overview

General Information

Sample name:boatnet.spc.elf
Analysis ID:1640213
MD5:24d219d84de282b96539fd255cce28d0
SHA1:4df85490c759d6303b0bdb727123916c8a6db440
SHA256:5371fcfb706f1137cabc0d57d5c5790d50d5c57c0b609f43a6b837740d083af7
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Mirai
Score:76
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample tries to kill multiple processes (SIGKILL)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1640213
Start date and time:2025-03-17 02:40:44 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.spc.elf
Detection:MAL
Classification:mal76.spre.troj.linELF@0/0@2/0
Command:/tmp/boatnet.spc.elf
PID:5824
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5833, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5834, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5835, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5836, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
  • wrapper-2.0 (PID: 5837, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5838, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
boatnet.spc.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    boatnet.spc.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    boatnet.spc.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    SourceRuleDescriptionAuthorStrings
    5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xceb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xc958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc96c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc9f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xca98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcaac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xcae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        Click to see the 6 entries
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: boatnet.spc.elfAvira: detected
        Source: boatnet.spc.elfVirustotal: Detection: 67%Perma Link
        Source: boatnet.spc.elfReversingLabs: Detection: 75%
        Source: global trafficTCP traffic: 192.168.2.15:59998 -> 185.113.223.63:3778
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: unknownTCP traffic detected without corresponding DNS query: 185.113.223.63
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

        System Summary

        barindex
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5824, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5824, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5828, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.spc.elf PID: 5828, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3192, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3249, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3250, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3251, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3252, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3253, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3255, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3272, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3274, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3298, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5833, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5834, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5835, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5836, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5837, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5838, result: successfulJump to behavior
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3192, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3249, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3250, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3251, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3252, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3253, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3255, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3272, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3274, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 3298, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5833, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5834, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5835, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5836, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5837, result: successfulJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)SIGKILL sent: pid: 5838, result: successfulJump to behavior
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: boatnet.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5824, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5824, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5828, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.spc.elf PID: 5828, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: classification engineClassification label: mal76.spre.troj.linELF@0/0@2/0
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1185/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3241/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3483/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1732/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1730/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1333/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1695/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3235/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3234/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/911/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/515/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5810/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1617/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1615/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3255/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3253/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1591/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3252/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3251/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3250/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1623/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5829/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3249/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/764/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3368/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1585/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3246/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3488/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/766/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/888/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1509/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/804/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5669/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1867/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3407/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1484/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1514/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5838/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1634/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5839/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1479/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1875/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/654/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3379/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/655/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/656/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/777/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/931/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1595/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/657/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/812/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/779/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/658/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/933/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/418/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5833/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/419/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5834/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5835/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3419/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5836/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/5837/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3310/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3275/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3274/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3273/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3394/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3272/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/782/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3303/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3708/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1762/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3027/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1486/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/789/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1806/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1660/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3440/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/793/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/794/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3316/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/674/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/796/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/675/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/676/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1498/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1497/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1496/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3157/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3278/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3399/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3796/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3797/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3798/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3799/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/1659/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3332/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5826)File opened: /proc/3210/cmdlineJump to behavior
        Source: /tmp/boatnet.spc.elf (PID: 5824)Queries kernel information via 'uname': Jump to behavior
        Source: boatnet.spc.elf, 5824.1.00005586c8874000.00005586c88f9000.rw-.sdmp, boatnet.spc.elf, 5828.1.00005586c8874000.00005586c88f9000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
        Source: boatnet.spc.elf, 5824.1.00005586c8874000.00005586c88f9000.rw-.sdmp, boatnet.spc.elf, 5828.1.00005586c8874000.00005586c88f9000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/sparc
        Source: boatnet.spc.elf, 5824.1.00007ffd7043c000.00007ffd7045d000.rw-.sdmp, boatnet.spc.elf, 5828.1.00007ffd7043c000.00007ffd7045d000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sparc/tmp/boatnet.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.spc.elf
        Source: boatnet.spc.elf, 5824.1.00007ffd7043c000.00007ffd7045d000.rw-.sdmp, boatnet.spc.elf, 5828.1.00007ffd7043c000.00007ffd7045d000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: boatnet.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.spc.elf PID: 5824, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: boatnet.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 5828.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5824.1.00007f3f9c011000.00007f3f9c01f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.spc.elf PID: 5824, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Non-Standard Port
        Exfiltration Over Other Network Medium1
        Service Stop
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1640213 Sample: boatnet.spc.elf Startdate: 17/03/2025 Architecture: LINUX Score: 76 22 185.113.223.63, 3778, 59998, 60000 RADORETR Turkey 2->22 24 daisy.ubuntu.com 2->24 26 Malicious sample detected (through community Yara rule) 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 7 boatnet.spc.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 4 other processes 2->13 signatures3 process4 process5 15 boatnet.spc.elf 7->15         started        18 boatnet.spc.elf 7->18         started        20 boatnet.spc.elf 7->20         started        signatures6 34 Sample tries to kill multiple processes (SIGKILL) 15->34

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        boatnet.spc.elf67%VirustotalBrowse
        boatnet.spc.elf75%ReversingLabsLinux.Backdoor.Mirai
        boatnet.spc.elf100%AviraEXP/ELF.Gafgyt.D
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.25
        truefalse
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          185.113.223.63
          unknownTurkey
          42926RADORETRfalse
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          185.113.223.63SecuriteInfo.com.Linux.DownLoader.523.24180.20921.elfGet hashmaliciousUnknownBrowse
          • /hiddenbin/boatnet.arm6
          SecuriteInfo.com.Linux.DownLoader.531.18112.14994.elfGet hashmaliciousUnknownBrowse
          • /hiddenbin/boatnet.x86
          SecuriteInfo.com.Linux.DownLoader.523.24235.224.elfGet hashmaliciousUnknownBrowse
          • /hiddenbin/boatnet.arm7
          SecuriteInfo.com.Linux.DownLoader.294.21870.14020.elfGet hashmaliciousUnknownBrowse
          • /hiddenbin/boatnet.mpsl
          SecuriteInfo.com.Linux.DownLoader.598.26899.27276.elfGet hashmaliciousUnknownBrowse
          • /hiddenbin/boatnet.mips
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          daisy.ubuntu.comboatnet.x86.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.25
          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.24
          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
          • 162.213.35.24
          .i.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          test.bot.mpsl.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          re.bot.arm7.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25
          sshd.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.25
          re.bot.arm.elfGet hashmaliciousUnknownBrowse
          • 162.213.35.24
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          RADORETRboatnet.arm.elfGet hashmaliciousMiraiBrowse
          • 185.113.223.63
          boatnet.ppc.elfGet hashmaliciousMiraiBrowse
          • 185.113.223.63
          boatnet.x86.elfGet hashmaliciousMiraiBrowse
          • 185.113.223.63
          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
          • 185.113.223.63
          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
          • 185.113.223.63
          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
          • 185.113.223.63
          SecuriteInfo.com.Linux.DownLoader.523.24180.20921.elfGet hashmaliciousUnknownBrowse
          • 185.113.223.63
          SecuriteInfo.com.Linux.DownLoader.531.18112.14994.elfGet hashmaliciousUnknownBrowse
          • 185.113.223.63
          SecuriteInfo.com.Linux.DownLoader.523.24235.224.elfGet hashmaliciousUnknownBrowse
          • 185.113.223.63
          SecuriteInfo.com.Linux.DownLoader.294.21870.14020.elfGet hashmaliciousUnknownBrowse
          • 185.113.223.63
          No context
          No context
          No created / dropped files found
          File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
          Entropy (8bit):6.066515457058937
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:boatnet.spc.elf
          File size:58'376 bytes
          MD5:24d219d84de282b96539fd255cce28d0
          SHA1:4df85490c759d6303b0bdb727123916c8a6db440
          SHA256:5371fcfb706f1137cabc0d57d5c5790d50d5c57c0b609f43a6b837740d083af7
          SHA512:b230cb6b24806a959815f819d8a2afa1a9ede4647815c4c2693391485b488c84f30a03c24b03c41007b4145f9162b58fbba078b432d876b5e3cbbe9df57c338f
          SSDEEP:768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwL:RqtmZPuutfbltZFBSJsBcfDSTFI+BEL
          TLSH:8C432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8
          File Content Preview:.ELF...........................4...x.....4. ...(.......................................................8...P........dt.Q................................@..(....@.2.................#.....b8..`.....!..... ...@.....".........`......$ ... ...@...........`....

          ELF header

          Class:ELF32
          Data:2's complement, big endian
          Version:1 (current)
          Machine:Sparc
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x101a4
          Flags:0x0
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:57976
          Section Header Size:40
          Number of Section Headers:10
          Header String Table Index:9
          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x100940x940x1c0x00x6AX004
          .textPROGBITS0x100b00xb00xc8880x00x6AX004
          .finiPROGBITS0x1c9380xc9380x140x00x6AX004
          .rodataPROGBITS0x1c9500xc9500x11b00x00x2A008
          .ctorsPROGBITS0x2e0000xe0000x80x00x3WA004
          .dtorsPROGBITS0x2e0080xe0080x80x00x3WA004
          .dataPROGBITS0x2e0180xe0180x2200x00x3WA008
          .bssNOBITS0x2e2380xe2380x3180x00x3WA004
          .shstrtabSTRTAB0x00xe2380x3e0x00x0001
          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x100000x100000xdb000xdb006.17300x5R E0x10000.init .text .fini .rodata
          LOAD0xe0000x2e0000x2e0000x2380x5502.92290x6RW 0x10000.ctors .dtors .data .bss
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

          Download Network PCAP: filteredfull

          • Total Packets: 354
          • 3778 undefined
          • 53 (DNS)
          TimestampSource PortDest PortSource IPDest IP
          Mar 17, 2025 02:41:52.833923101 CET599983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:52.838629961 CET377859998185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:52.838675976 CET599983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:52.860898972 CET599983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:52.865537882 CET377859998185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:52.865590096 CET599983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:52.870225906 CET377859998185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:53.567997932 CET377859998185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:53.571300030 CET599983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:53.571449995 CET599983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:53.627284050 CET600003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:53.632028103 CET377860000185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:53.632499933 CET600003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:53.651271105 CET600003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:53.655915022 CET377860000185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:53.662980080 CET600003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:53.667670012 CET377860000185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:54.339835882 CET377860000185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:54.339900970 CET600003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:54.339960098 CET600003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:54.340440035 CET600023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:54.345731974 CET377860002185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:54.345779896 CET600023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:54.346971035 CET600023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:54.351749897 CET377860002185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:54.351794004 CET600023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:54.356452942 CET377860002185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.060786963 CET377860002185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.060839891 CET600023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.060894012 CET600023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.061738014 CET600043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.066395998 CET377860004185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.066477060 CET600043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.068154097 CET600043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.072849035 CET377860004185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.072906971 CET600043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.077615976 CET377860004185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.763145924 CET377860004185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.763209105 CET600043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.763238907 CET600043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.764019012 CET600063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.768677950 CET377860006185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.768723011 CET600063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.770761013 CET600063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.775465965 CET377860006185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:55.775506020 CET600063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:55.780138016 CET377860006185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:56.474210024 CET377860006185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:56.474284887 CET600063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:56.474318981 CET600063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:56.475042105 CET600083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:56.479729891 CET377860008185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:56.479785919 CET600083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:56.481800079 CET600083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:56.486462116 CET377860008185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:56.486507893 CET600083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:56.491142988 CET377860008185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:57.201069117 CET377860008185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:57.201122046 CET600083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.201183081 CET600083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.202425957 CET600103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.207123995 CET377860010185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:57.207171917 CET600103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.209286928 CET600103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.213927984 CET377860010185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:57.213968992 CET600103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.218600988 CET377860010185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:57.956850052 CET377860010185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:57.959323883 CET600103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.959357023 CET600103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.975337982 CET600123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:57.980000019 CET377860012185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:57.983292103 CET600123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.067293882 CET600123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.072010994 CET377860012185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:58.075294971 CET600123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.079929113 CET377860012185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:58.732959986 CET377860012185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:58.733213902 CET600123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.733213902 CET600123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.743340015 CET600143778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.748083115 CET377860014185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:58.748127937 CET600143778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.748913050 CET600143778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.753546000 CET377860014185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:58.753587008 CET600143778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:58.758202076 CET377860014185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:59.447360039 CET377860014185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:59.447458982 CET600143778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:59.447484016 CET600143778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:59.447874069 CET600163778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:59.452533960 CET377860016185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:59.452586889 CET600163778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:59.453166008 CET600163778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:59.457753897 CET377860016185.113.223.63192.168.2.15
          Mar 17, 2025 02:41:59.457794905 CET600163778192.168.2.15185.113.223.63
          Mar 17, 2025 02:41:59.462959051 CET377860016185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.166327000 CET377860016185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.166414022 CET600163778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.166428089 CET600163778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.166795969 CET600183778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.171433926 CET377860018185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.171482086 CET600183778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.172003984 CET600183778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.176673889 CET377860018185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.176709890 CET600183778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.181418896 CET377860018185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.871268988 CET377860018185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.871376038 CET600183778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.871376038 CET600183778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.871826887 CET600203778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.876549006 CET377860020185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.876601934 CET600203778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.877146006 CET600203778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.881771088 CET377860020185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:00.881834030 CET600203778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:00.886456966 CET377860020185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:01.572822094 CET377860020185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:01.572942972 CET600203778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:01.572978020 CET600203778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:01.573468924 CET600223778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:01.578135967 CET377860022185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:01.578186035 CET600223778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:01.578730106 CET600223778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:01.583389044 CET377860022185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:01.583431959 CET600223778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:01.588131905 CET377860022185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:02.275636911 CET377860022185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:02.275814056 CET600223778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:02.275815010 CET600223778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:02.276160002 CET600243778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:02.280854940 CET377860024185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:02.280905008 CET600243778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:02.281462908 CET600243778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:02.286108017 CET377860024185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:02.286148071 CET600243778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:02.290782928 CET377860024185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.007903099 CET377860024185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.008071899 CET600243778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.008071899 CET600243778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.008449078 CET600263778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.013092995 CET377860026185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.013138056 CET600263778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.013698101 CET600263778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.018381119 CET377860026185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.018429041 CET600263778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.023066044 CET377860026185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.752506971 CET377860026185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.752661943 CET600263778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.752662897 CET600263778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.753041029 CET600283778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.757711887 CET377860028185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.757764101 CET600283778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.758315086 CET600283778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.762996912 CET377860028185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:03.763041973 CET600283778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:03.767688990 CET377860028185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:04.456245899 CET377860028185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:04.456331015 CET600283778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:04.456331015 CET600283778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:04.456660032 CET600303778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:04.461359978 CET377860030185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:04.461396933 CET600303778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:04.461894035 CET600303778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:04.466519117 CET377860030185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:04.466566086 CET600303778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:04.471215963 CET377860030185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.189089060 CET377860030185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.189171076 CET600303778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.189199924 CET600303778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.189610004 CET600323778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.194431067 CET377860032185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.194483042 CET600323778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.194978952 CET600323778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.199650049 CET377860032185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.199687004 CET600323778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.204335928 CET377860032185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.901027918 CET377860032185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.901123047 CET600323778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.901216984 CET600323778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.901859999 CET600343778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.906564951 CET377860034185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.906616926 CET600343778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.907361031 CET600343778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.912014008 CET377860034185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:05.912056923 CET600343778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:05.916774988 CET377860034185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:06.602165937 CET377860034185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:06.602252960 CET600343778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:06.602282047 CET600343778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:06.602674961 CET600363778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:06.608536959 CET377860036185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:06.608587027 CET600363778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:06.609190941 CET600363778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:06.615803003 CET377860036185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:06.615844965 CET600363778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:06.621632099 CET377860036185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:07.329050064 CET377860036185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:07.329149961 CET600363778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:07.329193115 CET600363778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:07.329763889 CET600383778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:07.334472895 CET377860038185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:07.334561110 CET600383778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:07.335248947 CET600383778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:07.339900970 CET377860038185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:07.339943886 CET600383778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:07.344635010 CET377860038185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.052066088 CET377860038185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.052184105 CET600383778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.052223921 CET600383778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.052686930 CET600403778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.057403088 CET377860040185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.057459116 CET600403778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.057977915 CET600403778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.062630892 CET377860040185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.062671900 CET600403778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.067442894 CET377860040185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.767848969 CET377860040185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.767935991 CET600403778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.767968893 CET600403778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.768347979 CET600423778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.773009062 CET377860042185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.773057938 CET600423778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.773585081 CET600423778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.778219938 CET377860042185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:08.778260946 CET600423778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:08.782934904 CET377860042185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:09.501887083 CET377860042185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:09.501970053 CET600423778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:09.502001047 CET600423778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:09.502396107 CET600443778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:09.507148981 CET377860044185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:09.507203102 CET600443778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:09.507733107 CET600443778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:09.512408018 CET377860044185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:09.512455940 CET600443778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:09.517092943 CET377860044185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.217300892 CET377860044185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.217400074 CET600443778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.217436075 CET600443778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.217856884 CET600463778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.222517967 CET377860046185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.222563982 CET600463778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.223082066 CET600463778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.227709055 CET377860046185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.227749109 CET600463778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.232397079 CET377860046185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.940849066 CET377860046185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.940994978 CET600463778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.941040039 CET600463778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.941510916 CET600483778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.946263075 CET377860048185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.946315050 CET600483778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.946850061 CET600483778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.951529026 CET377860048185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:10.951569080 CET600483778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:10.957655907 CET377860048185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:11.674091101 CET377860048185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:11.674292088 CET600483778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:11.674292088 CET600483778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:11.674688101 CET600503778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:11.679375887 CET377860050185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:11.679426908 CET600503778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:11.679968119 CET600503778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:11.684616089 CET377860050185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:11.684658051 CET600503778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:11.689276934 CET377860050185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:12.392381907 CET377860050185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:12.392622948 CET600503778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:12.392622948 CET600503778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:12.393037081 CET600523778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:12.397747040 CET377860052185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:12.397799015 CET600523778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:12.398318052 CET600523778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:12.403012991 CET377860052185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:12.403064013 CET600523778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:12.407754898 CET377860052185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.130455017 CET377860052185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.130680084 CET600523778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.130680084 CET600523778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.131166935 CET600543778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.135859966 CET377860054185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.135909081 CET600543778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.137506008 CET600543778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.142200947 CET377860054185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.142245054 CET600543778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.146970034 CET377860054185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.835556984 CET377860054185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.835658073 CET600543778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.835733891 CET600543778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.836163998 CET600563778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.840924025 CET377860056185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.840976954 CET600563778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.841726065 CET600563778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.846354961 CET377860056185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:13.846395969 CET600563778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:13.851069927 CET377860056185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:14.546267986 CET377860056185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:14.546365023 CET600563778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:14.546400070 CET600563778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:14.546848059 CET600583778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:14.551479101 CET377860058185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:14.551532030 CET600583778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:14.552092075 CET600583778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:14.556698084 CET377860058185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:14.556735039 CET600583778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:14.561343908 CET377860058185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.252620935 CET377860058185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.252708912 CET600583778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.252783060 CET600583778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.253417015 CET600603778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.258085012 CET377860060185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.258160114 CET600603778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.258929968 CET600603778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.263586998 CET377860060185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.263648033 CET600603778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.268254995 CET377860060185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.962217093 CET377860060185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.962490082 CET600603778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.962555885 CET600603778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.963150978 CET600623778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.967819929 CET377860062185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.967891932 CET600623778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.968624115 CET600623778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.973267078 CET377860062185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:15.973320007 CET600623778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:15.977945089 CET377860062185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:16.698781967 CET377860062185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:16.698878050 CET600623778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:16.698904991 CET600623778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:16.699457884 CET600643778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:16.704071999 CET377860064185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:16.704118967 CET600643778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:16.704749107 CET600643778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:16.709408998 CET377860064185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:16.709441900 CET600643778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:16.714092016 CET377860064185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:17.433341026 CET377860064185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:17.433480978 CET600643778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:17.433567047 CET600643778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:17.434189081 CET600663778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:17.438896894 CET377860066185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:17.438970089 CET600663778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:17.439718008 CET600663778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:17.444298983 CET377860066185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:17.444360018 CET600663778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:17.449048042 CET377860066185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.158082962 CET377860066185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.158217907 CET600663778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.158252001 CET600663778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.158745050 CET600683778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.163510084 CET377860068185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.163568974 CET600683778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.164150953 CET600683778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.168833971 CET377860068185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.168879986 CET600683778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.173491955 CET377860068185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.857937098 CET377860068185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.858063936 CET600683778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.858063936 CET600683778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.858493090 CET600703778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.863132954 CET377860070185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.863184929 CET600703778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.863737106 CET600703778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.868407965 CET377860070185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:18.868448019 CET600703778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:18.873112917 CET377860070185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:19.572644949 CET377860070185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:19.572853088 CET600703778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:19.572853088 CET600703778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:19.573343039 CET600723778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:19.578130007 CET377860072185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:19.578236103 CET600723778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:19.578983068 CET600723778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:19.583606958 CET377860072185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:19.583667040 CET600723778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:19.588380098 CET377860072185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:20.295772076 CET377860072185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:20.295874119 CET600723778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:20.295897961 CET600723778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:20.296287060 CET600743778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:20.300977945 CET377860074185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:20.301031113 CET600743778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:20.301568031 CET600743778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:20.306212902 CET377860074185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:20.306255102 CET600743778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:20.311453104 CET377860074185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.022550106 CET377860074185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.022818089 CET600743778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.022818089 CET600743778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.023384094 CET600763778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.028048992 CET377860076185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.028100014 CET600763778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.028841019 CET600763778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.033565044 CET377860076185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.033610106 CET600763778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.038333893 CET377860076185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.745563030 CET377860076185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.745776892 CET600763778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.745776892 CET600763778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.746262074 CET600783778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.751399040 CET377860078185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.751480103 CET600783778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.752176046 CET600783778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.756784916 CET377860078185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:21.756824017 CET600783778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:21.761464119 CET377860078185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:22.451021910 CET377860078185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:22.451159000 CET600783778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:22.451198101 CET600783778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:22.451747894 CET600803778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:22.456449986 CET377860080185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:22.456528902 CET600803778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:22.457273006 CET600803778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:22.461955070 CET377860080185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:22.462080956 CET600803778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:22.466701031 CET377860080185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.172115088 CET377860080185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.172224045 CET600803778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.172281027 CET600803778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.172724009 CET600823778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.177792072 CET377860082185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.177860975 CET600823778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.178589106 CET600823778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.183331966 CET377860082185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.183387995 CET600823778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.188291073 CET377860082185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.883594990 CET377860082185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.883872986 CET600823778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.883949041 CET600823778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.884519100 CET600843778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.889252901 CET377860084185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.889312983 CET600843778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.890053988 CET600843778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.894660950 CET377860084185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:23.894706964 CET600843778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:23.899533987 CET377860084185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:24.586344004 CET377860084185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:24.586469889 CET600843778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:24.586469889 CET600843778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:24.586935043 CET600863778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:24.592428923 CET377860086185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:24.592477083 CET600863778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:24.593069077 CET600863778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:24.599101067 CET377860086185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:24.599143982 CET600863778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:24.605232000 CET377860086185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:25.306648016 CET377860086185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:25.306729078 CET600863778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:25.306756973 CET600863778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:25.307190895 CET600883778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:25.311880112 CET377860088185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:25.311933041 CET600883778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:25.312551022 CET600883778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:25.317269087 CET377860088185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:25.317313910 CET600883778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:25.321940899 CET377860088185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.017118931 CET377860088185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.017241001 CET600883778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.017324924 CET600883778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.017889977 CET600903778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.022531033 CET377860090185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.022607088 CET600903778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.023361921 CET600903778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.028021097 CET377860090185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.028075933 CET600903778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.032777071 CET377860090185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.729068995 CET377860090185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.729170084 CET600903778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.729186058 CET600903778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.729578972 CET600923778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.734217882 CET377860092185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.734271049 CET600923778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.734800100 CET600923778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.739487886 CET377860092185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:26.739530087 CET600923778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:26.744167089 CET377860092185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:27.450784922 CET377860092185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:27.450881958 CET600923778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:27.450907946 CET600923778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:27.451308012 CET600943778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:27.456016064 CET377860094185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:27.456060886 CET600943778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:27.456619024 CET600943778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:27.463325024 CET377860094185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:27.463363886 CET600943778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:27.468676090 CET377860094185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.163537979 CET377860094185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.163624048 CET600943778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.163677931 CET600943778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.164218903 CET600963778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.171072006 CET377860096185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.171144009 CET600963778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.171895981 CET600963778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.178795099 CET377860096185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.178853989 CET600963778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.185439110 CET377860096185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.883590937 CET377860096185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.883694887 CET600963778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.883723021 CET600963778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.884100914 CET600983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.888817072 CET377860098185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.888863087 CET600983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.889378071 CET600983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.894083023 CET377860098185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:28.894124985 CET600983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:28.898929119 CET377860098185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:29.615709066 CET377860098185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:29.615813971 CET600983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:29.615852118 CET600983778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:29.616311073 CET601003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:29.621068001 CET377860100185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:29.621117115 CET601003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:29.621886969 CET601003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:29.626486063 CET377860100185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:29.626526117 CET601003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:29.631167889 CET377860100185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:30.339293003 CET377860100185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:30.339478016 CET601003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:30.339478016 CET601003778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:30.339869022 CET601023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:30.344530106 CET377860102185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:30.344574928 CET601023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:30.345119953 CET601023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:30.349737883 CET377860102185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:30.349771976 CET601023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:30.354501963 CET377860102185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.059902906 CET377860102185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.059981108 CET601023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.060005903 CET601023778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.060420036 CET601043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.065105915 CET377860104185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.065195084 CET601043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.065845013 CET601043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.070492029 CET377860104185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.070560932 CET601043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.075282097 CET377860104185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.771575928 CET377860104185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.771729946 CET601043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.771773100 CET601043778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.772228003 CET601063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.776977062 CET377860106185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.777028084 CET601063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.777605057 CET601063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.782294989 CET377860106185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:31.782340050 CET601063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:31.786986113 CET377860106185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:32.498857975 CET377860106185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:32.498946905 CET601063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:32.498960972 CET601063778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:32.499346018 CET601083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:32.503958941 CET377860108185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:32.504091978 CET601083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:32.504702091 CET601083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:32.509344101 CET377860108185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:32.509386063 CET601083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:32.514055967 CET377860108185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.222579002 CET377860108185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.222661972 CET601083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.222697020 CET601083778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.223153114 CET601103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.227814913 CET377860110185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.227863073 CET601103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.228409052 CET601103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.233066082 CET377860110185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.233104944 CET601103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.237741947 CET377860110185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.936630964 CET377860110185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.936709881 CET601103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.936729908 CET601103778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.937242985 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.941952944 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.942008018 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.942569017 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.947206020 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:33.947254896 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:33.951875925 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:43.949779987 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:42:43.954483032 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:44.181037903 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:42:44.181133986 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:43:44.212342024 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:43:44.217272043 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:43:44.444494963 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:43:44.444629908 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:44:44.479064941 CET601123778192.168.2.15185.113.223.63
          Mar 17, 2025 02:44:44.483819962 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:44:44.709742069 CET377860112185.113.223.63192.168.2.15
          Mar 17, 2025 02:44:44.710031986 CET601123778192.168.2.15185.113.223.63
          TimestampSource PortDest PortSource IPDest IP
          Mar 17, 2025 02:44:39.157322884 CET4548553192.168.2.151.1.1.1
          Mar 17, 2025 02:44:39.157371998 CET5365653192.168.2.151.1.1.1
          Mar 17, 2025 02:44:39.164047956 CET53536561.1.1.1192.168.2.15
          Mar 17, 2025 02:44:39.164885044 CET53454851.1.1.1192.168.2.15
          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          Mar 17, 2025 02:44:39.157322884 CET192.168.2.151.1.1.10x80cStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
          Mar 17, 2025 02:44:39.157371998 CET192.168.2.151.1.1.10xd455Standard query (0)daisy.ubuntu.com28IN (0x0001)false
          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          Mar 17, 2025 02:44:39.164885044 CET1.1.1.1192.168.2.150x80cNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
          Mar 17, 2025 02:44:39.164885044 CET1.1.1.1192.168.2.150x80cNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

          System Behavior

          Start time (UTC):01:41:51
          Start date (UTC):17/03/2025
          Path:/tmp/boatnet.spc.elf
          Arguments:/tmp/boatnet.spc.elf
          File size:4379400 bytes
          MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

          Start time (UTC):01:41:51
          Start date (UTC):17/03/2025
          Path:/tmp/boatnet.spc.elf
          Arguments:-
          File size:4379400 bytes
          MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

          Start time (UTC):01:41:51
          Start date (UTC):17/03/2025
          Path:/tmp/boatnet.spc.elf
          Arguments:-
          File size:4379400 bytes
          MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

          Start time (UTC):01:41:51
          Start date (UTC):17/03/2025
          Path:/tmp/boatnet.spc.elf
          Arguments:-
          File size:4379400 bytes
          MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/bin/xfce4-panel
          Arguments:-
          File size:375768 bytes
          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

          Start time (UTC):01:41:52
          Start date (UTC):17/03/2025
          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
          File size:35136 bytes
          MD5 hash:ac0b8a906f359a8ae102244738682e76