Edit tour

Linux Analysis Report
rrrdsl.elf

Overview

General Information

Sample name:	rrrdsl.elf
Analysis ID:	1646111
MD5:	ce3f8985258e149cc22289c50faac938
SHA1:	8fb739e6b9268a3391819bb213e47c88f60378cd
SHA256:	81e8a6a027ef122e596d7711970ce01f2b74b53be750a13050cc749da6a80b68
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646111
Start date and time:	2025-03-23 10:43:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	rrrdsl.elf
Detection:	MAL
Classification:	mal64.spre.evad.linELF@0/5@4/0

Runtime Messages

Command:	/tmp/rrrdsl.elf
PID:	6271
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

rrrdsl.elf (PID: 6271, Parent: 6195, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/rrrdsl.elf

rrrdsl.elf New Fork (PID: 6273, Parent: 6271)

rrrdsl.elf New Fork (PID: 6275, Parent: 6273)

rrrdsl.elf New Fork (PID: 6276, Parent: 6273)

xfce4-panel New Fork (PID: 6281, Parent: 2063)

wrapper-2.0 (PID: 6281, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6284, Parent: 2063)

wrapper-2.0 (PID: 6284, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

dbus-daemon New Fork (PID: 6286, Parent: 6285)

xfconfd (PID: 6286, Parent: 6285, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

xfce4-panel New Fork (PID: 6290, Parent: 2063)

wrapper-2.0 (PID: 6290, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6293, Parent: 2063)

wrapper-2.0 (PID: 6293, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6310, Parent: 6293)

xfpm-power-backlight-helper (PID: 6310, Parent: 6293, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6299, Parent: 2063)

wrapper-2.0 (PID: 6299, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6303, Parent: 2063)

wrapper-2.0 (PID: 6303, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 6317, Parent: 1860)

xfce4-notifyd (PID: 6317, Parent: 1860, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

gnome-session-binary New Fork (PID: 6378, Parent: 1477)

sh (PID: 6378, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6378, Parent: 1477, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6380, Parent: 1477)

sh (PID: 6380, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6382, Parent: 1477)

sh (PID: 6382, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6383, Parent: 1477)

sh (PID: 6383, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

dbus-daemon New Fork (PID: 6386, Parent: 6385)

xfconfd (PID: 6386, Parent: 6385, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

gdm3 New Fork (PID: 6387, Parent: 1320)

Default (PID: 6387, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6388, Parent: 1320)

Default (PID: 6388, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

dash New Fork (PID: 6412, Parent: 4332)

rm (PID: 6412, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.up366WRCei /tmp/tmp.Vn5eq1nHfO /tmp/tmp.Lq9fDSsJtb

dash New Fork (PID: 6413, Parent: 4332)

rm (PID: 6413, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.up366WRCei /tmp/tmp.Vn5eq1nHfO /tmp/tmp.Lq9fDSsJtb

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: rrrdsl.elf	Virustotal: Detection: 37%			Perma Link
Source: rrrdsl.elf	ReversingLabs: Detection: 50%

Source: global traffic

TCP traffic: 192.168.2.23:41918 -> 141.98.10.142:2211

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:39258 -> 34.249.145.219:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: raw.awaken-network.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39258 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6293, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6303, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6317, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 774, result: no such process	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior

Source: xfce4-panel.xml.new.21.dr

OLE indicator, VBA macros: true

Source: xfce4-panel.xml.new.21.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6293, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6303, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 6317, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 774, result: no such process	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior

Source: classification engine

Classification label: mal64.spre.evad.linELF@0/5@4/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/rrrdsl.elf (PID: 6276)

Deleted: /dev/kmsg

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6286)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6286)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6286)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6286)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6290)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6293)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6317)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6317)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6317)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6317)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6386)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6386)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6386)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6386)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/6105/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/912/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/918/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1594/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/121/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1349/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/122/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/243/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/123/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/2/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/124/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/3/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/4/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/125/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/126/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1344/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 6275)	File opened: /proc/1344/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6412)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.up366WRCei /tmp/tmp.Vn5eq1nHfO /tmp/tmp.Lq9fDSsJtb			Jump to behavior
Source: /usr/bin/dash (PID: 6413)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.up366WRCei /tmp/tmp.Vn5eq1nHfO /tmp/tmp.Lq9fDSsJtb			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/rrrdsl.elf (PID: 6276)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/rrrdsl.elf (PID: 6273)

File: /tmp/rrrdsl.elf

Jump to behavior

Source: /tmp/rrrdsl.elf (PID: 6271)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6290)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6293)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6303)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6317)	Queries kernel information via 'uname':	Jump to behavior

Source: rrrdsl.elf, 6276.1.00007f955c473000.00007f955c481000.rw-.sdmp	Binary or memory string: H$/tmp/vmware-root_721-4290559889(
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: /var/lib/vmware4/var/lib/PackageKit
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStoreH
Source: rrrdsl.elf, 6271.1.000055ea7b9f3000.000055ea7ba7a000.rw-.sdmp, rrrdsl.elf, 6276.1.000055ea7b9f3000.000055ea7ba7a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: dH(/var/lib/vmware/VGAuth/aliasStoreH
Source: rrrdsl.elf, 6276.1.000055ea7b9f3000.000055ea7ba7a000.rw-.sdmp	Binary or memory string: U!/var/lib/vmware
Source: rrrdsl.elf, 6276.1.000055ea7ba7a000.000055ea7ba9d000.rw-.sdmp	Binary or memory string: vmware/V!
Source: rrrdsl.elf, 6271.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp, rrrdsl.elf, 6276.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: rrrdsl.elf, 6276.1.000055ea7b9f3000.000055ea7ba7a000.rw-.sdmp	Binary or memory string: U1/tmp/vmware-root_721-4290559889P
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: rrrdsl.elf, 6276.1.000055ea7b9f3000.000055ea7ba7a000.rw-.sdmp	Binary or memory string: U!/var/lib/vmware/VGAuth
Source: rrrdsl.elf, 6276.1.000055ea7ba7a000.000055ea7ba9d000.rw-.sdmp	Binary or memory string: ar/lib/vmware/V!
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: 3HT/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/tmpX/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp$/tmp/vmware-root_721-4290559889P/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i4/tmp/snap.lxdH
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth4/var/lib/NetworkManager`!H4
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: rrrdsl.elf, 6271.1.000055ea7b9f3000.000055ea7ba7a000.rw-.sdmp, rrrdsl.elf, 6276.1.000055ea7b9f3000.000055ea7ba7a000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: rrrdsl.elf, 6271.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.4a7g5o\
Source: rrrdsl.elf, 6276.1.000055ea7ba7a000.000055ea7ba9d000.rw-.sdmp	Binary or memory string: 1/var/lib/command-not-found1/var/lib/update-notifier/user.dvmware/V!/dev/vfio 1/var/lib/vmware/VGAuth/aliasStoreupd1/var/lib/cloud/instancesar/lib/vmware/V!/dev/net !/var/lib/grub/esp1/var/lib/fwupd/gnupg/private-keys-v1.dQ/var/lib/systemd/deb-systemd-helper-enabled/cloud-init.target.wantsluetQ/var/lib/systemd/deb-systemd-helper-enabled/rescue.target.wantsed/cloud1/var/lib/systemd/timesyncr/lib/fwupd/pk!
Source: rrrdsl.elf, 6271.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp, rrrdsl.elf, 6276.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/rrrdsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/rrrdsl.elf
Source: rrrdsl.elf, 6276.1.00007f955c481000.00007f955c68e000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: rrrdsl.elf, 6271.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp, rrrdsl.elf, 6276.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: rrrdsl.elf, 6271.1.00007ffd8b78e000.00007ffd8b7af000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.4a7g5o

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rrrdsl.elf	38%	Virustotal		Browse
rrrdsl.elf	50%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
141.98.10.142	raw.awaken-network.net	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	morte.ppc.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	sync.powerpc.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
141.98.10.142	eehah4.elf	Get hash	malicious	Unknown	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	jfeeps.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.42	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	drea4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	pdVpRWPKwS.ps1	Get hash	malicious	Conti	Browse	185.125.189.229
	4JeAr66776.ps1	Get hash	malicious	Conti	Browse	185.125.189.228
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
HOSTBALTICLT	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	drea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
INIT7CH	drea4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
AMAZON-02US	drea4.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Download File

Process:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5128
Entropy (8bit):	4.457618060812407
Encrypted:	false
SSDEEP:	96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
MD5:	2A2A7C34B585CDAE5E123F3C5100C253
SHA1:	E814B1B1531B25581DB76CB813C85E53E1390BA4
SHA-256:	BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
SHA-512:	CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in

/proc/6271/task/6271/comm

Download File

Process:	/tmp/rrrdsl.elf
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:I:I
MD5:	336D5EBC5436534E61D16E63DDFCA327
SHA1:	3BC15C8AAE3E4124DD409035F32EA2FD6835EFC9
SHA-256:	3973E022E93220F9212C18D0D0C543AE7C309E46640DA93A4A0314DE999F5112
SHA-512:	7C0B0D99A6E4C33CDA0F6F63547F878F4DD9F486DFE5D0446CE004B1C0FF28F191FF86F5D5933D3614CCEEE6FBBDC17E658881D3A164DFA5D6F4C699B2126E3D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	-

/tmp/qemu-open.4a7g5o (deleted)

Download File

Process:	/tmp/rrrdsl.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.8731406795131327
Encrypted:	false
SSDEEP:	3:TgxWO8HJN:Tg2JN
MD5:	94BB3F3C4E316B1BFDA0789F3F4CCF1C
SHA1:	D30AE36DEDF23C1003471DDF03ABD529AFD78DC7
SHA-256:	A6E654A189D43F2ECD936B290B0E3816BA80B39599736442E886809BA05E966E
SHA-512:	3C3B3C7F3B4BEF3B52972823D6BDD1EF1E4E29A8A88851A681ECFCF5D26E3056ACFD1332D91E44F2E2ADFA4A9D4E863A1AB64E0087D50F646C813BE04D9FD294
Malicious:	false
Reputation:	low
Preview:	/tmp/rrrdsl.elf.nwlrbbmqbh

/tmp/qemu-open.AAk42n (deleted)

Download File

Process:	/tmp/rrrdsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.5792232105089465
Encrypted:	false
SSDEEP:	3:2ugXhW7BdSQhVvo/FNvN:YX+WGA/1
MD5:	6014D875995D1AC466704A4C1DC39EBE
SHA1:	788D78BE11878A58750D68D68BF364F6F085A279
SHA-256:	00AC1DCAD7CE0483676534674F902EC2625E8697DAFBFAA2A05AE7E7CA1546A9
SHA-512:	F4366B3FD23BCEC688A753B29A684E21CA6A721C8D83A8084345F9C2B35E8E0E838BC85BA697207D91174636113C41D6C9BBF6829FBB24FB7D684F677A88AB0A
Malicious:	false
Reputation:	low
Preview:	6271 (/tmp/rrrdsl.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2147483056 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.- (0) S 0 0 0 0 0 0 0 0 0 0 0 0 0 0

/tmp/qemu-open.Vk8aCm (deleted)

Download File

Process:	/tmp/rrrdsl.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4548223999466066
Encrypted:	false
SSDEEP:	3:TgxWgn:Tgp
MD5:	F45CC7E78FB5617F878C634E2885244A
SHA1:	7F497D824D12411C2F761F4C0373E2B0219A04F2
SHA-256:	D1ABE99F1E1720A73437D51722ECFB9E22ABDA8565F245FD6E1811BEE4AB2A42
SHA-512:	0D76AFC2AFE7FA666C4DF98903E70DFC935E7B9F55CE0657FE182324320E1AAA18E7746BAEE33D1166519EAB66F050964CF84F29E758A4B192A5FADB7A43F1FC
Malicious:	false
Reputation:	low
Preview:	/tmp/rrrdsl.elf..

Static File Info

General

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.043318945837652
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	rrrdsl.elf
File size:	208'448 bytes
MD5:	ce3f8985258e149cc22289c50faac938
SHA1:	8fb739e6b9268a3391819bb213e47c88f60378cd
SHA256:	81e8a6a027ef122e596d7711970ce01f2b74b53be750a13050cc749da6a80b68
SHA512:	16cd4fcfdd85f5986b54bc20ceb5dd5c1b78886520a2012b43835c004a71990e82b3fb255ba78bb359632244b9b3697811beaf6705c66f50ac7548ce632413f9
SSDEEP:	6144:J4Tc0VDsMHq+16O308PrZsHxRms8iC9hYwvDlM:eTcuDsMHq+sSbPryRRNJC/vDS
TLSH:	E214D819AB520EFBDCAFCE3706E9070629CC641722A43B3A3674D918F54B54B59E3C78
File Content Preview:	.ELF....................`.@.4....,......4. ...(...............@...@...........................F...F..X.., ..........Q.td...............................<...'!......'.......................<h..'!... .........9'.. ........................<8..'!.............9

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	207888
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x29500	0x0	0x6	AX	16
.fini	PROGBITS	0x429620	0x29620	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x429680	0x29680	0x3c40	0x0	0x2	A	16
.ctors	PROGBITS	0x46d2c4	0x2d2c4	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x46d2d0	0x2d2d0	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x46d2dc	0x2d2dc	0x4a4	0x0	0x3	WA	4
.data	PROGBITS	0x46d780	0x2d780	0x49b0	0x0	0x3	WA	32
.got	PROGBITS	0x472130	0x32130	0xa7c	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x472bac	0x32bac	0x50	0x0	0x10000003	WAp	4
.bss	NOBITS	0x472c00	0x32bac	0xc6f0	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x139e	0x32bac	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x32bac	0x64	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x2d2c0	0x2d2c0	5.3469	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x2d2c4	0x46d2c4	0x46d2c4	0x58e8	0x1202c	1.4662	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 549
• 7733 undefined
• 2211 undefined
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 23, 2025 10:45:16.808562994 CET	43928	443	192.168.2.23	91.189.91.42
Mar 23, 2025 10:45:17.366919994 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:17.602174044 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:17.602260113 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:17.604842901 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:17.795634985 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:17.795732021 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:17.976490021 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:18.007003069 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:18.163470030 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:18.163942099 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:18.984231949 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:19.171152115 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:19.171329021 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:19.174650908 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:19.186597109 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:19.363195896 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:19.375119925 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:19.375189066 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:20.200083971 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:20.387227058 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:20.387306929 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:20.390008926 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:20.403604031 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:20.577070951 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:20.594295025 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:20.594350100 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:21.415908098 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:21.415920973 CET	39258	443	192.168.2.23	34.249.145.219
Mar 23, 2025 10:45:21.607201099 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:21.607289076 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:21.619951963 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:21.640369892 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:21.655217886 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:21.655301094 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:21.807729006 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:21.827507019 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:21.827661037 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:22.663788080 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:22.876657963 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:22.876740932 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:22.881933928 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:22.901597977 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:23.106167078 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:23.132885933 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:23.132952929 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:23.911554098 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:24.108234882 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:24.108330011 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:24.112786055 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:24.130002022 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:24.300815105 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:24.316785097 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:24.316853046 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:25.159379005 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:25.346296072 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:25.346513033 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:25.359469891 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:25.382633924 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:25.546545982 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:25.590562105 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:25.590645075 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:26.407191038 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:26.617566109 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:26.617643118 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:26.632164001 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:26.657774925 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:26.856456041 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:26.882806063 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:26.882992983 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:27.687589884 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:27.877835989 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:27.877924919 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:27.894354105 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:27.937463045 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:28.098556995 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:28.166837931 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:28.166912079 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:28.966849089 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:29.198853016 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:29.198931932 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:29.207757950 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:29.299619913 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:29.432132959 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:29.486115932 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:29.486473083 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:30.310659885 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:30.497370958 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:30.497473001 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:30.509037971 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:30.570022106 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:30.695590019 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:30.779774904 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:30.779866934 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:31.398540974 CET	42516	80	192.168.2.23	109.202.202.202
Mar 23, 2025 10:45:31.590488911 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:31.800472021 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:31.800595045 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:31.810700893 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:31.847656012 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:32.021641016 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:32.055887938 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:32.056057930 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:32.870302916 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:32.991157055 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:32.991247892 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:33.059340000 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:33.059406042 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:33.064327955 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:33.079344034 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:33.266743898 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:33.266798973 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:33.270390034 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:34.086189032 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:34.273077965 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:34.273138046 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:34.279520988 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:34.319000959 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:34.454166889 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:34.454210043 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:34.468777895 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:34.509083986 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:34.509439945 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:35.334057093 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:35.522154093 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:35.522248030 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:35.530307055 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:35.565821886 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:35.717341900 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:35.734127998 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:35.734215021 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:35.787646055 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:35.787714005 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:36.581799984 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:36.789355040 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:36.789418936 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:36.793467999 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:36.822354078 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:37.010754108 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:37.010896921 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:37.014782906 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:37.051563025 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:37.051650047 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:37.541676998 CET	39258	443	192.168.2.23	34.249.145.219
Mar 23, 2025 10:45:37.541732073 CET	43928	443	192.168.2.23	91.189.91.42
Mar 23, 2025 10:45:37.829677105 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:38.028696060 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:38.028990984 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:38.030489922 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:38.032583952 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:38.220083952 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:38.220477104 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:38.220570087 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:38.301569939 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:38.301843882 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:39.045517921 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:39.244626045 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:39.244820118 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:39.246570110 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:39.251087904 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:39.341342926 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:39.341433048 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:39.450376034 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:39.450510979 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:39.458004951 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:40.261303902 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:40.449084044 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:40.449248075 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:40.450742006 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:40.598102093 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:40.598171949 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:40.637590885 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:41.382286072 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:41.585675001 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:41.585783958 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:41.587713003 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:41.706387997 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:41.790873051 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:41.878312111 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:41.878454924 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:41.896678925 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:41.896787882 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:42.725192070 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:42.911798000 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:42.911941051 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:42.913399935 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:42.915143013 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:43.099757910 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:43.104443073 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:43.104592085 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:43.180345058 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:43.180444002 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:43.940835953 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:44.132443905 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:44.132647991 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:44.133985996 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:44.135564089 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:44.321193933 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:44.356787920 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:44.356935978 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:44.444629908 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:44.444804907 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:45.156701088 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:45.354021072 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:45.354151964 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:45.355436087 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:45.357119083 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:45.544090986 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:45.544219971 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:45.583694935 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:45.718170881 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:45.718462944 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:46.372484922 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:46.559482098 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:46.559631109 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:46.562108040 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:46.566020966 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:46.749032021 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:46.787955046 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:46.788045883 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:47.022730112 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:47.022994041 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:47.588336945 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:47.778265953 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:47.778482914 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:47.779808044 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:47.781900883 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:47.967158079 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:47.969419956 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:47.969635010 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:48.186688900 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:48.186901093 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:48.278302908 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:48.278403997 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:48.804270029 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:49.011154890 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:49.011342049 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:49.012882948 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:49.014842033 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:49.203608990 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:49.203723907 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:49.226347923 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:49.557843924 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:49.558079004 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:49.643220901 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:49.643407106 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:50.020196915 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:50.208044052 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:50.208286047 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:50.209425926 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:50.211059093 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:50.397576094 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:50.398422003 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:50.398547888 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:50.839200020 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:50.839598894 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:50.923966885 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:50.924082994 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:51.235867023 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:51.422575951 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:51.422724962 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:51.424748898 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:51.427191019 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:51.612874031 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:51.658170938 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:51.658328056 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:52.158068895 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:52.158396959 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:52.271608114 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:52.271883965 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:52.451771975 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:53.397742033 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:53.397962093 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:53.515414953 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:53.515630007 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:53.680838108 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:53.681170940 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:53.682805061 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:53.685153008 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:53.872934103 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:53.873099089 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:53.910686016 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:54.558499098 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:54.558707952 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:54.677887917 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:54.677988052 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:54.691323996 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:54.880516052 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:54.880698919 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:54.882483959 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:54.884757042 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:55.069699049 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:55.071777105 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:55.071903944 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:55.702063084 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:55.702290058 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:55.786021948 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:55.786279917 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:55.907207966 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:56.093779087 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:56.093900919 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:56.095818996 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:56.098121881 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:56.282407999 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:56.284908056 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:56.285171986 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:57.011293888 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:57.011562109 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:57.108632088 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:57.108995914 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:57.122972012 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:57.309542894 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:57.309736013 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:57.311424971 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:57.313561916 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:57.498207092 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:57.535425901 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:57.535564899 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.263768911 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:58.263917923 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.338814020 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.394522905 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:58.394650936 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.556179047 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:58.556405067 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.558165073 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.560772896 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.748836040 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:58.748915911 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:58.771311998 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:59.542589903 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:59.542901039 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:59.586771965 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:59.634792089 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:59.635077953 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:59.773560047 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:59.773791075 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:59.776354074 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:59.779320955 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:59.799356937 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:45:59.799422026 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:45:59.963745117 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:00.567513943 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:00.567742109 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:00.802555084 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:00.907037020 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:00.907176971 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:00.991379023 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:00.991462946 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:00.994040012 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:00.997306108 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:01.180510998 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:01.184303045 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:01.184495926 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:01.845866919 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:01.846184015 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:02.018419027 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:02.205375910 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:02.205756903 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:02.207648993 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:02.210297108 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:02.211803913 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:02.211987019 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:02.396245956 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:02.399000883 CET	7733	50710	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:02.399183989 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.133274078 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:03.133553028 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.234219074 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.383028030 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:03.383363008 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.422565937 CET	7733	50710	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:03.422837019 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.425290108 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.458121061 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.468204021 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:03.468324900 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:03.612905025 CET	7733	50710	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:03.644809961 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:03.644876003 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.406795979 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:04.406941891 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.481955051 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.669670105 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:04.669913054 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.671462059 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.709542036 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.749649048 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:04.749886036 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.834495068 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:04.834630966 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:04.858566999 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:04.897181034 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:04.897345066 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:05.429800987 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:05.429994106 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:05.729882002 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:05.918894053 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:05.919187069 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:05.920526981 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:05.922384024 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:06.030973911 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:06.031141996 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:06.108968973 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:06.109874964 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:06.109968901 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:06.113975048 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:06.114037991 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:06.710176945 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:06.710369110 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:06.945667982 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:07.132419109 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:07.132534981 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:07.134042978 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:07.135577917 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:07.328053951 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:07.357476950 CET	7733	50718	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:07.357582092 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:07.367547035 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:07.367651939 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:07.495810032 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:07.496270895 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:08.161639929 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:08.369019032 CET	7733	50718	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:08.369196892 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:08.370498896 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:08.372231960 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:08.559549093 CET	7733	50720	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:08.559716940 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:08.584867954 CET	7733	50718	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:08.585860014 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:08.585982084 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:08.706461906 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:08.706598043 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.015958071 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:09.016191959 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.377393961 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.564587116 CET	7733	50720	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:09.565155983 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.567308903 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.570149899 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.755146980 CET	7733	50720	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:09.758373022 CET	7733	50722	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:09.758616924 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.782563925 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:09.782768011 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:09.865839005 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:09.866164923 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.294157028 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:10.294341087 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.593132973 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.779799938 CET	7733	50722	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:10.780474901 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.781883955 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.783695936 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.890064955 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:10.890247107 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.968554974 CET	7733	50722	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:10.973784924 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:10.973869085 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:10.993922949 CET	7733	50724	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:10.994200945 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:11.318123102 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:11.318495035 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:11.808983088 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:12.037462950 CET	7733	50724	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:12.037631035 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:12.038883924 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:12.040360928 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:12.227206945 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:12.227329969 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:12.235224962 CET	7733	50726	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:12.235332012 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:12.237747908 CET	7733	50724	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:12.343214989 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:12.343372107 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:12.599286079 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:12.599497080 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.056824923 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.282203913 CET	7733	50726	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:13.282397032 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.283497095 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.285784006 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.453891993 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:13.454030991 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.472105026 CET	7733	50728	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:13.472212076 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.502862930 CET	7733	50726	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:13.663959980 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:13.664201021 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:13.914604902 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:13.914951086 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:14.304909945 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:14.491889954 CET	7733	50728	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:14.492270947 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:14.494009018 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:14.496365070 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:14.689445972 CET	7733	50728	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:14.692667961 CET	7733	50730	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:14.692904949 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:14.742661953 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:14.743011951 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:14.862977982 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:14.863218069 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:15.157783031 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:15.157907963 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:15.520421982 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:15.707396984 CET	7733	50730	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:15.707562923 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:15.709186077 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:15.710758924 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:15.785490036 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:15.785744905 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:15.896929979 CET	7733	50730	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:15.898443937 CET	7733	50732	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:15.898688078 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:16.098272085 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:16.098423004 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:16.182956934 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:16.183056116 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:16.736299038 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:16.923892975 CET	7733	50732	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:16.924196005 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:16.926280975 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:16.928075075 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:17.042015076 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:17.042181969 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:17.113286972 CET	7733	50732	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:17.131961107 CET	7733	50734	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:17.132090092 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:17.462007046 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:17.462297916 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:17.501158953 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:17.501255989 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:17.952192068 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.161887884 CET	7733	50734	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:18.162200928 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.164215088 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.166966915 CET	50736	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.360357046 CET	7733	50736	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:18.360507011 CET	50736	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.362864971 CET	50736	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.366080999 CET	50738	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.369132996 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:18.369288921 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.395324945 CET	7733	50734	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:18.496023893 CET	43928	443	192.168.2.23	91.189.91.42
Mar 23, 2025 10:46:18.549717903 CET	7733	50736	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:18.691696882 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:18.692024946 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:18.784615040 CET	7733	50710	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:18.784707069 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:19.391942024 CET	50738	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:19.594433069 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:19.594500065 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:19.938549995 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:19.938632965 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:20.022099018 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:20.022169113 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:20.022361994 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:20.022471905 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:20.619434118 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:20.619760036 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:21.221751928 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:21.221988916 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:21.302335024 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:21.302475929 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:21.322103024 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:21.322299004 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:21.407636881 CET	50738	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:21.897880077 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:21.899168015 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:22.581809044 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:22.581912041 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:22.610361099 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:22.610435009 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:22.712330103 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:22.712635040 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:23.648962021 CET	7733	50718	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:23.649307013 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:23.774290085 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:23.774446964 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:23.925719976 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:23.925793886 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:24.238931894 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:24.239171982 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:24.885962009 CET	7733	50720	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:24.886070013 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:24.973515987 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:24.973737955 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:25.054155111 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:25.054297924 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:25.481992960 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:25.482125998 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:25.663037062 CET	50738	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:26.078699112 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:26.079009056 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:26.167537928 CET	7733	50722	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:26.167668104 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:26.167856932 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:26.167973042 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:26.505831957 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:26.505965948 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:27.450278997 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:27.450459957 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:27.451033115 CET	7733	50724	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:27.451214075 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:27.537357092 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:27.537548065 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:27.665678024 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:27.791241884 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:27.791547060 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:27.883886099 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:28.641725063 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:28.642019987 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:28.763366938 CET	7733	50726	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:28.763762951 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:28.872405052 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:28.872518063 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:29.141292095 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:29.141581059 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:29.749810934 CET	7733	50728	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:29.749944925 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:29.933775902 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:29.934009075 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:30.079622984 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:30.079963923 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:30.346287012 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:30.346647024 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:31.003832102 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:31.004167080 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:31.029666901 CET	7733	50730	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:31.029930115 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:31.286623001 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:31.286874056 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:31.369750977 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:31.369982004 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:32.233645916 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:32.233902931 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:32.310431004 CET	7733	50732	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:32.310743093 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:32.649770975 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:32.650048971 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:32.719857931 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:32.719974995 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:33.560264111 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:33.560446024 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:33.590219975 CET	7733	50736	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:33.590389013 CET	50736	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:33.635539055 CET	7733	50734	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:33.635634899 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:33.853996992 CET	50738	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:33.890064001 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:33.890372992 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:34.016407967 CET	7733	50710	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:34.016706944 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:34.803292036 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:34.803428888 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:35.126116991 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:35.126382113 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:35.210059881 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:35.210068941 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:35.210367918 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:35.210423946 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:35.819339991 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:35.819679976 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:36.406439066 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:36.406801939 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:36.489981890 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:36.490344048 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:36.545847893 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:36.546169043 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:37.090176105 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:37.090331078 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:37.674631119 CET	41918	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:37.773761988 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:37.774055004 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:37.802364111 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:37.802592039 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:37.862489939 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:37.943423986 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:37.943690062 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:38.838543892 CET	7733	50718	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:38.839015961 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:38.966053009 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:38.966470957 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:39.114612103 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:39.114949942 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:39.476552963 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:39.476803064 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:40.077925920 CET	7733	50720	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:40.078340054 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:40.209239006 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:40.209347963 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:40.246165037 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:40.246253967 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:40.669773102 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:40.670022964 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:41.271094084 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:41.271266937 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:41.359442949 CET	7733	50722	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:41.359460115 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:41.359532118 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:41.359543085 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:41.694179058 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:41.694504976 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:42.644124031 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:42.644401073 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:42.647038937 CET	7733	50724	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:42.647281885 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:42.726229906 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:42.726372957 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:42.984404087 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:42.984731913 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:43.830629110 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:43.830864906 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:43.976598024 CET	7733	50726	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:43.976996899 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:44.122256041 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:44.122504950 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:44.368196011 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:44.368455887 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:44.937639952 CET	7733	50728	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:44.938152075 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:45.122836113 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:45.123220921 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:45.319854021 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:45.320072889 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:45.533982992 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:45.534284115 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:45.697180033 CET	2211	41918	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:46.221684933 CET	7733	50730	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:46.221961021 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:46.235311985 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:46.235411882 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:46.474303961 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:46.474476099 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:46.558562040 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:46.558717966 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:46.903362989 CET	42020	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:47.132149935 CET	2211	42020	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:47.132337093 CET	42020	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:47.133837938 CET	42020	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:47.364182949 CET	2211	42020	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:47.364365101 CET	42020	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:47.424284935 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:47.424443960 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:47.501765966 CET	7733	50732	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:47.501907110 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:47.592837095 CET	2211	42020	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:47.837877035 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:47.838002920 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:47.935542107 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:47.935777903 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:48.768625975 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:48.768987894 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:48.781761885 CET	7733	50736	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:48.781970024 CET	50736	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:49.102787018 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:49.102920055 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:49.979698896 CET	50738	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:50.030077934 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:50.030185938 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:50.313939095 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:50.314125061 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:50.397524118 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:50.397670984 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:50.402472019 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:50.402569056 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:51.010581970 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:51.010988951 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:51.598233938 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:51.598480940 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:51.682126045 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:51.682295084 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:51.808250904 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:51.808549881 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:52.278621912 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:52.278774977 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:52.961776972 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:52.962085009 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:53.061239958 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:53.061407089 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:53.145566940 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:53.145741940 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:54.112648964 CET	7733	50718	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:54.112976074 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:54.159992933 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:54.160219908 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:54.364554882 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:54.364857912 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:54.715610027 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:54.715750933 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:55.265923023 CET	7733	50720	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:55.266102076 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:55.437916040 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:55.438054085 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:55.445641041 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:55.445710897 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:55.862428904 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:55.862618923 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:56.461812973 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:56.462023020 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:56.550198078 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:56.550230026 CET	7733	50722	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:56.550332069 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:56.550343990 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:56.885952950 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:56.886204004 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:57.869445086 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:57.869566917 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:57.881570101 CET	7733	50724	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:57.881725073 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:57.941863060 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:57.942022085 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:58.173748016 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:58.173897028 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:59.018163919 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:59.018368006 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:59.235517979 CET	7733	50726	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:59.235667944 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:59.354357004 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:59.354463100 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:46:59.603885889 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:46:59.604027033 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:00.125848055 CET	7733	50728	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:00.126086950 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:00.313575983 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:00.313886881 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:00.563333988 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:00.563750982 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:00.725924969 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:00.726367950 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:01.409733057 CET	7733	50730	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:01.409869909 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:01.470318079 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:01.470379114 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:01.662517071 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:01.662791967 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:01.750277996 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:01.750617027 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:02.584988117 CET	2211	42020	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:02.585274935 CET	42020	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:02.613771915 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:02.613935947 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:02.694684029 CET	7733	50732	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:02.694971085 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:03.030602932 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:03.030792952 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:03.177480936 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:03.177723885 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:03.969708920 CET	7733	50736	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:03.969851017 CET	50736	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:04.003606081 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:04.003876925 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:04.101914883 CET	7733	50734	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:04.102128029 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:04.339616060 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:04.339819908 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:04.355981112 CET	7733	50710	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:04.356087923 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:05.236829042 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:05.237046957 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:05.505765915 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:05.506084919 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:05.590161085 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:05.590240955 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:05.590379000 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:05.590384960 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:06.202034950 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:06.202265978 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:06.787285089 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:06.787522078 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:06.870119095 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:06.870330095 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:06.998337984 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:06.998563051 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:07.470773935 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:07.470916986 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:08.150612116 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:08.150911093 CET	50716	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:08.251481056 CET	7733	50668	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:08.251707077 CET	50668	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:08.338454008 CET	7733	50644	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:08.338862896 CET	50644	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:09.315634966 CET	7733	50718	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:09.315783024 CET	50718	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:09.351908922 CET	7733	50670	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:09.351979017 CET	50670	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:09.554639101 CET	7733	50646	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:09.554766893 CET	50646	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:09.906331062 CET	7733	50694	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:09.906603098 CET	50694	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:10.453845978 CET	7733	50720	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:10.453944921 CET	50720	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:10.626405001 CET	7733	50672	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:10.626581907 CET	50672	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:10.659768105 CET	7733	50648	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:10.659885883 CET	50648	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:11.049968958 CET	7733	50696	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:11.050136089 CET	50696	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:11.649775982 CET	7733	50674	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:11.649909973 CET	50674	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:11.734626055 CET	7733	50722	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:11.734812021 CET	7733	50650	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:11.734899998 CET	50722	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:11.734911919 CET	50650	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:12.074292898 CET	7733	50698	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:12.074415922 CET	50698	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:13.095417023 CET	7733	50676	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:13.095594883 CET	50676	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:13.127785921 CET	7733	50724	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:13.127870083 CET	50724	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:13.163358927 CET	7733	50652	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:13.163448095 CET	50652	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:13.363195896 CET	7733	50700	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:13.363359928 CET	50700	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:14.205534935 CET	7733	50678	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:14.205697060 CET	50678	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:14.451361895 CET	7733	50726	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:14.451500893 CET	50726	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:14.562566042 CET	7733	50654	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:14.562661886 CET	50654	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:14.807712078 CET	7733	50702	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:14.807852983 CET	50702	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:15.318202019 CET	7733	50728	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:15.318404913 CET	50728	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:15.502561092 CET	7733	50680	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:15.502656937 CET	50680	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:15.754620075 CET	7733	50656	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:15.754847050 CET	50656	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:15.918054104 CET	7733	50704	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:15.918219090 CET	50704	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:16.598445892 CET	7733	50730	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:16.598591089 CET	50730	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:16.669749022 CET	7733	50682	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:16.669842005 CET	50682	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:16.854378939 CET	7733	50658	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:16.854480982 CET	50658	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:16.937591076 CET	7733	50706	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:16.937658072 CET	50706	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:17.775316954 CET	2211	42020	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:17.775623083 CET	42020	2211	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:17.806344986 CET	7733	50684	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:17.806518078 CET	50684	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:17.885370016 CET	7733	50732	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:17.885507107 CET	50732	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:18.217684031 CET	7733	50708	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:18.217904091 CET	50708	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:18.393830061 CET	7733	50660	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:18.394038916 CET	50660	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:19.158179045 CET	7733	50736	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:19.158417940 CET	50736	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:19.229521036 CET	7733	50686	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:19.229667902 CET	50686	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:19.290520906 CET	7733	50734	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:19.290633917 CET	50734	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:19.567225933 CET	7733	50662	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:19.567424059 CET	50662	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:19.591803074 CET	7733	50710	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:19.591988087 CET	50710	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:20.478317022 CET	7733	50688	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:20.478569031 CET	50688	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:20.696222067 CET	7733	50664	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:20.696517944 CET	50664	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:20.777658939 CET	7733	50712	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:20.777776003 CET	7733	50640	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:20.777973890 CET	50712	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:20.778026104 CET	50640	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:21.389770031 CET	7733	50690	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:21.389848948 CET	50690	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:21.974278927 CET	7733	50666	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:21.974510908 CET	50666	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:22.057859898 CET	7733	50642	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:22.058034897 CET	50642	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:22.245863914 CET	7733	50714	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:22.246108055 CET	50714	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:22.661650896 CET	7733	50692	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:22.661806107 CET	50692	7733	192.168.2.23	141.98.10.142
Mar 23, 2025 10:47:23.339768887 CET	7733	50716	141.98.10.142	192.168.2.23
Mar 23, 2025 10:47:23.339884043 CET	50716	7733	192.168.2.23	141.98.10.142

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 23, 2025 10:45:17.171396971 CET	49987	53	192.168.2.23	8.8.8.8
Mar 23, 2025 10:45:17.266612053 CET	53	49987	8.8.8.8	192.168.2.23
Mar 23, 2025 10:45:17.269440889 CET	51565	53	192.168.2.23	8.8.8.8
Mar 23, 2025 10:45:17.365668058 CET	53	51565	8.8.8.8	192.168.2.23
Mar 23, 2025 10:46:46.704771996 CET	44033	53	192.168.2.23	8.8.8.8
Mar 23, 2025 10:46:46.800502062 CET	53	44033	8.8.8.8	192.168.2.23
Mar 23, 2025 10:46:46.802587032 CET	33009	53	192.168.2.23	8.8.8.8
Mar 23, 2025 10:46:46.902371883 CET	53	33009	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 23, 2025 10:45:17.171396971 CET	192.168.2.23	8.8.8.8	0x706d	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false
Mar 23, 2025 10:45:17.269440889 CET	192.168.2.23	8.8.8.8	0x3187	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false
Mar 23, 2025 10:46:46.704771996 CET	192.168.2.23	8.8.8.8	0x1e97	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false
Mar 23, 2025 10:46:46.802587032 CET	192.168.2.23	8.8.8.8	0x2cec	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 23, 2025 10:45:17.266612053 CET	8.8.8.8	192.168.2.23	0x706d	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 23, 2025 10:45:17.365668058 CET	8.8.8.8	192.168.2.23	0x3187	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 23, 2025 10:46:46.800502062 CET	8.8.8.8	192.168.2.23	0x1e97	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 23, 2025 10:46:46.902371883 CET	8.8.8.8	192.168.2.23	0x2cec	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: rrrdsl.elf PID: 6271, Parent PID: 6195

General

Start time (UTC):	09:45:16
Start date (UTC):	23/03/2025
Path:	/tmp/rrrdsl.elf
Arguments:	/tmp/rrrdsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: rrrdsl.elf PID: 6273, Parent PID: 6271

General

Start time (UTC):	09:45:16
Start date (UTC):	23/03/2025
Path:	/tmp/rrrdsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

File Activities

File Deleted

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: rrrdsl.elf PID: 6275, Parent PID: 6273

General

Start time (UTC):	09:45:16
Start date (UTC):	23/03/2025
Path:	/tmp/rrrdsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Signal Sent

Prctl Requested

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: rrrdsl.elf PID: 6276, Parent PID: 6273

General

Start time (UTC):	09:45:16
Start date (UTC):	23/03/2025
Path:	/tmp/rrrdsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

File Activities

File Opened

File Deleted

Directory Enumerated

Directory Deleted

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: xfce4-panel PID: 6281, Parent PID: 2063

General

Start time (UTC):	09:45:18
Start date (UTC):	23/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6281, Parent PID: 2063

General

Start time (UTC):	09:45:18
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6284, Parent PID: 2063

General

Start time (UTC):	09:45:19
Start date (UTC):	23/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6284, Parent PID: 2063

General

Start time (UTC):	09:45:19
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dbus-daemon PID: 6286, Parent PID: 6285

General

Start time (UTC):	09:45:20
Start date (UTC):	23/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfconfd PID: 6286, Parent PID: 6285

General

Start time (UTC):	09:45:20
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

File Activities

File Opened

File Read

File Written

File Moved

Directory Created

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6290, Parent PID: 2063

General

Start time (UTC):	09:45:21
Start date (UTC):	23/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6290, Parent PID: 2063

General

Start time (UTC):	09:45:21
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Truncated

File Read

Directory Enumerated

Directory Created

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6293, Parent PID: 2063

General

Start time (UTC):	09:45:22
Start date (UTC):	23/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6293, Parent PID: 2063

General

Start time (UTC):	09:45:22
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Process Forked

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6310, Parent PID: 6293

General

Start time (UTC):	09:45:27
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

Directory Enumerated

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 6310, Parent PID: 6293

General

Start time (UTC):	09:45:27
Start date (UTC):	23/03/2025
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: xfce4-panel PID: 6299, Parent PID: 2063

General

Start time (UTC):	09:45:23
Start date (UTC):	23/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6299, Parent PID: 2063

General

Start time (UTC):	09:45:23
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Directory Created

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6303, Parent PID: 2063

General

Start time (UTC):	09:45:24
Start date (UTC):	23/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6303, Parent PID: 2063

General

Start time (UTC):	09:45:24
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: systemd PID: 6317, Parent PID: 1860

General

Start time (UTC):	09:45:28
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-notifyd PID: 6317, Parent PID: 1860

General

Start time (UTC):	09:45:28
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

File Activities

File Opened

File Read

Directory Enumerated

Directory Created

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: gnome-session-binary PID: 6378, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6378, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gsd-wacom PID: 6378, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/libexec/gsd-wacom
Arguments:	/usr/libexec/gsd-wacom
File size:	39520 bytes
MD5 hash:	13778dd1a23a4e94ddc17ac9caa4fcc1

File Activities

File Opened

Chronological Activities

Analysis Process: gnome-session-binary PID: 6380, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6380, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gnome-session-binary PID: 6382, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6382, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gnome-session-binary PID: 6383, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6383, Parent PID: 1477

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: dbus-daemon PID: 6386, Parent PID: 6385

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfconfd PID: 6386, Parent PID: 6385

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

File Activities

File Opened

File Read

Directory Created

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: gdm3 PID: 6387, Parent PID: 1320

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 6387, Parent PID: 1320

General

Start time (UTC):	09:46:02
Start date (UTC):	23/03/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gdm3 PID: 6388, Parent PID: 1320

General

Start time (UTC):	09:46:03
Start date (UTC):	23/03/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 6388, Parent PID: 1320

General

Start time (UTC):	09:46:03
Start date (UTC):	23/03/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: dash PID: 6412, Parent PID: 4332

General

Start time (UTC):	09:46:05
Start date (UTC):	23/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6412, Parent PID: 4332

General

Start time (UTC):	09:46:05
Start date (UTC):	23/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.up366WRCei /tmp/tmp.Vn5eq1nHfO /tmp/tmp.Lq9fDSsJtb
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6413, Parent PID: 4332

General

Start time (UTC):	09:46:05
Start date (UTC):	23/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6413, Parent PID: 4332

General

Start time (UTC):	09:46:05
Start date (UTC):	23/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.up366WRCei /tmp/tmp.Vn5eq1nHfO /tmp/tmp.Lq9fDSsJtb
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report rrrdsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

/proc/6271/task/6271/comm

/tmp/qemu-open.4a7g5o (deleted)

/tmp/qemu-open.AAk42n (deleted)

/tmp/qemu-open.Vk8aCm (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: rrrdsl.elf PID: 6271, Parent PID: 6195

General

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: rrrdsl.elf PID: 6273, Parent PID: 6271

Linux Analysis Report
rrrdsl.elf