Edit tour

Linux Analysis Report
efjepc.elf

Overview

General Information

Sample name:	efjepc.elf
Analysis ID:	1649546
MD5:	e142ebfafd66b5fba15d66f0e4778cd3
SHA1:	5c7d26fdddc5f72da721716a21a6880714214334
SHA256:	866c7b98e222ea729842bc96af910d280c4668e9f61acd3cdb1e25b8083f9acd
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649546
Start date and time:	2025-03-26 22:08:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	efjepc.elf
Detection:	MAL
Classification:	mal64.spre.evad.linELF@0/4@2/0

Warnings

Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:	/tmp/efjepc.elf
PID:	5424
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

efjepc.elf (PID: 5424, Parent: 5349, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/efjepc.elf

efjepc.elf New Fork (PID: 5426, Parent: 5424)

efjepc.elf New Fork (PID: 5428, Parent: 5426)

efjepc.elf New Fork (PID: 5430, Parent: 5426)

efjepc.elf New Fork (PID: 5431, Parent: 5426)

xfce4-panel New Fork (PID: 5437, Parent: 3147)

wrapper-2.0 (PID: 5437, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5438, Parent: 3147)

wrapper-2.0 (PID: 5438, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5439, Parent: 3147)

wrapper-2.0 (PID: 5439, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5440, Parent: 3147)

wrapper-2.0 (PID: 5440, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 5441, Parent: 3147)

wrapper-2.0 (PID: 5441, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5442, Parent: 3147)

wrapper-2.0 (PID: 5442, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dash New Fork (PID: 5447, Parent: 3585)

rm (PID: 5447, Parent: 3585, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.r537UGDdmb /tmp/tmp.3hQJd9yzJc /tmp/tmp.usH1vlJkGi

dash New Fork (PID: 5450, Parent: 3585)

cat (PID: 5450, Parent: 3585, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.r537UGDdmb

dash New Fork (PID: 5451, Parent: 3585)

head (PID: 5451, Parent: 3585, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5452, Parent: 3585)

tr (PID: 5452, Parent: 3585, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5453, Parent: 3585)

cut (PID: 5453, Parent: 3585, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5454, Parent: 3585)

cat (PID: 5454, Parent: 3585, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.r537UGDdmb

dash New Fork (PID: 5455, Parent: 3585)

head (PID: 5455, Parent: 3585, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5456, Parent: 3585)

tr (PID: 5456, Parent: 3585, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5457, Parent: 3585)

cut (PID: 5457, Parent: 3585, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5458, Parent: 3585)

rm (PID: 5458, Parent: 3585, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.r537UGDdmb /tmp/tmp.3hQJd9yzJc /tmp/tmp.usH1vlJkGi

dbus-daemon New Fork (PID: 5489, Parent: 5487)

xfconfd (PID: 5489, Parent: 5487, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: efjepc.elf	Virustotal: Detection: 25%			Perma Link
Source: efjepc.elf	ReversingLabs: Detection: 22%

Source: unknown

HTTPS traffic detected: 54.217.10.153:443 -> 192.168.2.13:37674 version: TLS 1.2

Source: efjepc.elf

String: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlnohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmuxY

Source: global traffic

TCP traffic: 192.168.2.13:51626 -> 141.98.10.142:2211

Source: global traffic

DNS traffic detected: DNS query: raw.awaken-network.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37674
Source: unknown	Network traffic detected: HTTP traffic on port 37674 -> 443

Source: unknown

HTTPS traffic detected: 54.217.10.153:443 -> 192.168.2.13:37674 version: TLS 1.2

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5437, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5439, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5441, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5442, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 780, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 1563, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 1563, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 2984, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3134, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3134, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3146, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3153, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3153, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3158, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3158, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3203, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3203, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3220, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5409, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5409, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5489, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5437, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5439, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5441, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5442, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 780, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 1563, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 1563, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 2984, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3134, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3134, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3146, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3153, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3153, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3158, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3158, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3203, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3203, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 3220, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5409, result: successful	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5409, result: no such process	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	SIGKILL sent: pid: 5489, result: successful	Jump to behavior

Source: classification engine

Classification label: mal64.spre.evad.linELF@0/4@2/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/efjepc.elf (PID: 5431)	Deleted: /dev/kmsg			Jump to behavior
Source: /tmp/efjepc.elf (PID: 5431)	Deleted: /dev/null			Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5437)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5440)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5442)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5489)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5489)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5489)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5489)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/5264/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/5264/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/5264/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/5264/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/5264/fd	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/238/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/239/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/914/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/914/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/914/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/914/fd	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/3635/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/3635/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/3635/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/3635/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/3635/fd	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/917/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/917/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/917/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/917/fd	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5428)	File opened: /proc/11/stat	Jump to behavior

Source: /usr/bin/dash (PID: 5447)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.r537UGDdmb /tmp/tmp.3hQJd9yzJc /tmp/tmp.usH1vlJkGi			Jump to behavior
Source: /usr/bin/dash (PID: 5458)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.r537UGDdmb /tmp/tmp.3hQJd9yzJc /tmp/tmp.usH1vlJkGi			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/efjepc.elf (PID: 5431)	Log files deleted: /var/log/kern.log	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5431)	Log files deleted: /var/log/Xorg.0.log	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5431)	Log files deleted: /var/log/auth.log	Jump to behavior
Source: /tmp/efjepc.elf (PID: 5431)	Log files deleted: /var/log/Xorg.1.log	Jump to behavior

Sample deletes itself

Source: /tmp/efjepc.elf (PID: 5426)

File: /tmp/efjepc.elf

Jump to behavior

Source: /tmp/efjepc.elf (PID: 5424)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5437)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5438)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5439)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5440)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5441)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5442)	Queries kernel information via 'uname':	Jump to behavior

Source: efjepc.elf	Binary or memory string: /lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/bin//tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)x86armmipsmpslsh4wgetcurllynxftpftpgettftpscpaflaaarsyncpfclamscanreadelfizsnapstracelsofgdbpmapltraceptracewiresharktsharktcpdumpnetstatssnmaphping3tracerouteiptablesnftfirewalldauditctlselinuxapparmoraptdnfyumzypperpacmanemergebrewportnanovimvinvimgeditkateemacspkillkillallkillsystemctlnohuppythonpython3perlrubyluanodebashshkshzshfishvolatilitychkrootkitrkhunterradare2binwalkdockerpodmanlxcqemuvirshvboxmanagemountumountdfdulsblkblkidmkfsfdiskpartedobjdumpstringsxxdhexdumpncnetcatsocatjournalctldmesglogcattaillessgrepawksedtmuxY
Source: efjepc.elf, 5424.1.00007ffe3be1f000.00007ffe3be40000.rw-.sdmp	Binary or memory string: )x86_64/usr/bin/qemu-ppc/tmp/efjepc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/efjepc.elf
Source: efjepc.elf, 5424.1.00007ffe3be1f000.00007ffe3be40000.rw-.sdmp	Binary or memory string: sU/tmp/qemu-open.MeefRi\4i
Source: efjepc.elf, 5424.1.000055730d0a3000.000055730d153000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1/proc/5424/task/5424/comm1
Source: efjepc.elf, 5424.1.000055730d0a3000.000055730d153000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: efjepc.elf, 5424.1.00007ffe3be1f000.00007ffe3be40000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.MeefRi
Source: efjepc.elf, 5424.1.00007ffe3be1f000.00007ffe3be40000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: efjepc.elf, 5424.1.00007ffe3be1f000.00007ffe3be40000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: efjepc.elf, 5424.1.00007ffe3be1f000.00007ffe3be40000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
efjepc.elf	26%	Virustotal		Browse
efjepc.elf	22%	ReversingLabs	Linux.Backdoor.Mirai

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.217.10.153	unknown	United States		16509	AMAZON-02US	false
141.98.10.142	raw.awaken-network.net	Lithuania		209605	HOSTBALTICLT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.217.10.153	arm6.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	tarm5.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	tftp.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
141.98.10.142	vejfa5.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	jfeeps.elf	Get hash	malicious	Unknown	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	bejv86.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTBALTICLT	vejfa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	drea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	bejv86.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
AMAZON-02US	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	108.139.29.30
	efefa7.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	https://www.bing.com/ck/a?!&&p=5406480d02accf17624086c56a94c55f6a16b7aaf8708ca0aac470ec492dfdddJmltdHM9MTc0Mjk0NzIwMA&ptn=3&ver=2&hsh=4&fclid=19c568d0-da5e-6cab-0452-7d78db436d5e&u=a1aHR0cHM6Ly90ZWNub2xvZ2lhYWx0b2xhc2NvbmRlcy5jb20ubXgvbmV3LXByb2R1Y3Rz&ntb=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	3.168.73.27
	arm6.elf	Get hash	malicious	Unknown	Browse	34.254.182.186
	phishing.eml	Get hash	malicious	Unknown	Browse	54.200.22.172
	OdJqjzS22H.jar	Get hash	malicious	Can Stealer	Browse	13.226.94.17
	OdJqjzS22H.jar	Get hash	malicious	Can Stealer	Browse	13.226.94.17
	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	3.168.122.105
	https://eqrco.de/a/thFNTJ	Get hash	malicious	Unknown	Browse	52.92.18.50
	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDb5RYhyf7Kpg76mQsWD31yof1Vz37cyQEc6U1m5iMGETnZDWnZDWr0y31qxQrqpjLmAg1Zz37bqRp4oOYOL4Zu8W2iRR0S8V5KSVZcIgrifWpC8hYmJZ2mrY63EVp6sZstChpC0iK4oQ19/RsR6XpqxVrWSTKqN3oOwVpcJR2qHWsSYX801WsKLfop/i50W1Zus0JKR4EOqf8WKSZKNZ8iMZpKRi7l5g0KJ40Z6hqOmg2SNW8u54Mm9S5/k1KKNR7/SQ0m0hs0/48Kuh8N/fsRETImQjr/Uh1J6XLy0gMuD4KmX004r40iyTJy84ISVjKcqjpcq4qcESEGNi5KG26b91om~VpJr4Y5y0Kt8TLWLXsOVhpynQ2GERoGtX809TJ3yWpmVQ003iD4o41Zc4L6PhLSyZpKn08mv3rp6fqqWUY5=dc~Gb~b7F~2c/cbH8/FaH9H/KK/GbJaJ/IJ569bFc~F/JIbHGHa7H8/7aa/G/Kb6I?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiOGQ1YzIxZDBhODFkODAyNjQ3ZTBjNzc3MTdiNmY3ZDo3OmQwYzA6MTVhOWVkNDViMjQ5YjliMTE4NzM1ZDUwM2UyMThlNWU4ZGRjODY4ZjdmNDczYmNkYThiM2JmNWU0NWI4NDI2NTpoOlQ6VA	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	13.249.91.40

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb4726d465c5f28b84cd6d14cedd13a7	na.elf	Get hash	malicious	Prometei	Browse	54.217.10.153
	na.elf	Get hash	malicious	Prometei	Browse	54.217.10.153
	GoldAge3ATOspc.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	na.elf	Get hash	malicious	Prometei	Browse	54.217.10.153
	na.elf	Get hash	malicious	Prometei	Browse	54.217.10.153
	na.elf	Get hash	malicious	Prometei	Browse	54.217.10.153
	morte.mips.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	na.elf	Get hash	malicious	Prometei	Browse	54.217.10.153
	morte.x86.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	main_arm5.elf	Get hash	malicious	Mirai	Browse	54.217.10.153

Process:	/tmp/efjepc.elf
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:I:I
MD5:	336D5EBC5436534E61D16E63DDFCA327
SHA1:	3BC15C8AAE3E4124DD409035F32EA2FD6835EFC9
SHA-256:	3973E022E93220F9212C18D0D0C543AE7C309E46640DA93A4A0314DE999F5112
SHA-512:	7C0B0D99A6E4C33CDA0F6F63547F878F4DD9F486DFE5D0446CE004B1C0FF28F191FF86F5D5933D3614CCEEE6FBBDC17E658881D3A164DFA5D6F4C699B2126E3D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	-

/tmp/qemu-open.DClMcj (deleted)

Download File

Process:	/tmp/efjepc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	2.508467371678925
Encrypted:	false
SSDEEP:	3:EBFNKoKAMVG2EXWFVFe/FNvN:EB3KXYXCG/1
MD5:	8A1FFED278E1373EE57F4649F0C86979
SHA1:	1E23060E9B5E766F2355E7AE79487D8351751AE2
SHA-256:	19D53B8195ED60F71788AEF9C38AF6A593139DA7F7D9C2B8C7ED6C27C20EDCEE
SHA-512:	85A9DC1910E59F3202095AAF49A0E5471D570E9DB2F6A90D165A199CB8BEBE9A592E02CD9DCCA03B017A9B3A36BA14B2B1B58FC22F927ADC2EBF2864D6D62946
Malicious:	false
Reputation:	low
Preview:	5424 (/tmp/efjepc.elf) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4294962560 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.- (0) S 0 0 0 0 0 0 0 0 0 0 0 0 0 0

/tmp/qemu-open.MeefRi (deleted)

Download File

Process:	/tmp/efjepc.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.9500637564362093
Encrypted:	false
SSDEEP:	3:TgNVG2iHJN:TgQJN
MD5:	F9AEDE9BAE52F5EE5FAA29921D34F048
SHA1:	CDD4232D6F1A2E25B0E5741B8274EC5016165B03
SHA-256:	B8D2E4BE036BF92A5FB64698639687F1BC75020E61FE3A49767733860EE9577B
SHA-512:	F9838B179A9BE84EC9A3C9C881FC502F1BD6B0E92EE6574A322E0DE19B0765CC525CF161797BBD05CE3E7E532F4F9FE7CE96B58681624F089FEAD4704A38AAD1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/efjepc.elf.nwlrbbmqbh

/tmp/qemu-open.oObl1l (deleted)

Download File

Process:	/tmp/efjepc.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.337175341123077
Encrypted:	false
SSDEEP:	3:TgNVG2/:TgT
MD5:	7187C83E494C037807603564AB80AA66
SHA1:	848F96A90304D935026DE90937B5049BD3AA509F
SHA-256:	C408BA5FE2513A0E04CCE960A1B34D170DA36ADF943C79AE8A6A3A86414F975F
SHA-512:	1FAE83AE65B09F24105AE35986E502896285AB53C243482EDF8F1FAD4FF110E1097951ACF9CA0277315F3999614C78C37EA033969EEA28458C2D6132DF0793EB
Malicious:	false
Reputation:	low
Preview:	/tmp/efjepc.elf..

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.577577826781861
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	efjepc.elf
File size:	162'816 bytes
MD5:	e142ebfafd66b5fba15d66f0e4778cd3
SHA1:	5c7d26fdddc5f72da721716a21a6880714214334
SHA256:	866c7b98e222ea729842bc96af910d280c4668e9f61acd3cdb1e25b8083f9acd
SHA512:	bca4c402815a30e54abb0d17d9519632f030e847e4f3fb4b0b0a9c0832daf8afa599acd97f36d58c7ab94108b4980122d9150f9b0b1c323173b914e0063d2f17
SSDEEP:	1536:50nR1GNVetJ+yJvKR877Pxg2Mwbrgu/FkV4lcX0OS6RJeskdvAQ8G0PWAYw2DqI8:5UaA/v77xNbrDt7HO7RUaQ9TcV
TLSH:	56F32906730C0E47D1532EF02E3F27E193EFAA9121E4F744291FAA8A9175E365586ECD
File Content Preview:	.ELF...........................4..y......4. ...(......................&...&...............0...0...0...I....H........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........z...../...@..\?.....0D.+../...A..$8...})....0DN..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	162296
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x1e348	0x0	0x6	AX	4
.fini	PROGBITS	0x1001e400	0x1e400	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1001e420	0x1e420	0x4290	0x0	0x2	A	8
.ctors	PROGBITS	0x10033000	0x23000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x1003300c	0x2300c	0x8	0x0	0x3	WA	4
.got2	PROGBITS	0x10033018	0x23018	0xc	0x0	0x3	WA	1
.data	PROGBITS	0x10033040	0x23040	0x48e0	0x0	0x3	WA	32
.sdata	PROGBITS	0x10037920	0x27920	0x84	0x0	0x3	WA	4
.sbss	NOBITS	0x100379a4	0x279a4	0x120	0x0	0x3	WA	4
.bss	NOBITS	0x10037ac8	0x279a4	0xc480	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x279a4	0x51	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x226b0	0x226b0	6.1070	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x23000	0x10033000	0x10033000	0x49a4	0x10f48	0.4920	0x6	RW	0x10000	.ctors .dtors .got2 .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 514
• 7733 undefined
• 2211 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 22:08:57.765053034 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:08:57.947300911 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:08:57.947356939 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:08:57.949502945 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:08:58.131525993 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:08:58.131584883 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:08:58.313745022 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:00.030781031 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:00.197757006 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:00.198935032 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:00.200177908 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:00.428317070 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:03.217345953 CET	54536	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.400146008 CET	7733	54536	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:03.400394917 CET	54536	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.401701927 CET	54536	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.407974005 CET	54538	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.583421946 CET	7733	54536	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:03.588174105 CET	7733	54538	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:03.588242054 CET	54538	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.591907978 CET	54538	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.618513107 CET	54540	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.771442890 CET	7733	54538	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:03.800884962 CET	7733	54540	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:03.802927971 CET	54540	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.870980978 CET	54540	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:03.887567997 CET	54542	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.054279089 CET	7733	54540	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.068981886 CET	7733	54542	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.069051027 CET	54542	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.074940920 CET	54542	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.097127914 CET	54544	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.254198074 CET	7733	54542	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.276563883 CET	7733	54544	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.276654005 CET	54544	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.281258106 CET	54544	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.292006016 CET	54546	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.460406065 CET	7733	54544	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.474939108 CET	7733	54546	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.475017071 CET	54546	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.481678963 CET	54546	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.495445013 CET	54548	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.664608002 CET	7733	54546	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.675199032 CET	7733	54548	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.675292015 CET	54548	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.695193052 CET	54548	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.724023104 CET	54550	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:04.840521097 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:04.840549946 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:04.840559959 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:04.840569973 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:04.840579033 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:04.840588093 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:04.840713024 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:04.840713978 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:04.840713978 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:04.840713978 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:04.840713978 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:04.840713978 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:04.841658115 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:04.874150991 CET	7733	54548	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.903599977 CET	7733	54550	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:04.903665066 CET	54550	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.068099022 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:05.068711996 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:05.068794966 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:05.068926096 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:05.173940897 CET	54550	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.235693932 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:05.235714912 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:05.235785007 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:05.235832930 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:05.247502089 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:05.353494883 CET	7733	54550	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:05.441009998 CET	54552	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.470341921 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:05.470364094 CET	443	37674	54.217.10.153	192.168.2.13
Mar 26, 2025 22:09:05.470417023 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:05.470417023 CET	37674	443	192.168.2.13	54.217.10.153
Mar 26, 2025 22:09:05.622212887 CET	7733	54552	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:05.622267962 CET	54552	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.629475117 CET	54552	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.645723104 CET	54554	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.810261965 CET	7733	54552	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:05.828741074 CET	7733	54554	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:05.828804016 CET	54554	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.836709976 CET	54554	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:05.861860991 CET	54556	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.019682884 CET	7733	54554	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.042771101 CET	7733	54556	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.042848110 CET	54556	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.048901081 CET	54556	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.065762043 CET	54558	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.229809999 CET	7733	54556	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.249531984 CET	7733	54558	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.249603033 CET	54558	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.253670931 CET	54558	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.262949944 CET	54560	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.437171936 CET	7733	54558	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.445132017 CET	7733	54560	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.445187092 CET	54560	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.448787928 CET	54560	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.500536919 CET	54562	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.630716085 CET	7733	54560	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.682696104 CET	7733	54562	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.682775974 CET	54562	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.685909986 CET	54562	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.697513103 CET	54564	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.867770910 CET	7733	54562	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.878192902 CET	7733	54564	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:06.878273964 CET	54564	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.914238930 CET	54564	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:06.946882963 CET	54566	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:07.094918966 CET	7733	54564	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:07.127748013 CET	7733	54566	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:07.127859116 CET	54566	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:07.149832964 CET	54566	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:07.330267906 CET	7733	54566	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:08.332071066 CET	54568	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:08.511282921 CET	7733	54568	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:08.511434078 CET	54568	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:08.550756931 CET	54568	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:08.730170012 CET	7733	54568	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026792049 CET	7733	54568	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026808023 CET	7733	54566	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026817083 CET	7733	54548	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026851892 CET	7733	54550	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026861906 CET	7733	54564	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026887894 CET	7733	54556	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026907921 CET	7733	54544	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026957035 CET	7733	54552	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026964903 CET	7733	54538	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.026973963 CET	7733	54542	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.027751923 CET	54542	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027759075 CET	54538	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027759075 CET	54564	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027771950 CET	54552	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027771950 CET	54566	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027793884 CET	54544	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027867079 CET	54550	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027868986 CET	54548	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027867079 CET	54568	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.027885914 CET	54556	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.029174089 CET	7733	54554	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.029186010 CET	7733	54546	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.029360056 CET	7733	54536	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.029989958 CET	7733	54558	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.030002117 CET	7733	54562	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.030024052 CET	7733	54560	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.030039072 CET	7733	54540	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.031725883 CET	54560	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.031725883 CET	54558	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.031733990 CET	54554	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.031733990 CET	54540	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.031733990 CET	54562	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.031764984 CET	54536	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.031769037 CET	54546	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.467967987 CET	54570	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.649333000 CET	7733	54570	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.654597998 CET	54572	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:09.838968992 CET	7733	54572	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:09.842458963 CET	54574	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:10.023900032 CET	7733	54574	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:10.027435064 CET	54576	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:10.206386089 CET	7733	54576	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:10.209115028 CET	54578	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:10.392481089 CET	7733	54578	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:10.395754099 CET	54580	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:10.576370001 CET	7733	54580	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:10.579761982 CET	54582	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:10.758778095 CET	7733	54582	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:10.762172937 CET	54584	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:10.945374966 CET	7733	54584	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:10.948964119 CET	54586	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:11.130690098 CET	7733	54586	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:11.134496927 CET	54588	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:11.317996979 CET	7733	54588	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:11.320981979 CET	54590	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:11.501432896 CET	7733	54590	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:11.504291058 CET	54592	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:11.684528112 CET	7733	54592	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:11.687109947 CET	54594	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:11.869041920 CET	7733	54594	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:11.871534109 CET	54596	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:12.053356886 CET	7733	54596	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:12.055982113 CET	54598	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:12.235234976 CET	7733	54598	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:12.238152981 CET	54600	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:12.418756008 CET	7733	54600	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:12.421435118 CET	54602	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:12.603234053 CET	7733	54602	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:12.608810902 CET	54604	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:12.788189888 CET	7733	54604	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:12.870783091 CET	54606	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:13.051275015 CET	7733	54606	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:13.053905964 CET	54608	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:13.234698057 CET	7733	54608	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:13.237396002 CET	54610	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:13.348278999 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:13.348429918 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:13.419610023 CET	7733	54610	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:13.422274113 CET	54612	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:13.602201939 CET	7733	54612	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:13.605575085 CET	54614	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:13.787000895 CET	7733	54614	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:13.789545059 CET	54616	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:13.971481085 CET	7733	54616	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:13.974273920 CET	54618	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:14.153476954 CET	7733	54618	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:14.157982111 CET	54620	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:14.337297916 CET	7733	54620	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:14.339811087 CET	54622	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:14.520365953 CET	7733	54622	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:14.522912979 CET	54624	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:14.703389883 CET	7733	54624	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:14.705888987 CET	54626	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:14.890095949 CET	7733	54626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:14.893820047 CET	54628	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:15.075758934 CET	7733	54628	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:15.078900099 CET	54630	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:15.260554075 CET	7733	54630	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:15.263335943 CET	54632	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:15.446496010 CET	7733	54632	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:15.449392080 CET	54634	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:15.631027937 CET	7733	54634	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:15.634063005 CET	54636	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:15.813617945 CET	7733	54636	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:15.816503048 CET	54638	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:16.000010014 CET	7733	54638	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:16.007502079 CET	54640	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:16.188532114 CET	7733	54640	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:16.190882921 CET	54642	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:16.371227980 CET	7733	54642	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:16.374018908 CET	54644	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:16.557384968 CET	7733	54644	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:16.560277939 CET	54646	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:16.740721941 CET	7733	54646	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:16.743261099 CET	54648	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:16.925338984 CET	7733	54648	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:16.927645922 CET	54650	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:17.109644890 CET	7733	54650	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:17.125000000 CET	54652	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:17.308212996 CET	7733	54652	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:17.311090946 CET	54654	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:17.494590998 CET	7733	54654	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:17.497981071 CET	54656	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:17.679073095 CET	7733	54656	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:17.682327986 CET	54658	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:17.868971109 CET	7733	54658	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:17.872041941 CET	54660	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.051661015 CET	7733	54660	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.056269884 CET	54662	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.239866972 CET	7733	54662	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.242994070 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.422174931 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.422278881 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.423439026 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.425319910 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.602422953 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.604326963 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.604470968 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.605699062 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.607248068 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.785365105 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.786777020 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.786957026 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.788094044 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.790472984 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.968307972 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.971611977 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:18.971690893 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.972877026 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:18.974610090 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.153748989 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.153810978 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.153877974 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.156291962 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.173850060 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.335789919 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.353204966 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.353533030 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.355707884 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.368375063 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.534475088 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.549144030 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.549190998 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.551053047 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.554697037 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.731810093 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.736495018 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.736602068 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.737600088 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.739109039 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.917924881 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.918210030 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:19.918291092 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.919434071 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:19.921701908 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.100055933 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.100833893 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.100994110 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.102324963 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.104088068 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.281519890 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.283093929 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.283345938 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.284663916 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.286284924 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.463808060 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.465437889 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.465574026 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.466774940 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.468364000 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.646102905 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.651468039 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.651580095 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.652709007 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.654372931 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.835273981 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.835382938 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.835855007 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:20.836771965 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:20.838402987 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.017386913 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.019524097 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.019759893 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.020862103 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.022855043 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.201776028 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.206166983 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.206357956 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.207298994 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.208832979 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.390355110 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.390388966 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.390608072 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.391849041 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.393991947 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.573064089 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.573199034 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.573364019 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.574551105 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.576131105 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.756882906 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.756931067 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.757134914 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.758255959 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.759692907 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.938976049 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.942908049 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:21.943100929 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.944128036 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:21.946194887 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.126804113 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.127007008 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.127234936 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.127934933 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.129740000 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.308794975 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.308862925 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.309068918 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.310050964 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.311475992 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.489484072 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.496403933 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.496606112 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.497517109 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.500777960 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.680905104 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.684124947 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.684401035 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.685367107 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.697777033 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.868736982 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.880202055 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:22.880294085 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.881251097 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:22.894596100 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.063195944 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.077959061 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.078028917 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.079086065 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.093858004 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.262356043 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.277237892 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.277952909 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.279100895 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.292273045 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.464612961 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.474435091 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.476294994 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.476294994 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.488293886 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.661134005 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.667577982 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.667679071 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.668900967 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.703936100 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.849071980 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.885224104 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:23.885355949 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.886565924 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:23.901654005 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:24.069899082 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:24.080600977 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:24.080967903 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:24.081988096 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:24.261008978 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:28.532408953 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:28.532738924 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:33.826210976 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:33.826242924 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:33.826543093 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:33.826551914 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:34.081650972 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:34.082070112 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:34.341594934 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:34.341820955 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:34.342175007 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:34.342232943 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:34.593360901 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:34.593652010 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:34.850228071 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:34.850816011 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:35.108493090 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:35.108556986 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:35.108794928 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:35.108911991 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:35.361540079 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:35.361702919 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:35.617568016 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:35.617904902 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:35.873770952 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:35.874126911 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:35.875940084 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:35.876003981 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:36.129648924 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:36.129993916 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:36.385926962 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:36.386214972 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:36.644088030 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:36.644154072 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:36.644337893 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:36.644345045 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:36.897628069 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:36.897912025 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:37.153685093 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:37.154017925 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:37.155982971 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:37.156146049 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:37.409643888 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:37.409943104 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:37.667346001 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:37.667896986 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:37.925091982 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:37.925154924 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:37.925379992 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:37.925434113 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:38.180119991 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:38.180350065 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:38.436383009 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:38.436595917 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:38.692742109 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:38.692862988 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:38.693027020 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:38.693038940 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:38.945765018 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:38.946058035 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:39.201560020 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:39.201831102 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:39.457432032 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:39.457753897 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:43.716445923 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:43.716742992 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:49.009160042 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:49.009196043 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:49.009409904 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:49.009414911 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:49.261579037 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:49.261790037 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:49.521311045 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:49.521579981 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:49.525504112 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:49.525594950 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:49.773261070 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:49.773608923 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:50.033644915 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:50.034022093 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:50.289925098 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:50.290292025 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:50.293205976 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:50.293277025 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:50.541470051 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:50.541910887 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:50.797581911 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:50.797854900 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:51.057378054 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:51.057595015 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:51.063709021 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:51.063760996 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:51.313579082 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:51.313818932 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:51.569632053 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:51.569792986 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:51.829122066 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:51.829154015 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:51.829360962 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:51.829441071 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:52.078866959 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:52.079206944 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:52.337917089 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:52.338253975 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:52.340148926 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:52.340234041 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:52.593255997 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:52.593420982 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:52.849646091 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:52.849921942 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:53.022780895 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.023322105 CET	51626	2211	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:53.112284899 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.112325907 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.112613916 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:53.112623930 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:53.205616951 CET	2211	51626	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.364754915 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.365134001 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:53.620589018 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.620856047 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:53.876235962 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.876425028 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:53.879946947 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:53.880042076 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:54.125473976 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:54.125720024 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:54.386410952 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:54.386631966 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:09:54.637195110 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:09:54.637448072 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:04.189212084 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:04.189273119 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:04.189405918 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:04.189536095 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:04.444020033 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:04.444225073 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:04.702779055 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:04.702946901 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:04.711288929 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:04.711347103 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:04.953089952 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:04.953349113 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:05.217469931 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:05.217688084 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:05.473644018 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:05.473928928 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:05.477236032 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:05.477423906 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:05.721529007 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:05.721774101 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:05.977334976 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:05.977572918 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:06.237421989 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:06.237658024 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:06.247658014 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:06.247740984 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:06.497838974 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:06.498311996 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:06.755569935 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:06.755758047 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:07.011821032 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:07.012064934 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:07.015825987 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:07.016072035 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:07.263319969 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:07.263567924 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:07.521810055 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:07.522100925 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:07.528394938 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:07.528490067 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:07.777406931 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:07.777549028 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:08.029320955 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:08.029520988 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:08.300203085 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:08.300272942 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:08.300393105 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:08.300546885 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:08.552659988 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:08.552992105 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:08.807936907 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:08.808286905 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:09.060591936 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:09.060807943 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:09.067888975 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:09.068133116 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:09.311260939 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:09.311465979 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:09.576627970 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:09.576848030 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:09.817179918 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:09.817404985 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:19.393106937 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:19.393218994 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:19.393373966 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:19.393409014 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:19.650923967 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:19.651269913 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:19.907394886 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:19.907435894 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:19.907649994 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:19.907752991 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:20.160983086 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:20.161139011 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:20.417794943 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:20.418095112 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:20.673163891 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:20.673532009 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:20.673648119 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:20.673753977 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:20.929261923 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:20.929600000 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:21.185403109 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:21.185627937 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:21.441375017 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:21.441617966 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:21.443694115 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:21.443758011 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:21.697527885 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:21.697746038 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:21.953545094 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:21.953799009 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:22.211639881 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:22.211776018 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:22.211855888 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:22.211863041 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:22.465512037 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:22.465718985 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:22.721633911 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:22.721961975 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:22.723855972 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:22.723929882 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:22.977147102 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:22.977380991 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:23.233283043 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:23.233489990 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:23.493345022 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:23.493374109 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:23.493557930 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:23.493648052 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:23.747937918 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:23.748150110 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:24.003983974 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:24.004183054 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:24.259804964 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:24.259975910 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:24.260010004 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:24.260159969 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:24.514415026 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:24.514648914 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:24.769455910 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:24.769922972 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:25.025211096 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:25.025461912 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:34.573591948 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:34.573653936 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:34.573808908 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:34.573816061 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:34.833636999 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:34.833842993 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:35.089056969 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:35.089387894 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:35.093714952 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:35.093779087 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:35.343183994 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:35.343422890 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:35.601459026 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:35.601823092 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:35.857389927 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:35.857604027 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:35.859561920 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:35.859744072 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:36.113290071 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:36.113590956 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:36.365262032 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:36.365401030 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:36.621212006 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:36.621429920 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:36.627573967 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:36.627634048 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:36.881416082 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:36.881684065 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:37.137412071 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:37.137729883 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:37.395661116 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:37.395689011 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:37.395997047 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:37.396152020 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:37.649353981 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:37.649585009 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:37.905703068 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:37.906023979 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:37.907751083 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:37.907819033 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:38.162002087 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:38.162209034 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:38.413224936 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:38.413891077 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:38.679972887 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:38.680010080 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:38.680195093 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:38.680289984 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:38.938658953 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:38.938879967 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:39.188210964 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:39.188450098 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:39.444058895 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:39.444171906 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:39.444272041 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:39.444303036 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:39.697413921 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:39.697557926 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:39.953185081 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:39.953480005 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:40.205014944 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:40.205323935 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:49.754169941 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:49.754200935 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:49.754534006 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:49.754615068 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:50.013541937 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:50.013796091 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:50.269001007 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:50.269325018 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:50.277523041 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:50.277683973 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:50.527264118 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:50.527663946 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:50.786467075 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:50.786798000 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:51.037257910 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:51.037497997 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:51.040945053 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:51.041021109 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:51.293214083 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:51.293509007 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:51.545464993 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:51.545954943 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:51.801223040 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:51.801477909 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:51.811625957 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:51.811856031 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:52.065527916 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:52.065840960 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:52.321631908 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:52.321952105 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:52.579660892 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:52.579694986 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:52.580001116 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:52.580039024 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:52.829147100 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:52.829400063 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:53.089731932 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:53.090137005 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:53.095796108 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:53.095902920 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:53.345748901 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:53.346079111 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:53.593352079 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:53.593621969 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:53.864171982 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:53.864423990 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:53.868479967 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:53.868704081 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:54.125313997 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:54.125626087 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:54.371788025 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:54.372112989 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:54.627748966 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:54.627842903 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:54.628146887 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:54.628155947 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:54.877243996 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:54.877429962 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:55.137157917 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:55.137485027 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:10:55.384964943 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:10:55.385260105 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:04.961018085 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:04.961050987 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:04.961251974 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:04.961289883 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:05.218193054 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:05.218529940 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:05.473231077 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:05.473385096 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:05.473598003 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:05.473736048 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:05.728986979 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:05.729511023 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:05.985615015 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:05.985714912 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:06.241169930 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:06.241458893 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:06.241472960 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:06.241662979 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:06.497160912 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:06.497298956 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:06.753490925 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:06.753771067 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:07.011609077 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:07.011748075 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:07.012450933 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:07.012506962 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:07.265697002 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:07.266510963 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:07.524384975 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:07.524787903 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:07.779867887 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:07.779937029 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:07.780216932 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:07.780225992 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:08.035676956 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:08.035911083 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:08.289860964 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:08.290219069 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:08.293276072 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:08.293369055 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:08.545169115 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:08.545432091 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:08.801318884 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:08.801652908 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:09.060049057 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:09.060074091 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:09.060425043 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:09.060493946 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:09.315952063 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:09.316189051 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:09.571969032 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:09.572204113 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:09.828120947 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:09.828214884 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:09.828351974 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:09.828470945 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:10.081299067 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:10.081487894 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:10.337198973 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:10.337475061 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:10.593729973 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:10.594027042 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:20.140872955 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:20.140892982 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:20.141026020 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:20.141268015 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:20.401228905 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:20.401386023 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:20.652816057 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:20.653014898 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:20.657133102 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:20.657198906 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:20.908921003 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:20.909158945 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:21.169306993 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:21.169420004 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:21.421376944 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:21.421495914 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:21.425246954 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:21.425292015 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:21.681821108 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:21.682068110 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:21.933274984 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:21.933403969 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:22.193705082 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:22.193829060 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:22.199630022 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:22.199693918 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:22.453279018 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:22.453403950 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:22.713092089 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:22.713362932 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:22.963680029 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:22.963721037 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:22.963881969 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:22.963893890 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:23.219285011 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:23.219424009 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:23.473490000 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:23.473784924 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:23.482084990 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:23.482242107 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:23.728800058 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:23.729110003 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:23.981359959 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:23.981539011 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:24.243994951 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:24.244031906 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:24.244287014 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:24.244404078 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:24.499862909 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:24.500057936 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:24.755897999 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:24.756064892 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:25.011640072 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:25.011807919 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:25.011866093 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:25.012274981 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:25.265351057 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:25.267059088 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:25.521146059 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:25.521373987 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:25.778613091 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:25.778810978 CET	54724	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:35.328898907 CET	7733	54664	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:35.329174042 CET	7733	54666	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:35.329308987 CET	54666	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:35.329318047 CET	54664	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:35.589135885 CET	7733	54668	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:35.589231014 CET	54668	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:35.840785980 CET	7733	54672	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:35.841039896 CET	54672	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:35.845284939 CET	7733	54670	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:35.845341921 CET	54670	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:36.098140955 CET	7733	54674	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:36.098280907 CET	54674	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:36.357171059 CET	7733	54676	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:36.357266903 CET	54676	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:36.609200001 CET	7733	54680	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:36.609467983 CET	54680	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:36.612819910 CET	7733	54678	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:36.612894058 CET	54678	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:36.869329929 CET	7733	54682	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:36.869528055 CET	54682	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:37.121685028 CET	7733	54684	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:37.121886969 CET	54684	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:37.381098032 CET	7733	54686	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:37.381258011 CET	54686	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:37.391516924 CET	7733	54688	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:37.391599894 CET	54688	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:37.641298056 CET	7733	54690	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:37.641675949 CET	54690	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:37.901207924 CET	7733	54692	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:37.901336908 CET	54692	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:38.151477098 CET	7733	54696	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:38.151789904 CET	54696	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:38.155656099 CET	7733	54694	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:38.155720949 CET	54694	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:38.411310911 CET	7733	54698	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:38.411519051 CET	54698	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:38.661540031 CET	7733	54700	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:38.661941051 CET	54700	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:38.671753883 CET	7733	54702	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:38.671859980 CET	54702	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:38.917115927 CET	7733	54704	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:38.917258024 CET	54704	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:39.171581984 CET	7733	54706	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:39.171921968 CET	54706	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:39.435823917 CET	7733	54708	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:39.435846090 CET	7733	54710	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:39.435966969 CET	54708	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:39.436074018 CET	54710	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:39.687865019 CET	7733	54712	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:39.688132048 CET	54712	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:39.948853970 CET	7733	54714	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:39.949064016 CET	54714	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:40.203149080 CET	7733	54718	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:40.203313112 CET	54718	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:40.204859972 CET	7733	54716	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:40.205086946 CET	54716	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:40.453310966 CET	7733	54720	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:40.453524113 CET	54720	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:40.710164070 CET	7733	54722	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:40.710299969 CET	54722	7733	192.168.2.13	141.98.10.142
Mar 26, 2025 22:11:40.966054916 CET	7733	54724	141.98.10.142	192.168.2.13
Mar 26, 2025 22:11:40.966224909 CET	54724	7733	192.168.2.13	141.98.10.142

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 22:08:57.583693027 CET	57868	53	192.168.2.13	8.8.8.8
Mar 26, 2025 22:08:57.678102970 CET	53	57868	8.8.8.8	192.168.2.13
Mar 26, 2025 22:08:57.680775881 CET	58225	53	192.168.2.13	8.8.8.8
Mar 26, 2025 22:08:57.763736963 CET	53	58225	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 26, 2025 22:08:57.583693027 CET	192.168.2.13	8.8.8.8	0x24f9	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false
Mar 26, 2025 22:08:57.680775881 CET	192.168.2.13	8.8.8.8	0xbedc	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 26, 2025 22:08:57.678102970 CET	8.8.8.8	192.168.2.13	0x24f9	No error (0)	raw.awaken-network.net		141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 26, 2025 22:08:57.763736963 CET	8.8.8.8	192.168.2.13	0xbedc	No error (0)	raw.awaken-network.net		141.98.10.142	A (IP address)	IN (0x0001)	false

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 26, 2025 22:09:04.840588093 CET	54.217.10.153	443	192.168.2.13	37674	CN=motd.ubuntu.com CN=R10, O=Let's Encrypt, C=US	CN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Sat Mar 22 09:18:05 CET 2025 Wed Mar 13 01:00:00 CET 2024	Fri Jun 20 10:18:04 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2	fb4726d465c5f28b84cd6d14cedd13a7
Mar 26, 2025 22:09:04.840588093 CET	54.217.10.153	443	192.168.2.13	37674	CN=R10, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		fb4726d465c5f28b84cd6d14cedd13a7

System Behavior

Analysis Process: efjepc.elf PID: 5424, Parent PID: 5349

General

Start time (UTC):	21:08:56
Start date (UTC):	26/03/2025
Path:	/tmp/efjepc.elf
Arguments:	/tmp/efjepc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:08:56
Start date (UTC):	26/03/2025
Path:	/tmp/efjepc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:08:56
Start date (UTC):	26/03/2025
Path:	/tmp/efjepc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:08:56
Start date (UTC):	26/03/2025
Path:	/tmp/efjepc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:08:56
Start date (UTC):	26/03/2025
Path:	/tmp/efjepc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:09:02
Start date (UTC):	26/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	21:09:02
Start date (UTC):	26/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	21:09:02
Start date (UTC):	26/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	21:09:02
Start date (UTC):	26/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	21:09:02
Start date (UTC):	26/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	21:09:02
Start date (UTC):	26/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	21:09:03
Start date (UTC):	26/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	21:09:03
Start date (UTC):	26/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	21:09:03
Start date (UTC):	26/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	21:09:03
Start date (UTC):	26/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	21:09:03
Start date (UTC):	26/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	21:09:03
Start date (UTC):	26/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.r537UGDdmb /tmp/tmp.3hQJd9yzJc /tmp/tmp.usH1vlJkGi
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.r537UGDdmb
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.r537UGDdmb
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:09:04
Start date (UTC):	26/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.r537UGDdmb /tmp/tmp.3hQJd9yzJc /tmp/tmp.usH1vlJkGi
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	21:09:11
Start date (UTC):	26/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	21:09:11
Start date (UTC):	26/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report efjepc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/proc/5424/task/5424/comm

/tmp/qemu-open.DClMcj (deleted)

/tmp/qemu-open.MeefRi (deleted)

/tmp/qemu-open.oObl1l (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Connections

System Behavior

Analysis Process: efjepc.elf PID: 5424, Parent PID: 5349

General

File Activities

File Opened

File Deleted

File Read

File Written

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Linux Analysis Report
efjepc.elf