Edit tour

Linux Analysis Report
killua.x86_64.elf

Overview

General Information

Sample name:	killua.x86_64.elf
Analysis ID:	1653384
MD5:	ec5c46e4e5efc67637891965f559ff0d
SHA1:	e8d5002aa9bff6ab9e667433aa38a73406bb7d3a
SHA256:	de090b5bad834552936cc77bc52a00a4faebe9efb6103f18aa28751da5b10db0
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1653384
Start date and time:	2025-04-01 05:53:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	killua.x86_64.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/0@6/0

Warnings

VT rate limit hit for: kittylover321.shop

Runtime Messages

Command:	/tmp/killua.x86_64.elf
PID:	5468
Exit Code:
Exit Code Info:
Killed:	True
Standard Output:	t.me/kittylover321 golang botnet guys
Standard Error:

Process Tree

system is lnxubuntu20

killua.x86_64.elf (PID: 5468, Parent: 5385, MD5: ec5c46e4e5efc67637891965f559ff0d) Arguments: /tmp/killua.x86_64.elf

killua.x86_64.elf New Fork (PID: 5474, Parent: 5468)

killua.x86_64.elf New Fork (PID: 5475, Parent: 5468)

sh (PID: 5475, Parent: 5468, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/sh -c "ulimit -n 9999999"

killua.x86_64.elf New Fork (PID: 5476, Parent: 5468)

sh (PID: 5476, Parent: 5468, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/sh -c "ulimit -u 9999999"

killua.x86_64.elf New Fork (PID: 5477, Parent: 5468)

killua.x86_64.elf (PID: 5477, Parent: 5468, MD5: ec5c46e4e5efc67637891965f559ff0d) Arguments: /tmp/killua.x86_64.elf

killua.x86_64.elf New Fork (PID: 5505, Parent: 5477)

udisksd New Fork (PID: 5487, Parent: 802)

dumpe2fs (PID: 5487, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 5572, Parent: 802)

dumpe2fs (PID: 5572, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: killua.x86_64.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: killua.x86_64.elf	Virustotal: Detection: 7%			Perma Link
Source: killua.x86_64.elf	ReversingLabs: Detection: 38%

Source: global traffic

TCP traffic: 192.168.2.13:49470 -> 176.65.134.43:3333

Source: /tmp/killua.x86_64.elf (PID: 5468)	Reads hosts file: /etc/hosts			Jump to behavior
Source: /tmp/killua.x86_64.elf (PID: 5477)	Reads hosts file: /etc/hosts			Jump to behavior

Source: /tmp/killua.x86_64.elf (PID: 5468)	Socket: 127.0.0.1:26645			Jump to behavior
Source: /tmp/killua.x86_64.elf (PID: 5468)	Socket: [::]:46803			Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: kittylover321.shop
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: killua.x86_64.elf

String found in binary or memory: http://upx.sf.net

Source: LOAD without section mappings

Program segment: 0x400000

Source: classification engine

Classification label: mal60.evad.linELF@0/0@6/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $

Source: /tmp/killua.x86_64.elf (PID: 5468)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /tmp/killua.x86_64.elf (PID: 5468)	Reads from proc file: /proc/sys/net/core/somaxconn	Jump to behavior
Source: /tmp/killua.x86_64.elf (PID: 5477)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: killua.x86_64.elf

Submission file: segment LOAD with 7.9997 entropy (max. 8.0)

Source: /tmp/killua.x86_64.elf (PID: 5468)	Queries kernel information via 'uname':			Jump to behavior
Source: /tmp/killua.x86_64.elf (PID: 5477)	Queries kernel information via 'uname':			Jump to behavior

Source: killua.x86_64.elf, 5468.1.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: /tmp//vmware-root_727-4290690966
Source: killua.x86_64.elf, 5468.1.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: /tmp//vmware-root_727-4290690966/tmp//vmware-root_727-4290690966Deleted killua.x86_64.elf
Source: killua.x86_64.elf, 5468.1.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: Deleted vmware-root_727-4290690966
Source: killua.x86_64.elf, 5468.1.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: Successfully listed server on 46803 portKey value successfully set to DiEEybcfCjfvngph/tmp//vmware-root_727-4290690966/tmp//vmware-root_727-4290690966/tmp//vmware-root_727-4290690966Deleted vmware-root_727-4290690966`A
Source: killua.x86_64.elf, 5468.1.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: +/tmp//vmware-root_727-4290690966/tmp//vmware-root_727-4290690966Deleted killua.x86_64.elfDeleted config-err-IN1GlBP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
killua.x86_64.elf	8%	Virustotal		Browse
killua.x86_64.elf	39%	ReversingLabs	Linux.Trojan.Multiverze
killua.x86_64.elf	100%	Avira	LINUX/AVI.Agent.deawb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
kittylover321.shop	176.65.134.43	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	killua.x86_64.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.134.43	kittylover321.shop	Germany		56325	DIOGELO-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.65.134.43	killua.x86.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	killua.mipsel.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	killua.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	killua.arm4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	killua.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	miraint.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	miraint.armhf.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	miraint.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	miraint.arm64.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	mirai.arm64.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	miraint.ppc64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
kittylover321.shop	killua.x86.elf	Get hash	malicious	Unknown	Browse	176.65.134.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIOGELO-ASGB	arm5.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Get hash	malicious	XWorm	Browse	176.65.134.56
	1743362767b39ce9ae90af463b2090fcece5c4349a42c3942cf272d75d62dd81aabd676faf123.dat-decoded.exe	Get hash	malicious	XWorm	Browse	176.65.134.56
	SZf8I0IvEg.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	176.65.134.105
	Z9dgTYzz4x.exe	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.153
	killua.x86.elf	Get hash	malicious	Unknown	Browse	176.65.134.43
	a55fee51fe469b7ed4f23ef3753b380fb548d65f40306962.pptm.ps1	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.153
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	jae1h6e218.exe	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.145
	5IY8PW2nOl.exe	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.145

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.999670433764552
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	killua.x86_64.elf
File size:	850'640 bytes
MD5:	ec5c46e4e5efc67637891965f559ff0d
SHA1:	e8d5002aa9bff6ab9e667433aa38a73406bb7d3a
SHA256:	de090b5bad834552936cc77bc52a00a4faebe9efb6103f18aa28751da5b10db0
SHA512:	aa24e5b8b0de8fc1bfa121714f291a786bf0306cd1144c0a5c217c2f27d11e2021da3a510f23a6d8dbd2e0ec43c7239d5d2486e82a4256e8eb620e4a7e704b74
SSDEEP:	12288:PepoTjKClm8DrEj58zP5lyCnVm8rW5+oufJbZ5fxHuuHkqm2yf65kj:PeKXJdDiW75lkzN+BZHu/qmzRj
TLSH:	DE0523BCCD189734DCB5B935CE3F51676866D52B1299BCB0DCE833769CAC90AB9102B0
File Content Preview:	.ELF..............>.....H.L.....@...................@.8...@.......................@.......@...............................................M.......M..............M..............Q.td......................................................@9UPX!\.......$.'.$.'

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4ce748
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x400000	0x400000	0xcf996	0xcf996	7.9997	0x5	R E	0x1000
LOAD	0x0	0x4d0000	0x4d0000	0x0	0x1c4de0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 182
• 3333 undefined
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 1, 2025 05:54:12.460927010 CEST	45276	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:12.481574059 CEST	49470	3333	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:12.679774046 CEST	80	45276	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:12.683283091 CEST	45280	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:12.707632065 CEST	3333	49470	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:12.899092913 CEST	80	45280	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:12.921870947 CEST	45282	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:13.148857117 CEST	80	45282	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:13.168798923 CEST	45284	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:13.375876904 CEST	80	45284	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:13.377674103 CEST	45286	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:13.588301897 CEST	80	45286	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:13.590661049 CEST	45288	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:13.805051088 CEST	80	45288	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:13.880253077 CEST	45290	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:14.096752882 CEST	80	45290	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:14.106197119 CEST	45292	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:14.313575983 CEST	80	45292	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:14.315463066 CEST	45294	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:14.528036118 CEST	80	45294	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:14.530355930 CEST	45296	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:14.756880045 CEST	80	45296	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:14.758495092 CEST	45298	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:14.985846996 CEST	80	45298	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:14.987322092 CEST	45300	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:15.217860937 CEST	80	45300	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:15.219055891 CEST	45302	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:15.447287083 CEST	80	45302	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:15.448678970 CEST	45304	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:15.662554026 CEST	80	45304	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:15.663595915 CEST	45306	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:15.880233049 CEST	80	45306	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:15.881284952 CEST	45308	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:16.092948914 CEST	80	45308	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:16.094327927 CEST	45310	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:16.320108891 CEST	80	45310	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:16.321254969 CEST	45312	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:16.536082983 CEST	80	45312	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:16.537509918 CEST	45314	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:16.756743908 CEST	80	45314	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:16.758230925 CEST	45316	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:16.976181984 CEST	80	45316	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:16.977345943 CEST	45318	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:17.208245039 CEST	80	45318	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:17.209244013 CEST	45320	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:17.440872908 CEST	80	45320	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:17.442487001 CEST	45322	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:17.650995016 CEST	80	45322	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:17.652081013 CEST	45324	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:17.871896982 CEST	80	45324	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:17.873122931 CEST	45326	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:18.102489948 CEST	80	45326	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:18.103477001 CEST	45328	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:18.318896055 CEST	80	45328	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:18.319969893 CEST	45330	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:18.537797928 CEST	80	45330	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:18.539158106 CEST	45332	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:18.755148888 CEST	80	45332	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:18.756426096 CEST	45334	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:18.992402077 CEST	80	45334	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:18.994015932 CEST	45336	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:19.229177952 CEST	80	45336	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:19.231404066 CEST	45338	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:19.440587997 CEST	80	45338	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:19.441940069 CEST	45340	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:19.662482977 CEST	80	45340	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:19.663827896 CEST	45342	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:19.888664007 CEST	80	45342	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:19.890412092 CEST	45344	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:20.117072105 CEST	80	45344	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:20.118307114 CEST	45346	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:20.325930119 CEST	80	45346	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:20.326862097 CEST	45348	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:20.541774035 CEST	80	45348	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:20.542932034 CEST	45350	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:20.759716988 CEST	80	45350	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:20.760735989 CEST	45352	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:20.977514029 CEST	80	45352	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:20.978687048 CEST	45354	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:21.206202030 CEST	80	45354	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:21.207400084 CEST	45356	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:21.434412956 CEST	80	45356	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:21.435587883 CEST	45358	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:21.655909061 CEST	80	45358	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:21.656676054 CEST	45360	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:21.886364937 CEST	80	45360	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:21.887291908 CEST	45362	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:22.115995884 CEST	80	45362	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:22.117093086 CEST	45364	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:22.335956097 CEST	80	45364	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:22.336960077 CEST	45366	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:22.555211067 CEST	80	45366	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:22.555998087 CEST	45368	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:22.773701906 CEST	80	45368	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:22.774518013 CEST	45370	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:23.004885912 CEST	80	45370	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:23.005985975 CEST	45372	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:23.227255106 CEST	80	45372	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:23.228178978 CEST	45374	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:23.444736004 CEST	80	45374	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:23.445635080 CEST	45376	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:24.460197926 CEST	45376	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:24.682337999 CEST	80	45376	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:24.683294058 CEST	45378	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:24.897340059 CEST	80	45378	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:24.898049116 CEST	45380	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:25.112046957 CEST	80	45380	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:25.112941980 CEST	45382	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:25.339797020 CEST	80	45382	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:25.341077089 CEST	45384	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:25.559649944 CEST	80	45384	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:25.560611963 CEST	45386	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:25.790366888 CEST	80	45386	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:25.791363955 CEST	45388	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:26.010101080 CEST	80	45388	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:26.011045933 CEST	45390	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:26.235769987 CEST	80	45390	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:26.236941099 CEST	45392	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:26.456334114 CEST	80	45392	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:26.457356930 CEST	45394	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:26.686223984 CEST	80	45394	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:26.688565969 CEST	45396	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:26.919851065 CEST	80	45396	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:26.921024084 CEST	45398	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:27.149693012 CEST	80	45398	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:27.150830030 CEST	45400	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:27.367434025 CEST	80	45400	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:27.368928909 CEST	45402	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:27.593571901 CEST	80	45402	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:27.594897985 CEST	45404	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:27.809474945 CEST	80	45404	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:27.810216904 CEST	45406	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:28.028131962 CEST	80	45406	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:28.028922081 CEST	45408	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:28.248676062 CEST	80	45408	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:28.249672890 CEST	45410	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:29.260215044 CEST	45410	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:29.475389957 CEST	80	45410	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:29.476717949 CEST	45412	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:29.702379942 CEST	80	45412	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:29.703509092 CEST	45414	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:29.926290035 CEST	80	45414	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:29.927167892 CEST	45416	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:30.156619072 CEST	80	45416	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:30.157426119 CEST	45418	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:30.381198883 CEST	80	45418	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:30.381968021 CEST	45420	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:30.602076054 CEST	80	45420	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:30.602799892 CEST	45422	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:30.886758089 CEST	80	45422	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:30.888078928 CEST	45424	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:31.100845098 CEST	80	45424	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:31.102046967 CEST	45426	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:31.313582897 CEST	80	45426	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:31.314965963 CEST	45428	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:31.522109985 CEST	80	45428	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:31.523654938 CEST	45430	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:31.731180906 CEST	80	45430	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:31.732745886 CEST	45432	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:31.957184076 CEST	80	45432	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:31.958394051 CEST	45434	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:32.176723003 CEST	80	45434	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:32.177553892 CEST	45436	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:32.400109053 CEST	80	45436	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:32.401222944 CEST	45438	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:32.615340948 CEST	80	45438	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:32.616411924 CEST	45440	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:32.826205969 CEST	80	45440	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:32.827228069 CEST	45442	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:33.043903112 CEST	80	45442	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:33.044920921 CEST	45444	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:33.262036085 CEST	80	45444	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:33.263092995 CEST	45446	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:33.480927944 CEST	80	45446	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:33.482112885 CEST	45448	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:33.703102112 CEST	80	45448	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:33.704457998 CEST	45450	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:33.925785065 CEST	80	45450	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:33.927020073 CEST	45452	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:34.956295967 CEST	45452	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:35.185283899 CEST	80	45452	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:35.186213017 CEST	45454	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:35.402612925 CEST	80	45454	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:35.403425932 CEST	45456	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:35.627505064 CEST	80	45456	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:35.628887892 CEST	45458	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:35.842144012 CEST	80	45458	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:35.843375921 CEST	45460	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:36.078432083 CEST	80	45460	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:36.079705000 CEST	45462	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:36.295114040 CEST	80	45462	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:36.296184063 CEST	45464	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:36.511603117 CEST	80	45464	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:36.512782097 CEST	45466	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:36.721302032 CEST	80	45466	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:36.722312927 CEST	45468	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:36.932097912 CEST	80	45468	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:36.933087111 CEST	45470	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:37.169403076 CEST	80	45470	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:37.170356989 CEST	45472	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:37.390182018 CEST	80	45472	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:37.391465902 CEST	45474	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:37.596679926 CEST	80	45474	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:37.597837925 CEST	45476	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:37.826421022 CEST	80	45476	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:37.827810049 CEST	45478	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:38.828296900 CEST	45478	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:39.053323030 CEST	80	45478	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:39.054286003 CEST	45480	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:39.263314009 CEST	80	45480	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:39.264286041 CEST	45482	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:39.475250006 CEST	80	45482	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:39.476412058 CEST	45484	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:39.698884010 CEST	80	45484	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:39.699912071 CEST	45486	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:39.916594982 CEST	80	45486	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:39.917825937 CEST	45488	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:40.940423012 CEST	45488	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:41.179182053 CEST	80	45488	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:41.180141926 CEST	45490	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:41.397151947 CEST	80	45490	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:41.397910118 CEST	45492	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:41.617922068 CEST	80	45492	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:41.619414091 CEST	45494	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:41.833707094 CEST	80	45494	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:41.834898949 CEST	45496	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:42.050576925 CEST	80	45496	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:42.052031994 CEST	45498	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:42.262367010 CEST	80	45498	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:42.263781071 CEST	45500	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:42.482067108 CEST	80	45500	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:42.483139038 CEST	45502	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:42.703000069 CEST	80	45502	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:42.703983068 CEST	45504	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:42.933490038 CEST	80	45504	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:42.934284925 CEST	45506	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:43.154433966 CEST	80	45506	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:43.155313015 CEST	45508	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:43.370980978 CEST	80	45508	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:43.371902943 CEST	45510	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:43.587311029 CEST	80	45510	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:43.588466883 CEST	45512	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:43.801650047 CEST	80	45512	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:43.802927971 CEST	45514	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:44.026434898 CEST	80	45514	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:44.027436018 CEST	45516	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:44.249614000 CEST	80	45516	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:44.250842094 CEST	45518	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:44.464148045 CEST	80	45518	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:44.465142965 CEST	45520	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:44.678471088 CEST	80	45520	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:44.679524899 CEST	45522	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:44.905185938 CEST	80	45522	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:44.906215906 CEST	45524	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:45.932449102 CEST	45524	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:46.149065018 CEST	80	45524	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:46.150064945 CEST	45526	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:46.359236956 CEST	80	45526	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:46.360367060 CEST	45528	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:46.581392050 CEST	80	45528	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:46.582163095 CEST	45530	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:46.803478956 CEST	80	45530	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:46.804352999 CEST	45532	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:47.014595032 CEST	80	45532	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:47.015439987 CEST	45534	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:47.238704920 CEST	80	45534	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:47.239475012 CEST	45536	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:47.460558891 CEST	80	45536	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:47.461631060 CEST	45538	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:47.679929972 CEST	80	45538	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:47.680877924 CEST	45540	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:47.909354925 CEST	80	45540	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:47.910583019 CEST	45542	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:48.138906956 CEST	80	45542	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:48.140465021 CEST	45544	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:48.357266903 CEST	80	45544	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:48.358479977 CEST	45546	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:48.586287022 CEST	80	45546	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:48.587692976 CEST	45548	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:48.806267023 CEST	80	45548	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:48.807600975 CEST	45550	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:49.033463955 CEST	80	45550	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:49.034419060 CEST	45552	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:49.260230064 CEST	80	45552	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:49.261204004 CEST	45554	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:49.484595060 CEST	80	45554	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:49.485567093 CEST	45556	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:49.702431917 CEST	80	45556	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:49.703548908 CEST	45558	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:49.932971001 CEST	80	45558	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:49.934323072 CEST	45560	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:50.167320967 CEST	80	45560	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:50.168687105 CEST	45562	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:50.398091078 CEST	80	45562	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:50.399379969 CEST	45564	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:50.623903990 CEST	80	45564	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:50.625042915 CEST	45566	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:50.847136974 CEST	80	45566	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:50.848018885 CEST	45568	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:51.064356089 CEST	80	45568	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:51.065336943 CEST	45570	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:51.287884951 CEST	80	45570	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:51.288830996 CEST	45572	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:51.496754885 CEST	80	45572	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:51.497704029 CEST	45574	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:51.710781097 CEST	80	45574	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:51.711625099 CEST	45576	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:51.945245981 CEST	80	45576	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:51.946280956 CEST	45578	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:52.168593884 CEST	80	45578	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:52.169686079 CEST	45580	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:52.398468018 CEST	80	45580	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:52.399574041 CEST	45582	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:52.624702930 CEST	80	45582	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:52.625907898 CEST	45584	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:52.850816965 CEST	80	45584	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:52.851485014 CEST	45586	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:53.074718952 CEST	80	45586	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:53.075597048 CEST	45588	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:53.299423933 CEST	80	45588	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:53.300291061 CEST	45590	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:53.513439894 CEST	80	45590	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:53.514362097 CEST	45592	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:53.729378939 CEST	80	45592	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:53.730086088 CEST	45594	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:53.939944029 CEST	80	45594	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:53.941040039 CEST	45596	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:54.154505968 CEST	80	45596	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:54.155781031 CEST	45598	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:54.365310907 CEST	80	45598	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:54.366373062 CEST	45600	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:54.578782082 CEST	80	45600	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:54.579957008 CEST	45602	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:54.794848919 CEST	80	45602	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:54.796293974 CEST	45604	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:55.015192032 CEST	80	45604	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:55.015961885 CEST	45606	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:55.234525919 CEST	80	45606	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:55.235477924 CEST	45608	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:55.453175068 CEST	80	45608	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:55.454344034 CEST	45610	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:55.675507069 CEST	80	45610	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:55.676477909 CEST	45612	80	192.168.2.13	176.65.134.43
Apr 1, 2025 05:54:55.892283916 CEST	80	45612	176.65.134.43	192.168.2.13
Apr 1, 2025 05:54:55.893456936 CEST	45614	80	192.168.2.13	176.65.134.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 1, 2025 05:54:11.770576000 CEST	48408	53	192.168.2.13	8.8.8.8
Apr 1, 2025 05:54:11.774619102 CEST	52851	53	192.168.2.13	8.8.8.8
Apr 1, 2025 05:54:11.866609097 CEST	53	48408	8.8.8.8	192.168.2.13
Apr 1, 2025 05:54:12.047218084 CEST	53	52851	8.8.8.8	192.168.2.13
Apr 1, 2025 05:54:12.705821037 CEST	51415	53	192.168.2.13	8.8.8.8
Apr 1, 2025 05:54:12.715226889 CEST	56601	53	192.168.2.13	8.8.8.8
Apr 1, 2025 05:54:12.809717894 CEST	53	51415	8.8.8.8	192.168.2.13
Apr 1, 2025 05:54:12.812504053 CEST	53	56601	8.8.8.8	192.168.2.13
Apr 1, 2025 05:56:57.771780014 CEST	58195	53	192.168.2.13	1.1.1.1
Apr 1, 2025 05:56:57.771912098 CEST	41460	53	192.168.2.13	1.1.1.1
Apr 1, 2025 05:56:57.861500025 CEST	53	41460	1.1.1.1	192.168.2.13
Apr 1, 2025 05:56:57.861531973 CEST	53	58195	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 1, 2025 05:54:11.770576000 CEST	192.168.2.13	8.8.8.8	0x4952	Standard query (0)	kittylover321.shop	28	IN (0x0001)	false
Apr 1, 2025 05:54:11.774619102 CEST	192.168.2.13	8.8.8.8	0xcdf8	Standard query (0)	kittylover321.shop	A (IP address)	IN (0x0001)	false
Apr 1, 2025 05:54:12.705821037 CEST	192.168.2.13	8.8.8.8	0xf8ec	Standard query (0)	kittylover321.shop	A (IP address)	IN (0x0001)	false
Apr 1, 2025 05:54:12.715226889 CEST	192.168.2.13	8.8.8.8	0xadb7	Standard query (0)	kittylover321.shop	28	IN (0x0001)	false
Apr 1, 2025 05:56:57.771780014 CEST	192.168.2.13	1.1.1.1	0xc6db	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Apr 1, 2025 05:56:57.771912098 CEST	192.168.2.13	1.1.1.1	0x1b6	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 1, 2025 05:54:12.047218084 CEST	8.8.8.8	192.168.2.13	0xcdf8	No error (0)	kittylover321.shop	176.65.134.43	A (IP address)	IN (0x0001)	false
Apr 1, 2025 05:54:12.809717894 CEST	8.8.8.8	192.168.2.13	0xf8ec	No error (0)	kittylover321.shop	176.65.134.43	A (IP address)	IN (0x0001)	false
Apr 1, 2025 05:56:57.861531973 CEST	1.1.1.1	192.168.2.13	0xc6db	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Apr 1, 2025 05:56:57.861531973 CEST	1.1.1.1	192.168.2.13	0xc6db	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: killua.x86_64.elf PID: 5468, Parent PID: 5385

General

Start time (UTC):	03:54:10
Start date (UTC):	01/04/2025
Path:	/tmp/killua.x86_64.elf
Arguments:	/tmp/killua.x86_64.elf
File size:	850640 bytes
MD5 hash:	ec5c46e4e5efc67637891965f559ff0d

File Activities

File Opened

File Deleted

File Read

Directory Enumerated

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: killua.x86_64.elf PID: 5474, Parent PID: 5468

General

Start time (UTC):	03:54:10
Start date (UTC):	01/04/2025
Path:	/tmp/killua.x86_64.elf
Arguments:	-
File size:	850640 bytes
MD5 hash:	ec5c46e4e5efc67637891965f559ff0d

Analysis Process: killua.x86_64.elf PID: 5475, Parent PID: 5468

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/tmp/killua.x86_64.elf
Arguments:	-
File size:	850640 bytes
MD5 hash:	ec5c46e4e5efc67637891965f559ff0d

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5475, Parent PID: 5468

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/usr/bin/sh
Arguments:	/usr/bin/sh -c "ulimit -n 9999999"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: killua.x86_64.elf PID: 5476, Parent PID: 5468

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/tmp/killua.x86_64.elf
Arguments:	-
File size:	850640 bytes
MD5 hash:	ec5c46e4e5efc67637891965f559ff0d

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 5476, Parent PID: 5468

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/usr/bin/sh
Arguments:	/usr/bin/sh -c "ulimit -u 9999999"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: killua.x86_64.elf PID: 5477, Parent PID: 5468

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/tmp/killua.x86_64.elf
Arguments:	-
File size:	850640 bytes
MD5 hash:	ec5c46e4e5efc67637891965f559ff0d

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: killua.x86_64.elf PID: 5477, Parent PID: 5468

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/tmp/killua.x86_64.elf
Arguments:	/tmp/killua.x86_64.elf
File size:	850640 bytes
MD5 hash:	ec5c46e4e5efc67637891965f559ff0d

File Activities

File Opened

File Read

Process Activities

Process Forked

Signal Sent

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: killua.x86_64.elf PID: 5505, Parent PID: 5477

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/tmp/killua.x86_64.elf
Arguments:	-
File size:	850640 bytes
MD5 hash:	ec5c46e4e5efc67637891965f559ff0d

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: udisksd PID: 5487, Parent PID: 802

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5487, Parent PID: 802

General

Start time (UTC):	03:54:11
Start date (UTC):	01/04/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: udisksd PID: 5572, Parent PID: 802

General

Start time (UTC):	03:54:55
Start date (UTC):	01/04/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5572, Parent PID: 802

General

Start time (UTC):	03:54:55
Start date (UTC):	01/04/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report killua.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: killua.x86_64.elf PID: 5468, Parent PID: 5385

General

File Activities

File Opened

File Deleted

File Read

Directory Enumerated

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: killua.x86_64.elf PID: 5474, Parent PID: 5468

Linux Analysis Report
killua.x86_64.elf