Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:na.elf
Analysis ID:1540996
MD5:2ae67507543de72ba63ef6933bf45cff
SHA1:31969621b68748d0dfa969f121853f370750e95a
SHA256:bb132b4c7e4457e3578a4e8d2de0423c0a67a26bd4c2ea61969ee1dacc53806c
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1540996
Start date and time:2024-10-24 11:21:45 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 41s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:na.elf
Detection:MAL
Classification:mal56.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample

Warnings

  • Max analysis timeout: 600s exceeded, the analysis took too long
  • VT rate limit hit for: na.elf

Runtime Messages

Command:/tmp/na.elf
PID:5510
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory

Process Tree

  • system is lnxubuntu20
  • na.elf (PID: 5510, Parent: 5428, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: na.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: na.elfReversingLabs: Detection: 68%
Source: global trafficTCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknownNetwork traffic detected: HTTP traffic on port 46540 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@2/0
Source: /tmp/na.elf (PID: 5510)Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5510.1.00007ffe3dd4b000.00007ffe3dd6c000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5510.1.000055bad3560000.000055bad368e000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: na.elf, 5510.1.00007ffe3dd4b000.00007ffe3dd6c000.rw-.sdmpBinary or memory string: qemu: %s: %s
Source: na.elf, 5510.1.00007ffe3dd4b000.00007ffe3dd6c000.rw-.sdmpBinary or memory string: leqemu: %s: %s
Source: na.elf, 5510.1.000055bad3560000.000055bad368e000.rw-.sdmpBinary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: na.elf, 5510.1.000055bad3560000.000055bad368e000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 5510.1.00007ffe3dd4b000.00007ffe3dd6c000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: na.elf, 5510.1.000055bad3560000.000055bad368e000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
na.elf68%ReversingLabsLinux.Backdoor.Mirai
na.elf100%AviraEXP/ELF.Mirai.T

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.24
truefalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    185.125.190.26
    		unknownUnited Kingdom
    		41231CANONICAL-ASGBfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    185.125.190.26botnet.mips.elfGet hashmaliciousUnknownBrowse
      bot.arm6.elfGet hashmaliciousMirai, OkiruBrowse
        na.elfGet hashmaliciousUnknownBrowse
          bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
            sshd.elfGet hashmaliciousUnknownBrowse
              pozY1lq94j.elfGet hashmaliciousOkiruBrowse
                arm4.elfGet hashmaliciousUnknownBrowse
                  pty.elfGet hashmaliciousTsunamiBrowse
                    na.elfGet hashmaliciousMiraiBrowse
                      bin.armv4l.elfGet hashmaliciousGafgyt, MiraiBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        daisy.ubuntu.comla.bot.arm.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        botnet.mips.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        bot.arm6.elfGet hashmaliciousMirai, OkiruBrowse
                        • 162.213.35.25
                        la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        hidakibest.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                        • 162.213.35.24
                        la.bot.mips.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        boatnet.x86.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.25
                        x86.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        garm7.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.24

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        CANONICAL-ASGBnsharm6.elfGet hashmaliciousMiraiBrowse
                        • 91.189.91.42
                        botnet.mips.elfGet hashmaliciousUnknownBrowse
                        • 185.125.190.26
                        boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                        • 91.189.91.42
                        bot.arm6.elfGet hashmaliciousMirai, OkiruBrowse
                        • 185.125.190.26
                        na.elfGet hashmaliciousUnknownBrowse
                        • 185.125.190.26
                        BoM00gWx1d.elfGet hashmaliciousUnknownBrowse
                        • 91.189.91.42
                        hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                        • 91.189.91.42
                        boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                        • 91.189.91.42
                        boatnet.arm.elfGet hashmaliciousMiraiBrowse
                        • 91.189.91.42
                        na.elfGet hashmaliciousUnknownBrowse
                        • 91.189.91.42

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        ⊘No created / dropped files found

                        Static File Info

                        General

                        File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
                        Entropy (8bit):5.943095322791845
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:na.elf
                        File size:50'636 bytes
                        MD5:2ae67507543de72ba63ef6933bf45cff
                        SHA1:31969621b68748d0dfa969f121853f370750e95a
                        SHA256:bb132b4c7e4457e3578a4e8d2de0423c0a67a26bd4c2ea61969ee1dacc53806c
                        SHA512:54dd811f5486f009040b749cb4beb5ae557ae3c20c428865016d2383688e5ce4fbd69c6fb761247f75e1943b2ac54775428253b4416060d5470d6f496aa8ec99
                        SSDEEP:1536:/dE6mvHP4XkHTwuIjMRA0IuHfz4J1MgCjY5g:/+6oHP4XkAMzRtjY+
                        TLSH:C133C69178816A2BC2E013BFF5AE618E336167A8D1CF322BC9115F15B7C562F0CA7B51
                        File Content Preview:.ELF...a..........(.........4...........4. ...(.........4...4...4...................................................................................................................................................Q.td............................/lib/ld-uCl

                        Static ELF Info

                        ELF header

                        Class:ELF32
                        Data:2's complement, little endian
                        Version:1 (current)
                        Machine:ARM
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:ARM - ABI
                        ABI Version:0
                        Entry Point Address:0x8dfc
                        Flags:0x2
                        ELF Header Size:52
                        Program Header Offset:52
                        Program Header Size:32
                        Number of Program Headers:6
                        Section Header Offset:49916
                        Section Header Size:40
                        Number of Section Headers:18
                        Header String Table Index:17

                        Sections

                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                        NULL0x00x00x00x00x0000
                        .interpPROGBITS0x80f40xf40x140x00x2A001
                        .hashHASH0x81080x1080x2240x40x2A304
                        .dynsymDYNSYM0x832c0x32c0x4400x100x2A414
                        .dynstrSTRTAB0x876c0x76c0x2280x00x2A001
                        .rel.pltREL0x89940x9940x1580x80x2A374
                        .initPROGBITS0x8aec0xaec0x180x00x6AX004
                        .pltPROGBITS0x8b040xb040x2180x40x6AX004
                        .textPROGBITS0x8d1c0xd1c0xa5300x00x6AX004
                        .finiPROGBITS0x1324c0xb24c0x140x00x6AX004
                        .rodataPROGBITS0x132600xb2600xea00x00x2A004
                        .ctorsPROGBITS0x1c1040xc1040x80x00x3WA004
                        .dtorsPROGBITS0x1c10c0xc10c0x80x00x3WA004
                        .dynamicDYNAMIC0x1c1180xc1180x980x80x3WA404
                        .gotPROGBITS0x1c1b00xc1b00xb80x40x3WA004
                        .dataPROGBITS0x1c2680xc2680x200x00x3WA004
                        .bssNOBITS0x1c2880xc2880x1480x00x3WA004
                        .shstrtabSTRTAB0x00xc2880x730x00x0001

                        Program Segments

                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        PHDR0x340x80340x80340xc00xc02.15760x5R E0x4
                        INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                        LOAD0x00x80000x80000xc1000xc1005.97720x5R E0x8000.interp .hash .dynsym .dynstr .rel.plt .init .plt .text .fini .rodata
                        LOAD0xc1040x1c1040x1c1040x1840x2cc2.30630x6RW 0x8000.ctors .dtors .dynamic .got .data .bss
                        DYNAMIC0xc1180x1c1180x1c1180x980x981.92470x6RW 0x4.dynamic
                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                        Dynamic Tags

                        TypeMetaValueTag
                        DT_NEEDEDsharedliblibc.so.00x1
                        DT_INITvalue0x8aec0xc
                        DT_FINIvalue0x1324c0xd
                        DT_HASHvalue0x81080x4
                        DT_STRTABvalue0x876c0x5
                        DT_SYMTABvalue0x832c0x6
                        DT_STRSZbytes5520xa
                        DT_SYMENTbytes160xb
                        DT_DEBUGvalue0x00x15
                        DT_PLTGOTvalue0x1c1b00x3
                        DT_PLTRELSZbytes3440x2
                        DT_PLTRELpltrelDT_REL0x14
                        DT_JMPRELvalue0x89940x17
                        DT_NULLvalue0x00x0

                        Symbols

                        NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                        .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                        __aeabi_idiv0.dynsym0x1320c4FUNC<unknown>DEFAULT8
                        __aeabi_ldiv0.dynsym0x1320c4FUNC<unknown>DEFAULT8
                        __aeabi_uidiv.dynsym0x12f4c0FUNC<unknown>DEFAULT8
                        __aeabi_uidivmod.dynsym0x1304424FUNC<unknown>DEFAULT8
                        __bss_end__.dynsym0x1c3d00NOTYPE<unknown>DEFAULTSHN_ABS
                        __bss_start.dynsym0x1c2880NOTYPE<unknown>DEFAULTSHN_ABS
                        __bss_start__.dynsym0x1c2880NOTYPE<unknown>DEFAULTSHN_ABS
                        __data_start.dynsym0x1c2680NOTYPE<unknown>DEFAULT17
                        __div0.dynsym0x1320c4FUNC<unknown>DEFAULT8
                        __end__.dynsym0x1c3d00NOTYPE<unknown>DEFAULTSHN_ABS
                        __errno_location.dynsym0x8ca432FUNC<unknown>DEFAULTSHN_UNDEF
                        __modsi3.dynsym0x13128228FUNC<unknown>DEFAULT8
                        __uClibc_main.dynsym0x8c68488FUNC<unknown>DEFAULTSHN_UNDEF
                        __udivsi3.dynsym0x12f4c248FUNC<unknown>DEFAULT8
                        __umodsi3.dynsym0x1305c204FUNC<unknown>DEFAULT8
                        _bss_end__.dynsym0x1c3d00NOTYPE<unknown>DEFAULTSHN_ABS
                        _edata.dynsym0x1c2880NOTYPE<unknown>DEFAULTSHN_ABS
                        _end.dynsym0x1c3d00NOTYPE<unknown>DEFAULTSHN_ABS
                        _start.dynsym0x8dfc80FUNC<unknown>DEFAULT8
                        abort.dynsym0x8bcc352FUNC<unknown>DEFAULTSHN_UNDEF
                        atoi.dynsym0x012FUNC<unknown>DEFAULTSHN_UNDEF
                        bind.dynsym0x8bfc44FUNC<unknown>DEFAULTSHN_UNDEF
                        calloc.dynsym0x8bd888FUNC<unknown>DEFAULTSHN_UNDEF
                        clock.dynsym0x8cc852FUNC<unknown>DEFAULTSHN_UNDEF
                        close.dynsym0x8cec44FUNC<unknown>DEFAULTSHN_UNDEF
                        closedir.dynsym0x0196FUNC<unknown>DEFAULTSHN_UNDEF
                        connect.dynsym0x8b3c44FUNC<unknown>DEFAULTSHN_UNDEF
                        exit.dynsym0x8cb0172FUNC<unknown>DEFAULTSHN_UNDEF
                        fcntl.dynsym0x8ce0116FUNC<unknown>DEFAULTSHN_UNDEF
                        fork.dynsym0x8c5c44FUNC<unknown>DEFAULTSHN_UNDEF
                        free.dynsym0x8cf8288FUNC<unknown>DEFAULTSHN_UNDEF
                        getpid.dynsym0x8b5444FUNC<unknown>DEFAULTSHN_UNDEF
                        getppid.dynsym0x8c8044FUNC<unknown>DEFAULTSHN_UNDEF
                        getsockname.dynsym0x8d1044FUNC<unknown>DEFAULTSHN_UNDEF
                        getsockopt.dynsym0x8c9848FUNC<unknown>DEFAULTSHN_UNDEF
                        inet_addr.dynsym0x8c0836FUNC<unknown>DEFAULTSHN_UNDEF
                        ioctl.dynsym0x8b2480FUNC<unknown>DEFAULTSHN_UNDEF
                        kill.dynsym0x8bf044FUNC<unknown>DEFAULTSHN_UNDEF
                        listen.dynsym0x044FUNC<unknown>DEFAULTSHN_UNDEF
                        malloc.dynsym0x8b78400FUNC<unknown>DEFAULTSHN_UNDEF
                        memcpy.dynsym0x8b6c4FUNC<unknown>DEFAULTSHN_UNDEF
                        memset.dynsym0x8c74156FUNC<unknown>DEFAULTSHN_UNDEF
                        open.dynsym0x8cbc92FUNC<unknown>DEFAULTSHN_UNDEF
                        opendir.dynsym0x0264FUNC<unknown>DEFAULTSHN_UNDEF
                        prctl.dynsym0x8b6048FUNC<unknown>DEFAULTSHN_UNDEF
                        rand.dynsym0x8c204FUNC<unknown>DEFAULTSHN_UNDEF
                        read.dynsym0x8c3844FUNC<unknown>DEFAULTSHN_UNDEF
                        readdir.dynsym0x0224FUNC<unknown>DEFAULTSHN_UNDEF
                        readlink.dynsym0x044FUNC<unknown>DEFAULTSHN_UNDEF
                        realloc.dynsym0x8c50312FUNC<unknown>DEFAULTSHN_UNDEF
                        recv.dynsym0x8b3044FUNC<unknown>DEFAULTSHN_UNDEF
                        recvfrom.dynsym0x8b9052FUNC<unknown>DEFAULTSHN_UNDEF
                        select.dynsym0x8ba848FUNC<unknown>DEFAULTSHN_UNDEF
                        send.dynsym0x8bc044FUNC<unknown>DEFAULTSHN_UNDEF
                        sendto.dynsym0x8c4452FUNC<unknown>DEFAULTSHN_UNDEF
                        setsid.dynsym0x8cd444FUNC<unknown>DEFAULTSHN_UNDEF
                        setsockopt.dynsym0x8c1448FUNC<unknown>DEFAULTSHN_UNDEF
                        sigaddset.dynsym0x8bb448FUNC<unknown>DEFAULTSHN_UNDEF
                        sigemptyset.dynsym0x8b4824FUNC<unknown>DEFAULTSHN_UNDEF
                        signal.dynsym0x8c2c200FUNC<unknown>DEFAULTSHN_UNDEF
                        sigprocmask.dynsym0x8d0484FUNC<unknown>DEFAULTSHN_UNDEF
                        sleep.dynsym0x8b84420FUNC<unknown>DEFAULTSHN_UNDEF
                        socket.dynsym0x8b9c44FUNC<unknown>DEFAULTSHN_UNDEF
                        strcpy.dynsym0x8b1828FUNC<unknown>DEFAULTSHN_UNDEF
                        time.dynsym0x8c8c44FUNC<unknown>DEFAULTSHN_UNDEF
                        unlink.dynsym0x044FUNC<unknown>DEFAULTSHN_UNDEF
                        write.dynsym0x8be444FUNC<unknown>DEFAULTSHN_UNDEF

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Oct 24, 2024 11:22:48.550000906 CEST46540443192.168.2.14185.125.190.26
                        Oct 24, 2024 11:23:20.032710075 CEST46540443192.168.2.14185.125.190.26

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Oct 24, 2024 11:25:23.453068018 CEST3464753192.168.2.141.1.1.1
                        Oct 24, 2024 11:25:23.453149080 CEST4395453192.168.2.141.1.1.1
                        Oct 24, 2024 11:25:23.462691069 CEST53439541.1.1.1192.168.2.14
                        Oct 24, 2024 11:25:23.474582911 CEST53346471.1.1.1192.168.2.14

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Oct 24, 2024 11:25:23.453068018 CEST192.168.2.141.1.1.10xddd3Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                        Oct 24, 2024 11:25:23.453149080 CEST192.168.2.141.1.1.10xde89Standard query (0)daisy.ubuntu.com28IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Oct 24, 2024 11:25:23.474582911 CEST1.1.1.1192.168.2.140xddd3No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                        Oct 24, 2024 11:25:23.474582911 CEST1.1.1.1192.168.2.140xddd3No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                        System Behavior

                        General

                        Start time (UTC):09:22:38
                        Start date (UTC):24/10/2024
                        Path:/tmp/na.elf
                        Arguments:/tmp/na.elf
                        File size:4956856 bytes
                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                        Chronological Activities