Edit tour

Linux Analysis Report
morte.mips.elf

Overview

General Information

Sample name:	morte.mips.elf
Analysis ID:	1635785
MD5:	09f60899e0b38aaafd655e8d3d1c56e4
SHA1:	e1304182b7497dc90a7d88e518154f78860ea4b6
SHA256:	9a54c892b1423cc1f9360fd78a2ddc5438f6965472cf376effa91b81787b62eb
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes the "rm" command used to delete files or directories

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635785
Start date and time:	2025-03-12 00:47:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	morte.mips.elf
Detection:	MAL
Classification:	mal52.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/morte.mips.elf
PID:	5438
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5409, Parent: 3578)

rm (PID: 5409, Parent: 3578, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.FGWcN1GZfS /tmp/tmp.fkpLTFUKL9 /tmp/tmp.Dmj36ab6nf

dash New Fork (PID: 5410, Parent: 3578)

rm (PID: 5410, Parent: 3578, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.FGWcN1GZfS /tmp/tmp.fkpLTFUKL9 /tmp/tmp.Dmj36ab6nf

morte.mips.elf (PID: 5438, Parent: 5344, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/morte.mips.elf

morte.mips.elf New Fork (PID: 5441, Parent: 5438)

morte.mips.elf New Fork (PID: 5443, Parent: 5441)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: morte.mips.elf	Virustotal: Detection: 37%			Perma Link
Source: morte.mips.elf	ReversingLabs: Detection: 34%

Source: global traffic

TCP traffic: 192.168.2.13:38714 -> 176.65.134.62:7777

Source: /tmp/morte.mips.elf (PID: 5441)

Socket: 127.0.0.1:2644

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62

Source: morte.mips.elf

String found in binary or memory: http://upx.sf.net

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

Source: LOAD without section mappings

Program segment: 0x100000

Source: classification engine

Classification label: mal52.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /usr/bin/dash (PID: 5409)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FGWcN1GZfS /tmp/tmp.fkpLTFUKL9 /tmp/tmp.Dmj36ab6nf			Jump to behavior
Source: /usr/bin/dash (PID: 5410)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FGWcN1GZfS /tmp/tmp.fkpLTFUKL9 /tmp/tmp.Dmj36ab6nf			Jump to behavior

Source: morte.mips.elf

Submission file: segment LOAD with 7.9532 entropy (max. 8.0)

Source: /tmp/morte.mips.elf (PID: 5438)

Queries kernel information via 'uname':

Jump to behavior

Source: morte.mips.elf, 5438.1.00005555eb707000.00005555eb7ae000.rw-.sdmp, morte.mips.elf, 5443.1.00005555eb707000.00005555eb78e000.rw-.sdmp	Binary or memory string: UU!/etc/qemu-binfmt/mips
Source: morte.mips.elf, 5438.1.00007ffc79ae7000.00007ffc79b08000.rw-.sdmp, morte.mips.elf, 5443.1.00007ffc79ae7000.00007ffc79b08000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/morte.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/morte.mips.elf
Source: morte.mips.elf, 5438.1.00005555eb707000.00005555eb7ae000.rw-.sdmp, morte.mips.elf, 5443.1.00005555eb707000.00005555eb78e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: morte.mips.elf, 5438.1.00007ffc79ae7000.00007ffc79b08000.rw-.sdmp, morte.mips.elf, 5443.1.00007ffc79ae7000.00007ffc79b08000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
morte.mips.elf	38%	Virustotal		Browse
morte.mips.elf	34%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	morte.mips.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.134.62	unknown	Germany		56325	DIOGELO-ASGB	false
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
176.65.134.62	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	morte.x86.elf	Get hash	malicious	Unknown	Browse
	morte.sh4.elf	Get hash	malicious	Unknown	Browse
	morte.m68k.elf	Get hash	malicious	Unknown	Browse
	morte.arm7.elf	Get hash	malicious	Unknown	Browse
	morte.arm7.elf	Get hash	malicious	Mirai	Browse
	morte.x86.elf	Get hash	malicious	Unknown	Browse
	morte.x64.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
185.125.190.26	na.elf	Get hash	malicious	Prometei	Browse
	aarch64.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Mirai	Browse
	hide.m68k.elf	Get hash	malicious	Unknown	Browse
	morte.arm6.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	nabarm6.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.spc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	morte.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
DIOGELO-ASGB	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.x86.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.m68k.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm7.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm7.elf	Get hash	malicious	Mirai	Browse	176.65.134.62
	morte.x86.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.x64.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	176.65.134.62

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.951178671737291
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	morte.mips.elf
File size:	48'048 bytes
MD5:	09f60899e0b38aaafd655e8d3d1c56e4
SHA1:	e1304182b7497dc90a7d88e518154f78860ea4b6
SHA256:	9a54c892b1423cc1f9360fd78a2ddc5438f6965472cf376effa91b81787b62eb
SHA512:	4ed8bb4def087d1b7b419d297ef0c460a601b29d80f0fd5e06dd61e04762c227a752dd1891f85a8931e29167756aac7a04aa7c80cbcec0c9704fa1ca8a10daac
SSDEEP:	768:MrRCcIezkU7moQwlqDsg5woih5RcqjWSNvD+ovTbwXJgGlzDpbuR1J0:oiezNh5RfHFD+acVVJu2
TLSH:	3C23F1F5AA4448DEC9E0DDBA9235C35C5B183E3684812486E64EAB0C8FD7058F1E7B92
File Content Preview:	.ELF.......................0...4.........4. ...(.......................t...t.................F...F..................7...UPX!.d........S...S........T.......?.E.h4...@b..) ..]....E...@......$.K.{.d.U......'.H..`.P^Hzt.O..E0.....c...Y..^.....................

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10a730
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x100000	0x100000	0xba74	0xba74	7.9532	0x5	R E	0x10000
LOAD	0x99d0	0x4699d0	0x4699d0	0x0	0x0	0.0000	0x6	RW	0x10000

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2025 00:47:52.811676979 CET	38714	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:52.816670895 CET	7777	38714	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:52.816737890 CET	38714	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:52.821018934 CET	38714	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:52.825745106 CET	7777	38714	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:52.825891018 CET	38714	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:52.830617905 CET	7777	38714	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:55.165870905 CET	7777	38714	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:55.165981054 CET	38714	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:55.166702986 CET	38714	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:55.167186022 CET	38716	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:55.173363924 CET	7777	38716	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:55.173435926 CET	38716	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:55.174283981 CET	38716	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:55.179032087 CET	7777	38716	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:55.179114103 CET	38716	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:55.183865070 CET	7777	38716	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:59.613517046 CET	7777	38716	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:59.613697052 CET	38716	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:59.613739967 CET	38716	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:59.614269018 CET	38718	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:59.619025946 CET	7777	38718	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:59.619106054 CET	38718	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:59.619820118 CET	38718	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:59.624444008 CET	7777	38718	176.65.134.62	192.168.2.13
Mar 12, 2025 00:47:59.624497890 CET	38718	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:47:59.629184961 CET	7777	38718	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:01.075479031 CET	7777	38718	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:01.075594902 CET	38718	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:01.075625896 CET	38718	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:01.076143980 CET	38720	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:01.080862045 CET	7777	38720	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:01.080924034 CET	38720	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:01.081684113 CET	38720	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:01.086309910 CET	7777	38720	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:01.086357117 CET	38720	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:01.091026068 CET	7777	38720	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:04.127885103 CET	48202	443	192.168.2.13	185.125.190.26
Mar 12, 2025 00:48:11.091237068 CET	38720	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:11.096132994 CET	7777	38720	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:22.475055933 CET	7777	38720	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:22.475706100 CET	38720	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:22.480493069 CET	7777	38720	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:23.479159117 CET	38722	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:23.483895063 CET	7777	38722	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:23.483964920 CET	38722	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:23.485024929 CET	38722	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:23.489798069 CET	7777	38722	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:23.489854097 CET	38722	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:23.494538069 CET	7777	38722	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:25.929042101 CET	7777	38722	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:25.929322004 CET	38722	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:25.929439068 CET	38722	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:25.930138111 CET	38724	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:25.934892893 CET	7777	38724	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:25.934968948 CET	38724	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:25.936079979 CET	38724	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:25.940762997 CET	7777	38724	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:25.940819025 CET	38724	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:25.945519924 CET	7777	38724	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:32.669203043 CET	7777	38724	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:32.669394970 CET	38724	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:32.669567108 CET	38724	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:32.670368910 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:32.675158978 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:32.675256968 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:32.676469088 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:32.681139946 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:32.681267023 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:32.685960054 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:34.110042095 CET	7777	38726	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:34.110160112 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:34.110207081 CET	38726	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:34.110932112 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:34.115658998 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:34.115721941 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:34.116666079 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:34.121345043 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:34.121395111 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:34.126144886 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:35.557048082 CET	7777	38728	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:35.557230949 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:35.557317972 CET	38728	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:35.558070898 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:35.562971115 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:35.563043118 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:35.563643932 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:35.568648100 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:35.568825006 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:35.573504925 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:35.871877909 CET	48202	443	192.168.2.13	185.125.190.26
Mar 12, 2025 00:48:41.059906006 CET	7777	38730	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:41.060103893 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:41.060146093 CET	38730	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:41.060596943 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:41.065296888 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:41.065388918 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:41.066353083 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:41.071060896 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:41.071106911 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:41.075850010 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:42.507298946 CET	7777	38732	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:42.507610083 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:42.507610083 CET	38732	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:42.507972002 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:42.512692928 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:42.512767076 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:42.513351917 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:42.518057108 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:42.518136978 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:42.522804976 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:46.955364943 CET	7777	38734	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:46.955585957 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:46.955585957 CET	38734	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:46.956325054 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:46.961038113 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:46.961158037 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:46.962094069 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:46.966742039 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:46.966804981 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:46.971415043 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:48.406905890 CET	7777	38736	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:48.407018900 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:48.407052040 CET	38736	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:48.407484055 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:48.412195921 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:48.412328005 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:48.413219929 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:48.417911053 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:48.418004036 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:48.422672987 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:49.844827890 CET	7777	38738	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:49.844933033 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:49.844966888 CET	38738	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:49.845448017 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:49.850172043 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:49.850270987 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:49.851314068 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:49.855936050 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:49.856003046 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:49.860636950 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:54.035814047 CET	7777	38740	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:54.035960913 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:54.036050081 CET	38740	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:54.036761999 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:54.041517019 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:54.041640997 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:54.042732000 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:54.047377110 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:54.047476053 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:54.052175999 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:55.165019989 CET	7777	38742	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:55.165242910 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:55.165296078 CET	38742	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:55.166043997 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:55.171657085 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:55.171745062 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:55.172823906 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:55.178600073 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:55.178664923 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:55.183296919 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:56.270901918 CET	7777	38744	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:56.271109104 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:56.271167040 CET	38744	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:56.271853924 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:56.276551962 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:56.276607037 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:56.277391911 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:56.282249928 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:56.282293081 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:56.286938906 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:57.353404045 CET	7777	38746	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:57.353497028 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:57.353538990 CET	38746	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:57.353981972 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:57.358642101 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:57.358719110 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:57.359297037 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:57.363917112 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:57.363962889 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:57.368638992 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:58.484174967 CET	7777	38748	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:58.484293938 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:58.484329939 CET	38748	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:58.484741926 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:58.489465952 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:58.489522934 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:58.490186930 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:58.494895935 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:58.494951963 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:58.499623060 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:59.660687923 CET	7777	38750	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:59.660784006 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:59.660816908 CET	38750	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:59.661227942 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:59.665960073 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:59.666016102 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:59.666532040 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:59.671210051 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 00:48:59.671272039 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:48:59.675936937 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:00.927154064 CET	7777	38752	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:00.927253008 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:00.927280903 CET	38752	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:00.927675009 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:00.934186935 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:00.934302092 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:00.934864998 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:00.941457033 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:00.941525936 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:00.948103905 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:02.158332109 CET	7777	38754	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:02.158472061 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:02.158566952 CET	38754	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:02.159250021 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:02.163916111 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:02.164005995 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:02.165009022 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:02.169715881 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:02.169771910 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:02.174531937 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:03.377685070 CET	7777	38756	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:03.377769947 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:03.377804995 CET	38756	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:03.378191948 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:03.382896900 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:03.382999897 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:03.383594990 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:03.388240099 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:03.388309002 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:03.392960072 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:04.579293013 CET	7777	38758	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:04.579417944 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:04.579451084 CET	38758	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:04.580004930 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:04.584785938 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:04.584857941 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:04.585365057 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:04.590013981 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:04.590070963 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:04.594733000 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:05.746069908 CET	7777	38760	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:05.746203899 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:05.746284008 CET	38760	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:05.746704102 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:05.751336098 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:05.751394987 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:05.751975060 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:05.756599903 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:05.756637096 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:05.761374950 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:06.903166056 CET	7777	38762	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:06.903275013 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:06.903316975 CET	38762	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:06.903722048 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:06.908452034 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:06.908554077 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:06.909121037 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:06.913901091 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:06.913954973 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:06.918601036 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:08.054413080 CET	7777	38764	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:08.054573059 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:08.054769993 CET	38764	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:08.055469036 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:08.060137987 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:08.060220003 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:08.061218977 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:08.065946102 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:08.066003084 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:08.070710897 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:09.235497952 CET	7777	38766	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:09.235733986 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:09.235852957 CET	38766	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:09.236618042 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:09.241343021 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:09.241394043 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:09.241969109 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:09.246639013 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:09.246685982 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:09.251328945 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:10.293382883 CET	7777	38768	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:10.293492079 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:10.293517113 CET	38768	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:10.294003010 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:10.298718929 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:10.298806906 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:10.299417973 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:10.304044962 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:10.304090023 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:10.308700085 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:11.436578989 CET	7777	38770	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:11.436681032 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:11.436723948 CET	38770	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:11.437184095 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:11.441869020 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:11.441920042 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:11.442467928 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:11.447177887 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:11.447246075 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:11.451930046 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:12.474967957 CET	7777	38772	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:12.475075960 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:12.475112915 CET	38772	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:12.475572109 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:12.480226994 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:12.480330944 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:12.481303930 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:12.485972881 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:12.486031055 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:12.490736961 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:13.473963976 CET	7777	38774	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:13.474070072 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:13.474176884 CET	38774	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:13.475029945 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:13.479751110 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:13.479847908 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:13.480854034 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:13.485481977 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:13.485533953 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:13.490178108 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:14.596860886 CET	7777	38776	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:14.596998930 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:14.596998930 CET	38776	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:14.597481966 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:14.602164030 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:14.602264881 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:14.602823019 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:14.607455969 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:14.607522011 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:14.612195969 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:15.699665070 CET	7777	38778	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:15.699860096 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:15.700009108 CET	38778	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:15.700606108 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:15.705282927 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:15.705373049 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:15.706034899 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:15.710695982 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:15.710808039 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:15.715473890 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:16.712682009 CET	7777	38780	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:16.712800980 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:16.713000059 CET	38780	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:16.713471889 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:16.718168974 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:16.718252897 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:16.719115019 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:16.723871946 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:16.723928928 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:16.728535891 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:17.696969986 CET	7777	38782	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:17.697088003 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:17.697134972 CET	38782	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:17.697670937 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:17.702404022 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:17.702513933 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:17.703665972 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:17.708293915 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:17.708374023 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:17.713082075 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:18.503772974 CET	7777	38784	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:18.503966093 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:18.504009008 CET	38784	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:18.504477024 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:18.509146929 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:18.509197950 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:18.509768009 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:18.514398098 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:18.514444113 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:18.519059896 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:19.215835094 CET	7777	38786	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:19.215972900 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.216022968 CET	38786	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.216649055 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.221364975 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:19.221474886 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.222017050 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.226711035 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:19.226818085 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.231478930 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:19.994005919 CET	7777	38788	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:19.994159937 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.994193077 CET	38788	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.994693041 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:19.999450922 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:19.999520063 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.000138044 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.004843950 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:20.004894972 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.009624004 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:20.894598961 CET	7777	38790	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:20.894771099 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.894850969 CET	38790	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.895567894 CET	38792	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.900278091 CET	7777	38792	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:20.900326014 CET	38792	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.900914907 CET	38792	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.905575991 CET	7777	38792	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:20.905622005 CET	38792	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:20.910312891 CET	7777	38792	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:22.302937984 CET	7777	38792	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:22.303152084 CET	38792	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:22.303282976 CET	38792	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:22.303663015 CET	38794	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:22.308382034 CET	7777	38794	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:22.308475971 CET	38794	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:22.309005022 CET	38794	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:22.313678026 CET	7777	38794	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:22.313719034 CET	38794	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:22.318480968 CET	7777	38794	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:29.431420088 CET	7777	38794	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:29.431525946 CET	38794	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:29.431561947 CET	38794	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:29.432058096 CET	38796	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:29.437098980 CET	7777	38796	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:29.437180996 CET	38796	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:29.437769890 CET	38796	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:29.443350077 CET	7777	38796	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:29.443459034 CET	38796	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:29.449022055 CET	7777	38796	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:30.869422913 CET	7777	38796	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:30.869538069 CET	38796	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:30.869587898 CET	38796	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:30.870239973 CET	38798	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:30.874924898 CET	7777	38798	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:30.875025988 CET	38798	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:30.876085997 CET	38798	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:30.881031036 CET	7777	38798	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:30.881087065 CET	38798	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:30.886034012 CET	7777	38798	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:33.252089977 CET	7777	38798	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:33.252199888 CET	38798	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:33.252240896 CET	38798	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:33.252840042 CET	38800	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:33.258987904 CET	7777	38800	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:33.259083033 CET	38800	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:33.259685993 CET	38800	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:33.265691042 CET	7777	38800	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:33.265748024 CET	38800	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:33.271966934 CET	7777	38800	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:38.417514086 CET	7777	38800	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:38.417680025 CET	38800	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:38.417711973 CET	38800	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:38.418117046 CET	38802	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:38.422805071 CET	7777	38802	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:38.422852993 CET	38802	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:38.423301935 CET	38802	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:38.428205013 CET	7777	38802	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:38.428239107 CET	38802	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:38.432851076 CET	7777	38802	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:39.872275114 CET	7777	38802	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:39.872448921 CET	38802	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:39.872556925 CET	38802	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:39.873200893 CET	38804	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:39.877899885 CET	7777	38804	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:39.877996922 CET	38804	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:39.878876925 CET	38804	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:39.883573055 CET	7777	38804	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:39.883647919 CET	38804	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:39.888286114 CET	7777	38804	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:41.331464052 CET	7777	38804	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:41.331701040 CET	38804	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:41.331701040 CET	38804	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:41.332330942 CET	38806	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:41.337021112 CET	7777	38806	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:41.337141037 CET	38806	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:41.338059902 CET	38806	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:41.342696905 CET	7777	38806	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:41.342760086 CET	38806	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:41.347516060 CET	7777	38806	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:42.801803112 CET	7777	38806	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:42.801968098 CET	38806	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:42.802015066 CET	38806	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:42.802726030 CET	38808	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:42.807476044 CET	7777	38808	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:42.807550907 CET	38808	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:42.808259964 CET	38808	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:42.812941074 CET	7777	38808	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:42.812994003 CET	38808	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:42.817715883 CET	7777	38808	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:44.277156115 CET	7777	38808	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:44.277327061 CET	38808	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:44.277379990 CET	38808	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:44.277956009 CET	38810	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:44.282650948 CET	7777	38810	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:44.282742977 CET	38810	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:44.283396006 CET	38810	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:44.288065910 CET	7777	38810	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:44.288129091 CET	38810	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:44.292833090 CET	7777	38810	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:48.739260912 CET	7777	38810	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:48.739449024 CET	38810	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:48.739531040 CET	38810	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:48.740119934 CET	38812	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:48.744853020 CET	7777	38812	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:48.744940996 CET	38812	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:48.745954037 CET	38812	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:48.750606060 CET	7777	38812	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:48.750664949 CET	38812	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:48.755350113 CET	7777	38812	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:53.190335035 CET	7777	38812	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:53.190454006 CET	38812	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:53.190495968 CET	38812	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:53.190977097 CET	38814	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:53.195792913 CET	7777	38814	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:53.195854902 CET	38814	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:53.196434021 CET	38814	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:53.201087952 CET	7777	38814	176.65.134.62	192.168.2.13
Mar 12, 2025 00:49:53.201128006 CET	38814	7777	192.168.2.13	176.65.134.62
Mar 12, 2025 00:49:53.205764055 CET	7777	38814	176.65.134.62	192.168.2.13

System Behavior

Analysis Process: dash PID: 5409, Parent PID: 3578

General

Start time (UTC):	23:47:47
Start date (UTC):	11/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5409, Parent PID: 3578

General

Start time (UTC):	23:47:47
Start date (UTC):	11/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.FGWcN1GZfS /tmp/tmp.fkpLTFUKL9 /tmp/tmp.Dmj36ab6nf
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5410, Parent PID: 3578

General

Start time (UTC):	23:47:47
Start date (UTC):	11/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5410, Parent PID: 3578

General

Start time (UTC):	23:47:47
Start date (UTC):	11/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.FGWcN1GZfS /tmp/tmp.fkpLTFUKL9 /tmp/tmp.Dmj36ab6nf
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: morte.mips.elf PID: 5438, Parent PID: 5344

General

Start time (UTC):	23:47:51
Start date (UTC):	11/03/2025
Path:	/tmp/morte.mips.elf
Arguments:	/tmp/morte.mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: morte.mips.elf PID: 5441, Parent PID: 5438

General

Start time (UTC):	23:47:51
Start date (UTC):	11/03/2025
Path:	/tmp/morte.mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: morte.mips.elf PID: 5443, Parent PID: 5441

General

Start time (UTC):	23:47:51
Start date (UTC):	11/03/2025
Path:	/tmp/morte.mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report morte.mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 5409, Parent PID: 3578

General

Chronological Activities

Analysis Process: rm PID: 5409, Parent PID: 3578

General

Chronological Activities

Analysis Process: dash PID: 5410, Parent PID: 3578

General

Chronological Activities

Analysis Process: rm PID: 5410, Parent PID: 3578

General

Chronological Activities

Analysis Process: morte.mips.elf PID: 5438, Parent PID: 5344

General

Chronological Activities

Analysis Process: morte.mips.elf PID: 5441, Parent PID: 5438

General

Chronological Activities

Analysis Process: morte.mips.elf PID: 5443, Parent PID: 5441

General

Chronological Activities

Linux Analysis Report
morte.mips.elf