Edit tour

Linux Analysis Report
ppc.elf

Overview

General Information

Sample name:	ppc.elf
Analysis ID:	1579194
MD5:	55ef7e4a2d52afc084b8ebcb16e79d34
SHA1:	c8074b9659ece056c83d89b2cdbc8a419c007e60
SHA256:	cdbfc2d15e914a3bfb81d1f737058b3209a6ace7b6ff3d8ffaeb6e7a54318ce1
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579194
Start date and time:	2024-12-21 04:01:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ppc.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@66/0

Runtime Messages

Command:	/tmp/ppc.elf
PID:	5451
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	I just wanna look after my cats, man.
Standard Error:

Process Tree

system is lnxubuntu20

ppc.elf (PID: 5451, Parent: 5377, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ppc.elf

ppc.elf New Fork (PID: 5453, Parent: 5451)

ppc.elf New Fork (PID: 5513, Parent: 5453)

ppc.elf New Fork (PID: 5514, Parent: 5453)

ppc.elf New Fork (PID: 5533, Parent: 5514)

ppc.elf New Fork (PID: 5547, Parent: 5533)

ppc.elf New Fork (PID: 5454, Parent: 5451)

ppc.elf New Fork (PID: 5457, Parent: 5451)

ppc.elf New Fork (PID: 5478, Parent: 5457)

ppc.elf New Fork (PID: 5488, Parent: 5478)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5453.1.00007f7870001000.00007f7870012000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5451.1.00007f7870001000.00007f7870012000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ppc.elf

ReversingLabs: Detection: 18%

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 185.72.8.231 ports 6142,1,2,4,6,7711,6657,13201,15889
Source: global traffic	TCP traffic: 176.32.32.113 ports 8364,15242,1,2,4,5,1449
Source: global traffic	TCP traffic: 80.78.26.121 ports 18159,15242,1,2,4,5,10464,12744
Source: global traffic	TCP traffic: 212.64.215.71 ports 19984,8776,24927,9578,0,1,14705,4,23690,5,6,20094,9939,10465,12489
Source: global traffic	TCP traffic: 212.192.13.95 ports 8672,5342,15242,1,2,4,5,10465
Source: global traffic	TCP traffic: 212.60.5.153 ports 8222,7893,15242,2782,1,2,4,5
Source: global traffic	TCP traffic: 86.107.100.19 ports 6142,22734,9555,1,2,4,6,14575

Sends malformed DNS queries

Source: global traffic	DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]

Source: global traffic	TCP traffic: 192.168.2.13:57890 -> 176.32.32.113:15242
Source: global traffic	TCP traffic: 192.168.2.13:37202 -> 212.192.13.95:15242
Source: global traffic	TCP traffic: 192.168.2.13:36608 -> 212.60.5.153:15242
Source: global traffic	TCP traffic: 192.168.2.13:32966 -> 80.78.26.121:15242
Source: global traffic	TCP traffic: 192.168.2.13:39776 -> 185.72.8.231:6142
Source: global traffic	TCP traffic: 192.168.2.13:60612 -> 86.107.100.19:6142
Source: global traffic	TCP traffic: 192.168.2.13:35790 -> 212.64.215.71:10465

Source: /tmp/ppc.elf (PID: 5451)

Socket: 127.0.0.1:1172

Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 109.91.184.21
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 109.91.184.21
Source: unknown	UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 109.91.184.21
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown	UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 168.138.12.137
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 168.138.12.137
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 109.91.184.21
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 80.152.203.134
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 213.202.211.221
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 109.91.184.21

Source: global traffic	DNS traffic detected: DNS query: hikvision.geek
Source: global traffic	DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic	DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic	DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic	DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: catlovingfools.geek. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/0@66/0

Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5620/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5618/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5619/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5533/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5632/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5633/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5513/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5634/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5514/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5514/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5635/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5617/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5570/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5630/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5631/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5293/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5629/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5621/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5600/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5622/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5623/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5547/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5569/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5624/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5625/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5626/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5627/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5454)	File opened: /proc/5628/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5591/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5630/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5620/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5631/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5590/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5293/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5618/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5629/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5619/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5621/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5632/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5622/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5633/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5623/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5634/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5624/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5635/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5625/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5626/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5627/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5617/status	Jump to behavior
Source: /tmp/ppc.elf (PID: 5513)	File opened: /proc/5628/status	Jump to behavior

Source: /tmp/ppc.elf (PID: 5451)

Queries kernel information via 'uname':

Jump to behavior

Source: ppc.elf, 5451.1.000056541b065000.000056541b13b000.rw-.sdmp, ppc.elf, 5453.1.000056541b065000.000056541b13b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc/usr/lib/x86_64-linu
Source: ppc.elf, 5453.1.000056541b065000.000056541b13b000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: ppc.elf, 5451.1.000056541b065000.000056541b13b000.rw-.sdmp, ppc.elf, 5453.1.000056541b065000.000056541b13b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 5453.1.000056541b065000.000056541b13b000.rw-.sdmp	Binary or memory string: TV/ppc/sr/bin0!/usr/bin/VGAuthService1/usr/lib/x86_64-linux-gnu/xfce4/notifyd!/proc/1691/exe0!/proc/727/exe1/proc/3212/exe/ppc/ro10!/proc/1648/exe0!/usr/bin/vmtoolsd1/proc/3342/exe/ppc/10!/proc/1609/exe0!/proc/765/exe!/proc/2972/exe/ppc/pro!/proc/5435/exe/ppc/proa@
Source: ppc.elf, 5451.1.00007ffdb41cf000.00007ffdb41f0000.rw-.sdmp, ppc.elf, 5453.1.00007ffdb41cf000.00007ffdb41f0000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: ppc.elf, 5451.1.000056541b065000.000056541b13b000.rw-.sdmp, ppc.elf, 5453.1.000056541b065000.000056541b13b000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1/usr/lib/udisks2/udisksd1/proc/109/exe
Source: ppc.elf, 5451.1.00007ffdb41cf000.00007ffdb41f0000.rw-.sdmp, ppc.elf, 5453.1.00007ffdb41cf000.00007ffdb41f0000.rw-.sdmp	Binary or memory string: aXx86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: ppc.elf, type: SAMPLE
Source: Yara match	File source: 5453.1.00007f7870001000.00007f7870012000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5451.1.00007f7870001000.00007f7870012000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: ppc.elf, type: SAMPLE
Source: Yara match	File source: 5453.1.00007f7870001000.00007f7870012000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5451.1.00007f7870001000.00007f7870012000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ppc.elf	18%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
shitrocket.dyn	86.107.100.19	true	false	high
catlovingfools.geek	212.192.13.95	true	false	high
hikvision.geek	212.64.215.71	true	false	high
catlovingfools.geek. [malformed]	unknown	unknown	false	high
hikvision.geek. [malformed]	unknown	unknown	false	high
shitrocket.dyn. [malformed]	unknown	unknown	false	high
catvision.dyn. [malformed]	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.72.8.231	unknown	Russian Federation	57844	SPD-NETTR	true
176.32.32.113	unknown	Russian Federation	51659	ASBAXETRU	true
80.78.26.121	unknown	Cyprus	37560	CYBERDYNELR	true
212.64.215.71	hikvision.geek	Turkey	15395	RACKSPACE-LONGB	false
212.192.13.95	catlovingfools.geek	Russian Federation	49392	ASBAXETNRU	false
212.60.5.153	unknown	Russian Federation	49392	ASBAXETNRU	true
86.107.100.19	shitrocket.dyn	Romania	38995	AMG-ASRO	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
176.32.32.113	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
80.78.26.121	nshkppc.elf	Get hash	malicious	Unknown	Browse
	nshkmpsl.elf	Get hash	malicious	Unknown	Browse
	nshkmips.elf	Get hash	malicious	Unknown	Browse
	nshkarm7.elf	Get hash	malicious	Unknown	Browse
	nshkarm5.elf	Get hash	malicious	Unknown	Browse
	nshkarm.elf	Get hash	malicious	Unknown	Browse
212.64.215.71	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
	nshkppc.elf	Get hash	malicious	Unknown	Browse
	nshkmpsl.elf	Get hash	malicious	Unknown	Browse
	nshkmips.elf	Get hash	malicious	Unknown	Browse
	nshkarm7.elf	Get hash	malicious	Unknown	Browse
	nshkarm5.elf	Get hash	malicious	Unknown	Browse
	nshkarm.elf	Get hash	malicious	Unknown	Browse
212.192.13.95	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
212.60.5.153	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
185.72.8.231	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
86.107.100.19	nshkmpsl.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
catlovingfools.geek	nshkarm7.elf	Get hash	malicious	Mirai	Browse	212.192.13.95
catlovingfools.geek	nshkmips.elf	Get hash	malicious	Mirai	Browse	80.78.26.121
daisy.ubuntu.com	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.i486.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
shitrocket.dyn	nshkmips.elf	Get hash	malicious	Mirai	Browse	176.32.32.113
shitrocket.dyn	nsharm7.elf	Get hash	malicious	Mirai	Browse	212.192.13.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETRU	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	176.32.32.113
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	176.32.38.130
	quotation.exe	Get hash	malicious	FormBook	Browse	176.32.38.130
	ppc.elf	Get hash	malicious	Unknown	Browse	45.147.200.148
	hmips.elf	Get hash	malicious	Unknown	Browse	45.147.200.148
	arm4.elf	Get hash	malicious	Unknown	Browse	45.140.169.21
	mips.elf	Get hash	malicious	Unknown	Browse	176.32.39.112
	ppc.elf	Get hash	malicious	Unknown	Browse	176.32.39.112
	hmips.elf	Get hash	malicious	Unknown	Browse	185.22.155.152
	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	176.32.38.183
SPD-NETTR	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	2.58.124.230
	63Blg3Psdt.exe	Get hash	malicious	DCRat	Browse	185.118.143.220
	https://vmehy.daxizzobui.top/	Get hash	malicious	Unknown	Browse	195.133.45.183
	http://umjkitjtsk.top/crp/325gewfkj345	Get hash	malicious	Unknown	Browse	195.133.45.183
	http://draggedline.org	Get hash	malicious	Unknown	Browse	45.12.65.149
	LisectAVT_2403002C_106.exe	Get hash	malicious	Darkbot	Browse	195.133.45.237
	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Get hash	malicious	Bdaejec, PrivateLoader	Browse	212.193.30.29
	wO2hW34tnC.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	45.158.226.175
	pVwXSHLriO.elf	Get hash	malicious	Mirai, Moobot	Browse	45.67.86.157
CYBERDYNELR	nshkppc.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkmpsl.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkmips.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkarm.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	GjNVpV53SR.exe	Get hash	malicious	Quasar	Browse	80.78.28.83
	p-p.c-440.DUSK.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.193.127.129
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader	Browse	80.78.24.30
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse	80.78.24.30

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.205996023120609
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ppc.elf
File size:	71'112 bytes
MD5:	55ef7e4a2d52afc084b8ebcb16e79d34
SHA1:	c8074b9659ece056c83d89b2cdbc8a419c007e60
SHA256:	cdbfc2d15e914a3bfb81d1f737058b3209a6ace7b6ff3d8ffaeb6e7a54318ce1
SHA512:	1423da68b0de28cb012ebe72e3f4dd8c117297721a864535bdd2d50f527355f3092eb19a8956123223f489ac5f3474a8ab9466da50aa2ef2be11dfbcadd5e001
SSDEEP:	1536:dDoEdqoxzqR2KoPE3NRrerpEIS6c2WNAJH2Nyn2Y:deXRsWRGEIS72FNn2Y
TLSH:	45634B42730C0943D1A35DB0363F2BE193EEEA9122E4E684655FAB4991B2F331586FDD
File Content Preview:	.ELF...........................4.........4. ...(.......................$...$..............................T.........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?..........$..../...@..\?........+../...A..$8...})......N..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70632
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xf264	0x0	0x6	AX	4
.fini	PROGBITS	0x1000f31c	0xf31c	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000f340	0xf340	0x19e4	0x0	0x2	A	8
.ctors	PROGBITS	0x10021000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x10021008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x10021018	0x11018	0x344	0x0	0x3	WA	8
.sdata	PROGBITS	0x1002135c	0x1135c	0x40	0x0	0x3	WA	4
.sbss	NOBITS	0x1002139c	0x1139c	0x88	0x0	0x3	WA	4
.bss	NOBITS	0x10021424	0x1139c	0x508c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1139c	0x4b	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x10d24	0x10d24	6.2910	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x11000	0x10021000	0x10021000	0x39c	0x54b0	3.0301	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 04:01:52.903543949 CET	57890	15242	192.168.2.13	176.32.32.113
Dec 21, 2024 04:01:52.906831980 CET	37202	15242	192.168.2.13	212.192.13.95
Dec 21, 2024 04:01:53.023139000 CET	15242	57890	176.32.32.113	192.168.2.13
Dec 21, 2024 04:01:53.023225069 CET	57890	15242	192.168.2.13	176.32.32.113
Dec 21, 2024 04:01:53.023452044 CET	57890	15242	192.168.2.13	176.32.32.113
Dec 21, 2024 04:01:53.026261091 CET	15242	37202	212.192.13.95	192.168.2.13
Dec 21, 2024 04:01:53.026318073 CET	37202	15242	192.168.2.13	212.192.13.95
Dec 21, 2024 04:01:53.026582003 CET	37202	15242	192.168.2.13	212.192.13.95
Dec 21, 2024 04:01:53.088130951 CET	36608	15242	192.168.2.13	212.60.5.153
Dec 21, 2024 04:01:53.117969990 CET	32966	15242	192.168.2.13	80.78.26.121
Dec 21, 2024 04:01:53.142930984 CET	15242	57890	176.32.32.113	192.168.2.13
Dec 21, 2024 04:01:53.143002033 CET	57890	15242	192.168.2.13	176.32.32.113
Dec 21, 2024 04:01:53.146035910 CET	15242	37202	212.192.13.95	192.168.2.13
Dec 21, 2024 04:01:53.146215916 CET	37202	15242	192.168.2.13	212.192.13.95
Dec 21, 2024 04:01:53.210294008 CET	15242	36608	212.60.5.153	192.168.2.13
Dec 21, 2024 04:01:53.210448980 CET	36608	15242	192.168.2.13	212.60.5.153
Dec 21, 2024 04:01:53.210599899 CET	36608	15242	192.168.2.13	212.60.5.153
Dec 21, 2024 04:01:53.237538099 CET	15242	32966	80.78.26.121	192.168.2.13
Dec 21, 2024 04:01:53.237605095 CET	32966	15242	192.168.2.13	80.78.26.121
Dec 21, 2024 04:01:53.237812042 CET	32966	15242	192.168.2.13	80.78.26.121
Dec 21, 2024 04:01:53.262645960 CET	15242	57890	176.32.32.113	192.168.2.13
Dec 21, 2024 04:01:53.265774012 CET	15242	37202	212.192.13.95	192.168.2.13
Dec 21, 2024 04:01:53.329977036 CET	15242	36608	212.60.5.153	192.168.2.13
Dec 21, 2024 04:01:53.330018997 CET	36608	15242	192.168.2.13	212.60.5.153
Dec 21, 2024 04:01:53.357727051 CET	15242	32966	80.78.26.121	192.168.2.13
Dec 21, 2024 04:01:53.357831955 CET	32966	15242	192.168.2.13	80.78.26.121
Dec 21, 2024 04:01:53.449621916 CET	15242	36608	212.60.5.153	192.168.2.13
Dec 21, 2024 04:01:53.477813005 CET	15242	32966	80.78.26.121	192.168.2.13
Dec 21, 2024 04:02:03.028379917 CET	57890	15242	192.168.2.13	176.32.32.113
Dec 21, 2024 04:02:03.036489010 CET	37202	15242	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:03.148205042 CET	15242	57890	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:03.156094074 CET	15242	37202	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:03.220350981 CET	36608	15242	192.168.2.13	212.60.5.153
Dec 21, 2024 04:02:03.244339943 CET	32966	15242	192.168.2.13	80.78.26.121
Dec 21, 2024 04:02:03.340369940 CET	15242	36608	212.60.5.153	192.168.2.13
Dec 21, 2024 04:02:03.364162922 CET	15242	32966	80.78.26.121	192.168.2.13
Dec 21, 2024 04:02:14.925791025 CET	15242	37202	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:14.925899982 CET	15242	57890	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:14.926022053 CET	37202	15242	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:14.926091909 CET	57890	15242	192.168.2.13	176.32.32.113
Dec 21, 2024 04:02:15.045924902 CET	15242	37202	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:15.045939922 CET	15242	57890	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:15.160099983 CET	15242	32966	80.78.26.121	192.168.2.13
Dec 21, 2024 04:02:15.160339117 CET	32966	15242	192.168.2.13	80.78.26.121
Dec 21, 2024 04:02:15.279858112 CET	15242	32966	80.78.26.121	192.168.2.13
Dec 21, 2024 04:02:20.160993099 CET	39776	6142	192.168.2.13	185.72.8.231
Dec 21, 2024 04:02:20.162849903 CET	60612	6142	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.280518055 CET	6142	39776	185.72.8.231	192.168.2.13
Dec 21, 2024 04:02:20.280601025 CET	39776	6142	192.168.2.13	185.72.8.231
Dec 21, 2024 04:02:20.280623913 CET	39776	6142	192.168.2.13	185.72.8.231
Dec 21, 2024 04:02:20.282372952 CET	6142	60612	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:20.282490015 CET	60612	6142	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.282589912 CET	60612	6142	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.395329952 CET	41242	9555	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.400085926 CET	6142	39776	185.72.8.231	192.168.2.13
Dec 21, 2024 04:02:20.400130033 CET	39776	6142	192.168.2.13	185.72.8.231
Dec 21, 2024 04:02:20.402005911 CET	6142	60612	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:20.402126074 CET	60612	6142	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.515640974 CET	9555	41242	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:20.515867949 CET	41242	9555	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.515892982 CET	41242	9555	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.520621061 CET	6142	39776	185.72.8.231	192.168.2.13
Dec 21, 2024 04:02:20.522248030 CET	6142	60612	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:20.635442972 CET	9555	41242	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:20.635545969 CET	41242	9555	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:20.755141020 CET	9555	41242	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:21.196492910 CET	15242	36608	212.60.5.153	192.168.2.13
Dec 21, 2024 04:02:21.196696043 CET	36608	15242	192.168.2.13	212.60.5.153
Dec 21, 2024 04:02:21.316303968 CET	15242	36608	212.60.5.153	192.168.2.13
Dec 21, 2024 04:02:21.654505014 CET	6142	39776	185.72.8.231	192.168.2.13
Dec 21, 2024 04:02:21.654597044 CET	39776	6142	192.168.2.13	185.72.8.231
Dec 21, 2024 04:02:21.654697895 CET	39776	6142	192.168.2.13	185.72.8.231
Dec 21, 2024 04:02:25.483004093 CET	6142	60612	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:25.483114004 CET	60612	6142	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:25.483223915 CET	60612	6142	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:26.432413101 CET	46294	10465	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:26.551983118 CET	10465	46294	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:26.552073002 CET	46294	10465	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:26.552149057 CET	46294	10465	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:26.671700001 CET	10465	46294	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:26.671770096 CET	46294	10465	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:26.791215897 CET	10465	46294	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:26.896204948 CET	35790	10465	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:27.015717983 CET	10465	35790	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:27.015809059 CET	35790	10465	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:27.015894890 CET	35790	10465	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:27.135395050 CET	10465	35790	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:27.135458946 CET	35790	10465	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:27.254954100 CET	10465	35790	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:31.044116020 CET	34232	8364	192.168.2.13	176.32.32.113
Dec 21, 2024 04:02:31.163723946 CET	8364	34232	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:31.163857937 CET	34232	8364	192.168.2.13	176.32.32.113
Dec 21, 2024 04:02:31.163959980 CET	34232	8364	192.168.2.13	176.32.32.113
Dec 21, 2024 04:02:31.284056902 CET	8364	34232	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:31.284231901 CET	34232	8364	192.168.2.13	176.32.32.113
Dec 21, 2024 04:02:31.403753996 CET	8364	34232	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:41.594387054 CET	10465	35790	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:41.594604969 CET	35790	10465	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:41.594669104 CET	35790	10465	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:42.410785913 CET	9555	41242	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:42.410994053 CET	41242	9555	192.168.2.13	86.107.100.19
Dec 21, 2024 04:02:42.530495882 CET	9555	41242	86.107.100.19	192.168.2.13
Dec 21, 2024 04:02:47.113650084 CET	41056	8672	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:47.233731985 CET	8672	41056	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:47.233911991 CET	41056	8672	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:47.234029055 CET	41056	8672	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:47.354146957 CET	8672	41056	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:47.354480028 CET	41056	8672	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:47.474425077 CET	8672	41056	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:47.962471008 CET	50740	9939	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:48.082108021 CET	9939	50740	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:48.082269907 CET	50740	9939	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:48.082379103 CET	50740	9939	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:48.201920033 CET	9939	50740	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:48.202048063 CET	50740	9939	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:48.322933912 CET	9939	50740	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:48.473562002 CET	10465	46294	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:48.473953009 CET	46294	10465	192.168.2.13	212.192.13.95
Dec 21, 2024 04:02:48.593910933 CET	10465	46294	212.192.13.95	192.168.2.13
Dec 21, 2024 04:02:49.562191963 CET	9939	50740	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:49.562429905 CET	50740	9939	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:49.562736988 CET	50740	9939	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:53.082988977 CET	8364	34232	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:53.083137989 CET	34232	8364	192.168.2.13	176.32.32.113
Dec 21, 2024 04:02:53.202866077 CET	8364	34232	176.32.32.113	192.168.2.13
Dec 21, 2024 04:02:53.720364094 CET	37182	14705	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:53.841202974 CET	14705	37182	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:53.841579914 CET	37182	14705	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:53.841581106 CET	37182	14705	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:53.961812973 CET	14705	37182	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:53.962131023 CET	37182	14705	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:54.081933975 CET	14705	37182	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:54.831460953 CET	38064	8776	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:54.951149940 CET	8776	38064	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:54.951368093 CET	38064	8776	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:54.951474905 CET	38064	8776	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:55.070972919 CET	8776	38064	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:55.071135044 CET	38064	8776	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:55.191050053 CET	8776	38064	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:55.295248985 CET	14705	37182	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:55.295378923 CET	37182	14705	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:55.295465946 CET	37182	14705	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:56.397655964 CET	8776	38064	212.64.215.71	192.168.2.13
Dec 21, 2024 04:02:56.398099899 CET	38064	8776	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:56.398550987 CET	38064	8776	192.168.2.13	212.64.215.71
Dec 21, 2024 04:02:58.618441105 CET	48840	10464	192.168.2.13	80.78.26.121
Dec 21, 2024 04:02:58.738126993 CET	10464	48840	80.78.26.121	192.168.2.13
Dec 21, 2024 04:02:58.738265991 CET	48840	10464	192.168.2.13	80.78.26.121
Dec 21, 2024 04:02:58.738441944 CET	48840	10464	192.168.2.13	80.78.26.121
Dec 21, 2024 04:02:58.857995987 CET	10464	48840	80.78.26.121	192.168.2.13
Dec 21, 2024 04:02:58.858236074 CET	48840	10464	192.168.2.13	80.78.26.121
Dec 21, 2024 04:02:58.977907896 CET	10464	48840	80.78.26.121	192.168.2.13
Dec 21, 2024 04:03:00.546675920 CET	49186	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:00.666568995 CET	15889	49186	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:00.666876078 CET	49186	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:00.667052984 CET	49186	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:00.786699057 CET	15889	49186	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:00.786916018 CET	49186	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:00.906559944 CET	15889	49186	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:01.669930935 CET	34392	1449	192.168.2.13	176.32.32.113
Dec 21, 2024 04:03:01.789540052 CET	1449	34392	176.32.32.113	192.168.2.13
Dec 21, 2024 04:03:01.789710999 CET	34392	1449	192.168.2.13	176.32.32.113
Dec 21, 2024 04:03:01.789745092 CET	34392	1449	192.168.2.13	176.32.32.113
Dec 21, 2024 04:03:01.909385920 CET	1449	34392	176.32.32.113	192.168.2.13
Dec 21, 2024 04:03:01.909526110 CET	34392	1449	192.168.2.13	176.32.32.113
Dec 21, 2024 04:03:02.026340008 CET	15889	49186	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:02.026480913 CET	49186	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:02.026562929 CET	49186	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:02.029053926 CET	1449	34392	176.32.32.113	192.168.2.13
Dec 21, 2024 04:03:09.145752907 CET	8672	41056	212.192.13.95	192.168.2.13
Dec 21, 2024 04:03:09.146058083 CET	41056	8672	192.168.2.13	212.192.13.95
Dec 21, 2024 04:03:09.265597105 CET	8672	41056	212.192.13.95	192.168.2.13
Dec 21, 2024 04:03:13.015428066 CET	49190	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:13.137368917 CET	15889	49190	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:13.137617111 CET	49190	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:13.137691021 CET	49190	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:13.257528067 CET	15889	49190	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:13.257798910 CET	49190	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:13.377675056 CET	15889	49190	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:14.407752037 CET	42418	9578	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:14.497616053 CET	15889	49190	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:14.497742891 CET	49190	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:14.497848988 CET	49190	15889	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:14.527584076 CET	9578	42418	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:14.527822971 CET	42418	9578	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:14.527908087 CET	42418	9578	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:14.647428989 CET	9578	42418	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:14.647705078 CET	42418	9578	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:14.767646074 CET	9578	42418	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:15.986088991 CET	9578	42418	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:15.986342907 CET	42418	9578	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:15.986449957 CET	42418	9578	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:20.001837969 CET	34648	20094	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:20.121679068 CET	20094	34648	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:20.122112036 CET	34648	20094	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:20.122112036 CET	34648	20094	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:20.242053032 CET	20094	34648	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:20.242212057 CET	34648	20094	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:20.362273932 CET	20094	34648	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:20.646012068 CET	10464	48840	80.78.26.121	192.168.2.13
Dec 21, 2024 04:03:20.646285057 CET	48840	10464	192.168.2.13	80.78.26.121
Dec 21, 2024 04:03:20.766074896 CET	10464	48840	80.78.26.121	192.168.2.13
Dec 21, 2024 04:03:21.231781006 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:21.351726055 CET	7893	39516	212.60.5.153	192.168.2.13
Dec 21, 2024 04:03:21.352080107 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:21.352080107 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:21.471971035 CET	7893	39516	212.60.5.153	192.168.2.13
Dec 21, 2024 04:03:21.472130060 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:21.576935053 CET	20094	34648	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:21.577080965 CET	34648	20094	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:21.577159882 CET	34648	20094	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:21.591728926 CET	7893	39516	212.60.5.153	192.168.2.13
Dec 21, 2024 04:03:23.710978031 CET	1449	34392	176.32.32.113	192.168.2.13
Dec 21, 2024 04:03:23.711231947 CET	34392	1449	192.168.2.13	176.32.32.113
Dec 21, 2024 04:03:23.831005096 CET	1449	34392	176.32.32.113	192.168.2.13
Dec 21, 2024 04:03:28.952955961 CET	33780	19984	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:29.072796106 CET	19984	33780	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:29.072940111 CET	33780	19984	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:29.073024988 CET	33780	19984	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:29.192730904 CET	19984	33780	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:29.193103075 CET	33780	19984	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:29.313132048 CET	19984	33780	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:30.533873081 CET	19984	33780	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:30.534056902 CET	33780	19984	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:30.534148932 CET	33780	19984	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:30.892261028 CET	56630	5342	192.168.2.13	212.192.13.95
Dec 21, 2024 04:03:31.011991978 CET	5342	56630	212.192.13.95	192.168.2.13
Dec 21, 2024 04:03:31.012150049 CET	56630	5342	192.168.2.13	212.192.13.95
Dec 21, 2024 04:03:31.012283087 CET	56630	5342	192.168.2.13	212.192.13.95
Dec 21, 2024 04:03:31.132221937 CET	5342	56630	212.192.13.95	192.168.2.13
Dec 21, 2024 04:03:31.132365942 CET	56630	5342	192.168.2.13	212.192.13.95
Dec 21, 2024 04:03:31.252262115 CET	5342	56630	212.192.13.95	192.168.2.13
Dec 21, 2024 04:03:31.912220955 CET	37316	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:32.031872988 CET	8222	37316	212.60.5.153	192.168.2.13
Dec 21, 2024 04:03:32.032221079 CET	37316	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:32.032221079 CET	37316	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:32.151990891 CET	8222	37316	212.60.5.153	192.168.2.13
Dec 21, 2024 04:03:32.152349949 CET	37316	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:03:32.272275925 CET	8222	37316	212.60.5.153	192.168.2.13
Dec 21, 2024 04:03:35.787355900 CET	47694	6657	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:35.906955004 CET	6657	47694	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:35.907108068 CET	47694	6657	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:35.907108068 CET	47694	6657	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:36.026773930 CET	6657	47694	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:36.027030945 CET	47694	6657	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:36.146894932 CET	6657	47694	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:37.304541111 CET	6657	47694	185.72.8.231	192.168.2.13
Dec 21, 2024 04:03:37.304872036 CET	47694	6657	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:37.304963112 CET	47694	6657	192.168.2.13	185.72.8.231
Dec 21, 2024 04:03:42.712768078 CET	59026	18159	192.168.2.13	80.78.26.121
Dec 21, 2024 04:03:42.832530975 CET	18159	59026	80.78.26.121	192.168.2.13
Dec 21, 2024 04:03:42.832722902 CET	59026	18159	192.168.2.13	80.78.26.121
Dec 21, 2024 04:03:42.832778931 CET	59026	18159	192.168.2.13	80.78.26.121
Dec 21, 2024 04:03:42.952753067 CET	18159	59026	80.78.26.121	192.168.2.13
Dec 21, 2024 04:03:42.952953100 CET	59026	18159	192.168.2.13	80.78.26.121
Dec 21, 2024 04:03:43.072714090 CET	18159	59026	80.78.26.121	192.168.2.13
Dec 21, 2024 04:03:52.927917004 CET	5342	56630	212.192.13.95	192.168.2.13
Dec 21, 2024 04:03:52.928107977 CET	56630	5342	192.168.2.13	212.192.13.95
Dec 21, 2024 04:03:53.047801018 CET	5342	56630	212.192.13.95	192.168.2.13
Dec 21, 2024 04:03:58.583570957 CET	60432	24927	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:58.703181028 CET	24927	60432	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:58.703350067 CET	60432	24927	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:58.703464985 CET	60432	24927	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:58.822987080 CET	24927	60432	212.64.215.71	192.168.2.13
Dec 21, 2024 04:03:58.823152065 CET	60432	24927	192.168.2.13	212.64.215.71
Dec 21, 2024 04:03:58.942941904 CET	24927	60432	212.64.215.71	192.168.2.13
Dec 21, 2024 04:04:00.155736923 CET	24927	60432	212.64.215.71	192.168.2.13
Dec 21, 2024 04:04:00.156016111 CET	60432	24927	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:00.156182051 CET	60432	24927	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:00.667360067 CET	8222	37316	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:00.667895079 CET	37316	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:00.667895079 CET	37316	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:01.384690046 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:01.748704910 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:01.910032034 CET	7893	39516	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:01.910083055 CET	7893	39516	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:04.740843058 CET	18159	59026	80.78.26.121	192.168.2.13
Dec 21, 2024 04:04:04.741244078 CET	59026	18159	192.168.2.13	80.78.26.121
Dec 21, 2024 04:04:04.861469030 CET	18159	59026	80.78.26.121	192.168.2.13
Dec 21, 2024 04:04:05.660038948 CET	35890	12489	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:05.780111074 CET	12489	35890	212.64.215.71	192.168.2.13
Dec 21, 2024 04:04:05.780250072 CET	35890	12489	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:05.780332088 CET	35890	12489	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:05.900087118 CET	12489	35890	212.64.215.71	192.168.2.13
Dec 21, 2024 04:04:05.900273085 CET	35890	12489	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:06.019968033 CET	12489	35890	212.64.215.71	192.168.2.13
Dec 21, 2024 04:04:07.240823984 CET	12489	35890	212.64.215.71	192.168.2.13
Dec 21, 2024 04:04:07.241151094 CET	35890	12489	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:07.241152048 CET	35890	12489	192.168.2.13	212.64.215.71
Dec 21, 2024 04:04:09.982872009 CET	43012	22734	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:10.103001118 CET	22734	43012	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:10.103311062 CET	43012	22734	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:10.103473902 CET	43012	22734	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:10.223077059 CET	22734	43012	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:10.223309040 CET	43012	22734	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:10.343015909 CET	22734	43012	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:11.429711103 CET	37328	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:11.549478054 CET	8222	37328	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:11.549896955 CET	37328	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:11.550050974 CET	37328	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:11.670011044 CET	8222	37328	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:11.670321941 CET	37328	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:11.790663004 CET	8222	37328	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:12.752536058 CET	43948	2782	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:12.872749090 CET	2782	43948	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:12.873184919 CET	43948	2782	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:12.873186111 CET	43948	2782	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:12.993803978 CET	2782	43948	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:12.994054079 CET	43948	2782	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:13.114243031 CET	2782	43948	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:14.283580065 CET	7893	39516	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:14.283992052 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:20.112894058 CET	43012	22734	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:20.232587099 CET	22734	43012	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:22.880820990 CET	43948	2782	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:23.001319885 CET	2782	43948	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:37.194065094 CET	8222	37328	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:37.194168091 CET	37328	8222	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:37.314101934 CET	8222	37328	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:43.235924006 CET	37930	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:43.355707884 CET	14575	37930	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:43.355885983 CET	37930	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:43.355940104 CET	37930	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:43.475728035 CET	14575	37930	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:43.475848913 CET	37930	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:43.595438004 CET	14575	37930	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:53.364947081 CET	37930	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:04:53.484714031 CET	14575	37930	86.107.100.19	192.168.2.13
Dec 21, 2024 04:04:56.635751009 CET	2782	43948	212.60.5.153	192.168.2.13
Dec 21, 2024 04:04:56.635987997 CET	43948	2782	192.168.2.13	212.60.5.153
Dec 21, 2024 04:04:56.636100054 CET	43948	2782	192.168.2.13	212.60.5.153
Dec 21, 2024 04:05:01.311239004 CET	14575	37930	86.107.100.19	192.168.2.13
Dec 21, 2024 04:05:01.311522961 CET	37930	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:01.311523914 CET	37930	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:02.138791084 CET	51568	12744	192.168.2.13	80.78.26.121
Dec 21, 2024 04:05:02.259572029 CET	12744	51568	80.78.26.121	192.168.2.13
Dec 21, 2024 04:05:02.259753942 CET	51568	12744	192.168.2.13	80.78.26.121
Dec 21, 2024 04:05:02.259871960 CET	51568	12744	192.168.2.13	80.78.26.121
Dec 21, 2024 04:05:02.379502058 CET	12744	51568	80.78.26.121	192.168.2.13
Dec 21, 2024 04:05:02.379761934 CET	51568	12744	192.168.2.13	80.78.26.121
Dec 21, 2024 04:05:02.499397039 CET	12744	51568	80.78.26.121	192.168.2.13
Dec 21, 2024 04:05:07.347290993 CET	37934	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:07.467056036 CET	14575	37934	86.107.100.19	192.168.2.13
Dec 21, 2024 04:05:07.467221975 CET	37934	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:07.467302084 CET	37934	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:07.587054968 CET	14575	37934	86.107.100.19	192.168.2.13
Dec 21, 2024 04:05:07.587358952 CET	37934	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:07.707051039 CET	14575	37934	86.107.100.19	192.168.2.13
Dec 21, 2024 04:05:12.642591953 CET	14575	37934	86.107.100.19	192.168.2.13
Dec 21, 2024 04:05:12.642906904 CET	37934	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:12.642906904 CET	37934	14575	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:17.524255037 CET	22734	43012	86.107.100.19	192.168.2.13
Dec 21, 2024 04:05:17.524565935 CET	43012	22734	192.168.2.13	86.107.100.19
Dec 21, 2024 04:05:17.644217014 CET	22734	43012	86.107.100.19	192.168.2.13
Dec 21, 2024 04:05:17.911895037 CET	43706	23690	192.168.2.13	212.64.215.71
Dec 21, 2024 04:05:18.032107115 CET	23690	43706	212.64.215.71	192.168.2.13
Dec 21, 2024 04:05:18.032464981 CET	43706	23690	192.168.2.13	212.64.215.71
Dec 21, 2024 04:05:18.032521963 CET	43706	23690	192.168.2.13	212.64.215.71
Dec 21, 2024 04:05:18.152595997 CET	23690	43706	212.64.215.71	192.168.2.13
Dec 21, 2024 04:05:18.152736902 CET	43706	23690	192.168.2.13	212.64.215.71
Dec 21, 2024 04:05:18.272551060 CET	23690	43706	212.64.215.71	192.168.2.13
Dec 21, 2024 04:05:19.489223003 CET	23690	43706	212.64.215.71	192.168.2.13
Dec 21, 2024 04:05:19.489437103 CET	43706	23690	192.168.2.13	212.64.215.71
Dec 21, 2024 04:05:19.489438057 CET	43706	23690	192.168.2.13	212.64.215.71
Dec 21, 2024 04:05:23.053455114 CET	58070	13201	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:23.173347950 CET	13201	58070	185.72.8.231	192.168.2.13
Dec 21, 2024 04:05:23.173547983 CET	58070	13201	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:23.173664093 CET	58070	13201	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:23.293340921 CET	13201	58070	185.72.8.231	192.168.2.13
Dec 21, 2024 04:05:23.293479919 CET	58070	13201	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:23.413187027 CET	13201	58070	185.72.8.231	192.168.2.13
Dec 21, 2024 04:05:24.164805889 CET	12744	51568	80.78.26.121	192.168.2.13
Dec 21, 2024 04:05:24.165008068 CET	51568	12744	192.168.2.13	80.78.26.121
Dec 21, 2024 04:05:24.284682035 CET	12744	51568	80.78.26.121	192.168.2.13
Dec 21, 2024 04:05:24.344924927 CET	39516	7893	192.168.2.13	212.60.5.153
Dec 21, 2024 04:05:24.465440989 CET	7893	39516	212.60.5.153	192.168.2.13
Dec 21, 2024 04:05:24.546389103 CET	13201	58070	185.72.8.231	192.168.2.13
Dec 21, 2024 04:05:24.546610117 CET	58070	13201	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:24.546610117 CET	58070	13201	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:25.503772020 CET	52892	7711	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:25.623506069 CET	7711	52892	185.72.8.231	192.168.2.13
Dec 21, 2024 04:05:25.623687983 CET	52892	7711	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:25.623768091 CET	52892	7711	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:25.743381023 CET	7711	52892	185.72.8.231	192.168.2.13
Dec 21, 2024 04:05:25.743478060 CET	52892	7711	192.168.2.13	185.72.8.231
Dec 21, 2024 04:05:25.864295006 CET	7711	52892	185.72.8.231	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 04:01:52.658126116 CET	55112	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:01:52.666018963 CET	47140	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:01:52.847330093 CET	51625	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:01:52.877727985 CET	59720	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:01:52.897207975 CET	53	55112	81.169.136.222	192.168.2.13
Dec 21, 2024 04:01:52.904527903 CET	53	47140	81.169.136.222	192.168.2.13
Dec 21, 2024 04:01:53.086482048 CET	53	51625	81.169.136.222	192.168.2.13
Dec 21, 2024 04:01:53.116288900 CET	53	59720	81.169.136.222	192.168.2.13
Dec 21, 2024 04:02:19.928565025 CET	49805	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:02:19.929117918 CET	57489	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:02:20.160578012 CET	53	49805	213.202.211.221	192.168.2.13
Dec 21, 2024 04:02:20.161674023 CET	53	57489	213.202.211.221	192.168.2.13
Dec 21, 2024 04:02:20.163069010 CET	55910	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:02:20.394757986 CET	53	55910	213.202.211.221	192.168.2.13
Dec 21, 2024 04:02:26.200164080 CET	58017	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:02:26.431745052 CET	53	58017	213.202.211.221	192.168.2.13
Dec 21, 2024 04:02:26.656599998 CET	35270	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:02:26.895684004 CET	53	35270	81.169.136.222	192.168.2.13
Dec 21, 2024 04:02:30.485100985 CET	45492	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:02:30.724306107 CET	53	45492	81.169.136.222	192.168.2.13
Dec 21, 2024 04:02:30.725450993 CET	59375	53	192.168.2.13	168.235.111.72
Dec 21, 2024 04:02:31.043179035 CET	53	59375	168.235.111.72	192.168.2.13
Dec 21, 2024 04:02:46.599992037 CET	48584	53	192.168.2.13	152.53.15.127
Dec 21, 2024 04:02:46.848292112 CET	53	48584	152.53.15.127	192.168.2.13
Dec 21, 2024 04:02:46.849198103 CET	58725	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:02:47.111514091 CET	53	58725	185.181.61.24	192.168.2.13
Dec 21, 2024 04:02:47.414334059 CET	48380	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:02:47.652309895 CET	53	48380	81.169.136.222	192.168.2.13
Dec 21, 2024 04:02:47.655319929 CET	57345	53	192.168.2.13	168.235.111.72
Dec 21, 2024 04:02:47.960959911 CET	53	57345	168.235.111.72	192.168.2.13
Dec 21, 2024 04:02:53.479494095 CET	39013	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:02:53.717781067 CET	53	39013	81.169.136.222	192.168.2.13
Dec 21, 2024 04:02:54.568562031 CET	47251	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:02:54.828629017 CET	53	47251	185.181.61.24	192.168.2.13
Dec 21, 2024 04:02:58.085871935 CET	54062	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:02:58.346265078 CET	53	54062	185.181.61.24	192.168.2.13
Dec 21, 2024 04:02:58.348459005 CET	50526	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:02:58.616177082 CET	53	50526	185.181.61.24	192.168.2.13
Dec 21, 2024 04:03:00.298907995 CET	47183	53	192.168.2.13	152.53.15.127
Dec 21, 2024 04:03:00.545398951 CET	53	47183	152.53.15.127	192.168.2.13
Dec 21, 2024 04:03:01.402307987 CET	47449	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:03:01.668606043 CET	53	47449	109.91.184.21	192.168.2.13
Dec 21, 2024 04:03:07.032231092 CET	57548	53	192.168.2.13	194.36.144.87
Dec 21, 2024 04:03:07.277842045 CET	53	57548	194.36.144.87	192.168.2.13
Dec 21, 2024 04:03:07.281491995 CET	52263	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:03:07.770289898 CET	53	52263	109.91.184.21	192.168.2.13
Dec 21, 2024 04:03:07.773818016 CET	57397	53	192.168.2.13	80.152.203.134
Dec 21, 2024 04:03:12.782126904 CET	51196	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:03:13.013055086 CET	53	51196	213.202.211.221	192.168.2.13
Dec 21, 2024 04:03:14.151323080 CET	47574	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:03:14.406084061 CET	53	47574	109.91.184.21	192.168.2.13
Dec 21, 2024 04:03:19.502557993 CET	57275	53	192.168.2.13	152.53.15.127
Dec 21, 2024 04:03:19.752394915 CET	53	57275	152.53.15.127	192.168.2.13
Dec 21, 2024 04:03:19.754936934 CET	52044	53	192.168.2.13	152.53.15.127
Dec 21, 2024 04:03:20.001039028 CET	53	52044	152.53.15.127	192.168.2.13
Dec 21, 2024 04:03:20.990168095 CET	59488	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:03:21.230328083 CET	53	59488	81.169.136.222	192.168.2.13
Dec 21, 2024 04:03:25.651829958 CET	44470	53	192.168.2.13	80.152.203.134
Dec 21, 2024 04:03:26.580194950 CET	60309	53	192.168.2.13	80.152.203.134
Dec 21, 2024 04:03:28.713973999 CET	44773	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:03:28.952250957 CET	53	44773	81.169.136.222	192.168.2.13
Dec 21, 2024 04:03:30.658091068 CET	45405	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:03:30.890850067 CET	53	45405	213.202.211.221	192.168.2.13
Dec 21, 2024 04:03:31.586349964 CET	45750	53	192.168.2.13	168.235.111.72
Dec 21, 2024 04:03:31.910082102 CET	53	45750	168.235.111.72	192.168.2.13
Dec 21, 2024 04:03:35.538101912 CET	35636	53	192.168.2.13	152.53.15.127
Dec 21, 2024 04:03:35.786634922 CET	53	35636	152.53.15.127	192.168.2.13
Dec 21, 2024 04:03:42.308412075 CET	56543	53	192.168.2.13	168.138.12.137
Dec 21, 2024 04:03:42.711509943 CET	53	56543	168.138.12.137	192.168.2.13
Dec 21, 2024 04:03:57.931871891 CET	37211	53	192.168.2.13	194.36.144.87
Dec 21, 2024 04:03:58.177036047 CET	53	37211	194.36.144.87	192.168.2.13
Dec 21, 2024 04:03:58.178828001 CET	44527	53	192.168.2.13	168.138.12.137
Dec 21, 2024 04:03:58.581955910 CET	53	44527	168.138.12.137	192.168.2.13
Dec 21, 2024 04:04:05.162348032 CET	57547	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:04:05.395003080 CET	53	57547	213.202.211.221	192.168.2.13
Dec 21, 2024 04:04:05.398333073 CET	33306	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:04:05.657556057 CET	53	33306	109.91.184.21	192.168.2.13
Dec 21, 2024 04:04:05.673558950 CET	45000	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:04:05.933973074 CET	53	45000	185.181.61.24	192.168.2.13
Dec 21, 2024 04:04:05.936889887 CET	50394	53	192.168.2.13	202.61.197.122
Dec 21, 2024 04:04:06.181864977 CET	53	50394	202.61.197.122	192.168.2.13
Dec 21, 2024 04:04:06.184398890 CET	52572	53	192.168.2.13	80.152.203.134
Dec 21, 2024 04:04:09.747951031 CET	35101	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:04:09.980181932 CET	53	35101	213.202.211.221	192.168.2.13
Dec 21, 2024 04:04:11.193528891 CET	36349	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:04:11.427071095 CET	53	36349	213.202.211.221	192.168.2.13
Dec 21, 2024 04:04:12.246602058 CET	49201	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:04:12.506345034 CET	53	49201	185.181.61.24	192.168.2.13
Dec 21, 2024 04:04:12.510294914 CET	35325	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:04:12.749603987 CET	53	35325	81.169.136.222	192.168.2.13
Dec 21, 2024 04:04:37.123572111 CET	39542	53	192.168.2.13	1.1.1.1
Dec 21, 2024 04:04:37.123651981 CET	49469	53	192.168.2.13	1.1.1.1
Dec 21, 2024 04:04:37.343662024 CET	53	39542	1.1.1.1	192.168.2.13
Dec 21, 2024 04:04:37.352674961 CET	53	49469	1.1.1.1	192.168.2.13
Dec 21, 2024 04:04:42.196353912 CET	52409	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:04:42.467658997 CET	53	52409	109.91.184.21	192.168.2.13
Dec 21, 2024 04:04:42.469573021 CET	41353	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:04:42.724802017 CET	53	41353	109.91.184.21	192.168.2.13
Dec 21, 2024 04:04:42.726047993 CET	41224	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:04:42.982392073 CET	53	41224	109.91.184.21	192.168.2.13
Dec 21, 2024 04:04:42.984054089 CET	43843	53	192.168.2.13	194.36.144.87
Dec 21, 2024 04:04:43.234966040 CET	53	43843	194.36.144.87	192.168.2.13
Dec 21, 2024 04:05:01.640244007 CET	60885	53	192.168.2.13	213.202.211.221
Dec 21, 2024 04:05:01.873497963 CET	53	60885	213.202.211.221	192.168.2.13
Dec 21, 2024 04:05:01.876009941 CET	44577	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:05:02.137799978 CET	53	44577	109.91.184.21	192.168.2.13
Dec 21, 2024 04:05:06.315992117 CET	36882	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:05:06.606372118 CET	53	36882	109.91.184.21	192.168.2.13
Dec 21, 2024 04:05:06.608261108 CET	60384	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:05:06.847091913 CET	53	60384	81.169.136.222	192.168.2.13
Dec 21, 2024 04:05:06.848623991 CET	47215	53	192.168.2.13	202.61.197.122
Dec 21, 2024 04:05:07.096474886 CET	53	47215	202.61.197.122	192.168.2.13
Dec 21, 2024 04:05:07.097882986 CET	51546	53	192.168.2.13	202.61.197.122
Dec 21, 2024 04:05:07.345964909 CET	53	51546	202.61.197.122	192.168.2.13
Dec 21, 2024 04:05:17.646243095 CET	53083	53	192.168.2.13	109.91.184.21
Dec 21, 2024 04:05:17.910482883 CET	53	53083	109.91.184.21	192.168.2.13
Dec 21, 2024 04:05:22.527679920 CET	55943	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:05:22.790426016 CET	53	55943	185.181.61.24	192.168.2.13
Dec 21, 2024 04:05:22.792917013 CET	46623	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:05:23.051935911 CET	53	46623	185.181.61.24	192.168.2.13
Dec 21, 2024 04:05:24.493396997 CET	48384	53	192.168.2.13	51.158.108.203
Dec 21, 2024 04:05:24.733370066 CET	53	48384	51.158.108.203	192.168.2.13
Dec 21, 2024 04:05:24.735033989 CET	50206	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:05:24.994939089 CET	53	50206	185.181.61.24	192.168.2.13
Dec 21, 2024 04:05:24.997030020 CET	50292	53	192.168.2.13	81.169.136.222
Dec 21, 2024 04:05:25.236872911 CET	53	50292	81.169.136.222	192.168.2.13
Dec 21, 2024 04:05:25.238519907 CET	60255	53	192.168.2.13	185.181.61.24
Dec 21, 2024 04:05:25.502811909 CET	53	60255	185.181.61.24	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 04:01:52.658126116 CET	192.168.2.13	81.169.136.222	0xe7f	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.666018963 CET	192.168.2.13	81.169.136.222	0xe7f	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.847330093 CET	192.168.2.13	81.169.136.222	0xe7f	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.877727985 CET	192.168.2.13	81.169.136.222	0xe7f	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:19.928565025 CET	192.168.2.13	213.202.211.221	0x8db	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:19.929117918 CET	192.168.2.13	213.202.211.221	0x8db	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.163069010 CET	192.168.2.13	213.202.211.221	0x8db	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.200164080 CET	192.168.2.13	213.202.211.221	0x8db	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.656599998 CET	192.168.2.13	81.169.136.222	0x6a03	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:30.485100985 CET	192.168.2.13	81.169.136.222	0x6a03	Standard query (0)	catvision.dyn. [malformed]	256	454	false
Dec 21, 2024 04:02:30.725450993 CET	192.168.2.13	168.235.111.72	0xb793	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:46.599992037 CET	192.168.2.13	152.53.15.127	0x8ac1	Standard query (0)	catvision.dyn. [malformed]	256	470	false
Dec 21, 2024 04:02:46.849198103 CET	192.168.2.13	185.181.61.24	0xf981	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.414334059 CET	192.168.2.13	81.169.136.222	0x6a03	Standard query (0)	catvision.dyn. [malformed]	256	471	false
Dec 21, 2024 04:02:47.655319929 CET	192.168.2.13	168.235.111.72	0xb793	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.479494095 CET	192.168.2.13	81.169.136.222	0x6a03	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.568562031 CET	192.168.2.13	185.181.61.24	0xf981	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.085871935 CET	192.168.2.13	185.181.61.24	0xf981	Standard query (0)	catvision.dyn. [malformed]	256	482	false
Dec 21, 2024 04:02:58.348459005 CET	192.168.2.13	185.181.61.24	0x6c1e	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.298907995 CET	192.168.2.13	152.53.15.127	0x8ac1	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.402307987 CET	192.168.2.13	109.91.184.21	0xaefe	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:07.032231092 CET	192.168.2.13	194.36.144.87	0x3a69	Standard query (0)	hikvision.geek. [malformed]	256	491	false
Dec 21, 2024 04:03:07.281491995 CET	192.168.2.13	109.91.184.21	0xaefe	Standard query (0)	shitrocket.dyn. [malformed]	256	491	false
Dec 21, 2024 04:03:07.773818016 CET	192.168.2.13	80.152.203.134	0x956b	Standard query (0)	catlovingfools.geek. [malformed]	256	493	false
Dec 21, 2024 04:03:12.782126904 CET	192.168.2.13	213.202.211.221	0x68c9	Standard query (0)	catvision.dyn. [malformed]	256	497	false
Dec 21, 2024 04:03:14.151323080 CET	192.168.2.13	109.91.184.21	0xaefe	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:19.502557993 CET	192.168.2.13	152.53.15.127	0x9460	Standard query (0)	catvision.dyn. [malformed]	256	503	false
Dec 21, 2024 04:03:19.754936934 CET	192.168.2.13	152.53.15.127	0x32c9	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:20.990168095 CET	192.168.2.13	81.169.136.222	0x9d31	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:25.651829958 CET	192.168.2.13	80.152.203.134	0x956b	Standard query (0)	catvision.dyn. [malformed]	256	510	false
Dec 21, 2024 04:03:26.580194950 CET	192.168.2.13	80.152.203.134	0xc902	Standard query (0)	catvision.dyn. [malformed]	256	256	false
Dec 21, 2024 04:03:28.713973999 CET	192.168.2.13	81.169.136.222	0x9d31	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.658091068 CET	192.168.2.13	213.202.211.221	0x68c9	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.586349964 CET	192.168.2.13	168.235.111.72	0xe407	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.538101912 CET	192.168.2.13	152.53.15.127	0x9460	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.308412075 CET	192.168.2.13	168.138.12.137	0x1a09	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:57.931871891 CET	192.168.2.13	194.36.144.87	0x1144	Standard query (0)	catvision.dyn. [malformed]	256	286	false
Dec 21, 2024 04:03:58.178828001 CET	192.168.2.13	168.138.12.137	0x1a09	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:05.162348032 CET	192.168.2.13	213.202.211.221	0xc1c8	Standard query (0)	catvision.dyn. [malformed]	256	293	false
Dec 21, 2024 04:04:05.398333073 CET	192.168.2.13	109.91.184.21	0xa899	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:05.673558950 CET	192.168.2.13	185.181.61.24	0x28c5	Standard query (0)	catvision.dyn. [malformed]	256	293	false
Dec 21, 2024 04:04:05.936889887 CET	192.168.2.13	202.61.197.122	0xd3d0	Standard query (0)	catlovingfools.geek. [malformed]	256	294	false
Dec 21, 2024 04:04:06.184398890 CET	192.168.2.13	80.152.203.134	0xc57	Standard query (0)	hikvision.geek. [malformed]	256	295	false
Dec 21, 2024 04:04:09.747951031 CET	192.168.2.13	213.202.211.221	0xc1c8	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:11.193528891 CET	192.168.2.13	213.202.211.221	0x804e	Standard query (0)	shitrocket.dyn. [malformed]	256	299	false
Dec 21, 2024 04:04:12.246602058 CET	192.168.2.13	185.181.61.24	0x2294	Standard query (0)	catvision.dyn. [malformed]	256	300	false
Dec 21, 2024 04:04:12.510294914 CET	192.168.2.13	81.169.136.222	0xb3b1	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:37.123572111 CET	192.168.2.13	1.1.1.1	0x60a6	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:37.123651981 CET	192.168.2.13	1.1.1.1	0x5af5	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 21, 2024 04:04:42.196353912 CET	192.168.2.13	109.91.184.21	0x6acb	Standard query (0)	catlovingfools.geek. [malformed]	256	330	false
Dec 21, 2024 04:04:42.469573021 CET	192.168.2.13	109.91.184.21	0x7275	Standard query (0)	hikvision.geek. [malformed]	256	330	false
Dec 21, 2024 04:04:42.726047993 CET	192.168.2.13	109.91.184.21	0x24cd	Standard query (0)	catvision.dyn. [malformed]	256	330	false
Dec 21, 2024 04:04:42.984054089 CET	192.168.2.13	194.36.144.87	0x4487	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:01.640244007 CET	192.168.2.13	213.202.211.221	0x804e	Standard query (0)	catvision.dyn. [malformed]	256	349	false
Dec 21, 2024 04:05:01.876009941 CET	192.168.2.13	109.91.184.21	0x6acb	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:06.315992117 CET	192.168.2.13	109.91.184.21	0x65ca	Standard query (0)	catlovingfools.geek. [malformed]	256	354	false
Dec 21, 2024 04:05:06.608261108 CET	192.168.2.13	81.169.136.222	0x90a4	Standard query (0)	shitrocket.dyn. [malformed]	256	354	false
Dec 21, 2024 04:05:06.848623991 CET	192.168.2.13	202.61.197.122	0x2815	Standard query (0)	hikvision.geek. [malformed]	256	355	false
Dec 21, 2024 04:05:07.097882986 CET	192.168.2.13	202.61.197.122	0xfd74	Standard query (0)	catvision.dyn. [malformed]	256	355	false
Dec 21, 2024 04:05:17.646243095 CET	192.168.2.13	109.91.184.21	0x82d6	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:22.527679920 CET	192.168.2.13	185.181.61.24	0xa34e	Standard query (0)	catvision.dyn. [malformed]	256	370	false
Dec 21, 2024 04:05:22.792917013 CET	192.168.2.13	185.181.61.24	0x2294	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:24.493396997 CET	192.168.2.13	51.158.108.203	0xd562	Standard query (0)	catlovingfools.geek. [malformed]	256	372	false
Dec 21, 2024 04:05:24.735033989 CET	192.168.2.13	185.181.61.24	0x60d0	Standard query (0)	hikvision.geek. [malformed]	256	372	false
Dec 21, 2024 04:05:24.997030020 CET	192.168.2.13	81.169.136.222	0x860e	Standard query (0)	catvision.dyn. [malformed]	256	373	false
Dec 21, 2024 04:05:25.238519907 CET	192.168.2.13	185.181.61.24	0x5b7c	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 04:01:52.897207975 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.897207975 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.897207975 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.897207975 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.897207975 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.897207975 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.897207975 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.904527903 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.904527903 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.904527903 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.904527903 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.904527903 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.904527903 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:52.904527903 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.086482048 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.086482048 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.086482048 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.086482048 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.086482048 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.086482048 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.086482048 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.116288900 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.116288900 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.116288900 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.116288900 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.116288900 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.116288900 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:01:53.116288900 CET	81.169.136.222	192.168.2.13	0xe7f	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.160578012 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.160578012 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.160578012 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.160578012 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.160578012 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.160578012 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.160578012 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.161674023 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.161674023 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.161674023 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.161674023 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.161674023 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.161674023 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.161674023 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.394757986 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.394757986 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.394757986 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.394757986 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.394757986 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.394757986 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:20.394757986 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.431745052 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.431745052 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.431745052 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.431745052 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.431745052 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.431745052 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.431745052 CET	213.202.211.221	192.168.2.13	0x8db	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.895684004 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.895684004 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.895684004 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.895684004 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.895684004 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.895684004 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:26.895684004 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:31.043179035 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:31.043179035 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:31.043179035 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:31.043179035 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:31.043179035 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:31.043179035 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:31.043179035 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:46.848292112 CET	152.53.15.127	192.168.2.13	0x8ac1	Format error (1)	catvision.dyn. [malformed]	none	none	256	470	false
Dec 21, 2024 04:02:47.111514091 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.111514091 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.111514091 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.111514091 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.111514091 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.111514091 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.111514091 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.960959911 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.960959911 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.960959911 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.960959911 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.960959911 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.960959911 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:47.960959911 CET	168.235.111.72	192.168.2.13	0xb793	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.717781067 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.717781067 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.717781067 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.717781067 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.717781067 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.717781067 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:53.717781067 CET	81.169.136.222	192.168.2.13	0x6a03	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.828629017 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.828629017 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.828629017 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.828629017 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.828629017 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.828629017 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:54.828629017 CET	185.181.61.24	192.168.2.13	0xf981	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.616177082 CET	185.181.61.24	192.168.2.13	0x6c1e	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.616177082 CET	185.181.61.24	192.168.2.13	0x6c1e	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.616177082 CET	185.181.61.24	192.168.2.13	0x6c1e	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.616177082 CET	185.181.61.24	192.168.2.13	0x6c1e	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.616177082 CET	185.181.61.24	192.168.2.13	0x6c1e	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.616177082 CET	185.181.61.24	192.168.2.13	0x6c1e	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:02:58.616177082 CET	185.181.61.24	192.168.2.13	0x6c1e	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.545398951 CET	152.53.15.127	192.168.2.13	0x8ac1	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.545398951 CET	152.53.15.127	192.168.2.13	0x8ac1	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.545398951 CET	152.53.15.127	192.168.2.13	0x8ac1	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.545398951 CET	152.53.15.127	192.168.2.13	0x8ac1	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.545398951 CET	152.53.15.127	192.168.2.13	0x8ac1	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.545398951 CET	152.53.15.127	192.168.2.13	0x8ac1	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:00.545398951 CET	152.53.15.127	192.168.2.13	0x8ac1	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.668606043 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.668606043 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.668606043 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.668606043 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.668606043 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.668606043 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:01.668606043 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:07.277842045 CET	194.36.144.87	192.168.2.13	0x3a69	Format error (1)	hikvision.geek. [malformed]	none	none	256	491	false
Dec 21, 2024 04:03:07.770289898 CET	109.91.184.21	192.168.2.13	0xaefe	Format error (1)	shitrocket.dyn. [malformed]	none	none	256	491	false
Dec 21, 2024 04:03:14.406084061 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:14.406084061 CET	109.91.184.21	192.168.2.13	0xaefe	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:19.752394915 CET	152.53.15.127	192.168.2.13	0x9460	Format error (1)	catvision.dyn. [malformed]	none	none	256	503	false
Dec 21, 2024 04:03:20.001039028 CET	152.53.15.127	192.168.2.13	0x32c9	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:20.001039028 CET	152.53.15.127	192.168.2.13	0x32c9	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:20.001039028 CET	152.53.15.127	192.168.2.13	0x32c9	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:20.001039028 CET	152.53.15.127	192.168.2.13	0x32c9	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:20.001039028 CET	152.53.15.127	192.168.2.13	0x32c9	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:20.001039028 CET	152.53.15.127	192.168.2.13	0x32c9	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:20.001039028 CET	152.53.15.127	192.168.2.13	0x32c9	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:21.230328083 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:21.230328083 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:21.230328083 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:21.230328083 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:21.230328083 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:21.230328083 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:21.230328083 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:28.952250957 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:28.952250957 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:28.952250957 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:28.952250957 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:28.952250957 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:28.952250957 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:28.952250957 CET	81.169.136.222	192.168.2.13	0x9d31	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.890850067 CET	213.202.211.221	192.168.2.13	0x68c9	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.890850067 CET	213.202.211.221	192.168.2.13	0x68c9	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.890850067 CET	213.202.211.221	192.168.2.13	0x68c9	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.890850067 CET	213.202.211.221	192.168.2.13	0x68c9	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.890850067 CET	213.202.211.221	192.168.2.13	0x68c9	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.890850067 CET	213.202.211.221	192.168.2.13	0x68c9	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:30.890850067 CET	213.202.211.221	192.168.2.13	0x68c9	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.910082102 CET	168.235.111.72	192.168.2.13	0xe407	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.910082102 CET	168.235.111.72	192.168.2.13	0xe407	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.910082102 CET	168.235.111.72	192.168.2.13	0xe407	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.910082102 CET	168.235.111.72	192.168.2.13	0xe407	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.910082102 CET	168.235.111.72	192.168.2.13	0xe407	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.910082102 CET	168.235.111.72	192.168.2.13	0xe407	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:31.910082102 CET	168.235.111.72	192.168.2.13	0xe407	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.786634922 CET	152.53.15.127	192.168.2.13	0x9460	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.786634922 CET	152.53.15.127	192.168.2.13	0x9460	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.786634922 CET	152.53.15.127	192.168.2.13	0x9460	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.786634922 CET	152.53.15.127	192.168.2.13	0x9460	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.786634922 CET	152.53.15.127	192.168.2.13	0x9460	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.786634922 CET	152.53.15.127	192.168.2.13	0x9460	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:35.786634922 CET	152.53.15.127	192.168.2.13	0x9460	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.711509943 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.711509943 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.711509943 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.711509943 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.711509943 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.711509943 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:42.711509943 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:58.177036047 CET	194.36.144.87	192.168.2.13	0x1144	Format error (1)	catvision.dyn. [malformed]	none	none	256	286	false
Dec 21, 2024 04:03:58.581955910 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:58.581955910 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:58.581955910 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:58.581955910 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:58.581955910 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:58.581955910 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:03:58.581955910 CET	168.138.12.137	192.168.2.13	0x1a09	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:05.657556057 CET	109.91.184.21	192.168.2.13	0xa899	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:05.657556057 CET	109.91.184.21	192.168.2.13	0xa899	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:09.980181932 CET	213.202.211.221	192.168.2.13	0xc1c8	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:09.980181932 CET	213.202.211.221	192.168.2.13	0xc1c8	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:09.980181932 CET	213.202.211.221	192.168.2.13	0xc1c8	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:09.980181932 CET	213.202.211.221	192.168.2.13	0xc1c8	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:09.980181932 CET	213.202.211.221	192.168.2.13	0xc1c8	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:09.980181932 CET	213.202.211.221	192.168.2.13	0xc1c8	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:09.980181932 CET	213.202.211.221	192.168.2.13	0xc1c8	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:12.749603987 CET	81.169.136.222	192.168.2.13	0xb3b1	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:12.749603987 CET	81.169.136.222	192.168.2.13	0xb3b1	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:12.749603987 CET	81.169.136.222	192.168.2.13	0xb3b1	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:12.749603987 CET	81.169.136.222	192.168.2.13	0xb3b1	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:12.749603987 CET	81.169.136.222	192.168.2.13	0xb3b1	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:12.749603987 CET	81.169.136.222	192.168.2.13	0xb3b1	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:12.749603987 CET	81.169.136.222	192.168.2.13	0xb3b1	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:37.343662024 CET	1.1.1.1	192.168.2.13	0x60a6	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:37.343662024 CET	1.1.1.1	192.168.2.13	0x60a6	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:42.467658997 CET	109.91.184.21	192.168.2.13	0x6acb	Not Implemented (4)	catlovingfools.geek. [malformed]	none	none	256	330	false
Dec 21, 2024 04:04:42.724802017 CET	109.91.184.21	192.168.2.13	0x7275	Format error (1)	hikvision.geek. [malformed]	none	none	256	330	false
Dec 21, 2024 04:04:42.982392073 CET	109.91.184.21	192.168.2.13	0x24cd	Format error (1)	catvision.dyn. [malformed]	none	none	256	330	false
Dec 21, 2024 04:04:43.234966040 CET	194.36.144.87	192.168.2.13	0x4487	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:43.234966040 CET	194.36.144.87	192.168.2.13	0x4487	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:43.234966040 CET	194.36.144.87	192.168.2.13	0x4487	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:43.234966040 CET	194.36.144.87	192.168.2.13	0x4487	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:43.234966040 CET	194.36.144.87	192.168.2.13	0x4487	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:43.234966040 CET	194.36.144.87	192.168.2.13	0x4487	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:04:43.234966040 CET	194.36.144.87	192.168.2.13	0x4487	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:02.137799978 CET	109.91.184.21	192.168.2.13	0x6acb	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:02.137799978 CET	109.91.184.21	192.168.2.13	0x6acb	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:06.606372118 CET	109.91.184.21	192.168.2.13	0x65ca	Not Implemented (4)	catlovingfools.geek. [malformed]	none	none	256	354	false
Dec 21, 2024 04:05:17.910482883 CET	109.91.184.21	192.168.2.13	0x82d6	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:17.910482883 CET	109.91.184.21	192.168.2.13	0x82d6	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:23.051935911 CET	185.181.61.24	192.168.2.13	0x2294	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:23.051935911 CET	185.181.61.24	192.168.2.13	0x2294	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:23.051935911 CET	185.181.61.24	192.168.2.13	0x2294	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:23.051935911 CET	185.181.61.24	192.168.2.13	0x2294	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:23.051935911 CET	185.181.61.24	192.168.2.13	0x2294	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:23.051935911 CET	185.181.61.24	192.168.2.13	0x2294	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:23.051935911 CET	185.181.61.24	192.168.2.13	0x2294	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:24.733370066 CET	51.158.108.203	192.168.2.13	0xd562	Format error (1)	catlovingfools.geek. [malformed]	none	none	256	372	false
Dec 21, 2024 04:05:25.502811909 CET	185.181.61.24	192.168.2.13	0x5b7c	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:25.502811909 CET	185.181.61.24	192.168.2.13	0x5b7c	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:25.502811909 CET	185.181.61.24	192.168.2.13	0x5b7c	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:25.502811909 CET	185.181.61.24	192.168.2.13	0x5b7c	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:25.502811909 CET	185.181.61.24	192.168.2.13	0x5b7c	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:25.502811909 CET	185.181.61.24	192.168.2.13	0x5b7c	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:05:25.502811909 CET	185.181.61.24	192.168.2.13	0x5b7c	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ppc.elf PID: 5451, Parent PID: 5377

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	/tmp/ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5453, Parent PID: 5451

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5513, Parent PID: 5453

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5514, Parent PID: 5453

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5533, Parent PID: 5514

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5547, Parent PID: 5533

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5454, Parent PID: 5451

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5457, Parent PID: 5451

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5478, Parent PID: 5457

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: ppc.elf PID: 5488, Parent PID: 5478

General

Start time (UTC):	03:01:51
Start date (UTC):	21/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ppc.elf PID: 5451, Parent PID: 5377

General

Chronological Activities

Analysis Process: ppc.elf PID: 5453, Parent PID: 5451

General

Chronological Activities

Analysis Process: ppc.elf PID: 5513, Parent PID: 5453

General

Chronological Activities

Analysis Process: ppc.elf PID: 5514, Parent PID: 5453

General

Chronological Activities

Analysis Process: ppc.elf PID: 5533, Parent PID: 5514

General

Chronological Activities

Analysis Process: ppc.elf PID: 5547, Parent PID: 5533

General

Linux Analysis Report
ppc.elf