Edit tour

Linux Analysis Report
mips.elf

Overview

General Information

Sample name:	mips.elf
Analysis ID:	1579197
MD5:	32c6f75edeee7332e753b4ecb610839f
SHA1:	19e3545fcce9507d03669edae161f61c20808e86
SHA256:	3335f6ae1285a05c10dc94041ae1501bdd5c2dc6126d2c9c05e39851b13e936b
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579197
Start date and time:	2024-12-21 04:11:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mips.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@81/0

Runtime Messages

Command:	/tmp/mips.elf
PID:	6266
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	I just wanna look after my cats, man.
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6244, Parent: 4338)

rm (PID: 6244, Parent: 4338, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.wCP1PA9yai /tmp/tmp.HfuxCb1bPx /tmp/tmp.XSRV98qGVS

dash New Fork (PID: 6245, Parent: 4338)

cat (PID: 6245, Parent: 4338, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.wCP1PA9yai

dash New Fork (PID: 6246, Parent: 4338)

head (PID: 6246, Parent: 4338, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6247, Parent: 4338)

tr (PID: 6247, Parent: 4338, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6248, Parent: 4338)

cut (PID: 6248, Parent: 4338, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6249, Parent: 4338)

cat (PID: 6249, Parent: 4338, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.wCP1PA9yai

dash New Fork (PID: 6250, Parent: 4338)

head (PID: 6250, Parent: 4338, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6251, Parent: 4338)

tr (PID: 6251, Parent: 4338, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6252, Parent: 4338)

cut (PID: 6252, Parent: 4338, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6253, Parent: 4338)

rm (PID: 6253, Parent: 4338, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.wCP1PA9yai /tmp/tmp.HfuxCb1bPx /tmp/tmp.XSRV98qGVS

mips.elf (PID: 6266, Parent: 6178, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.elf

mips.elf New Fork (PID: 6268, Parent: 6266)

mips.elf New Fork (PID: 6342, Parent: 6268)

mips.elf New Fork (PID: 6344, Parent: 6268)

mips.elf New Fork (PID: 6357, Parent: 6344)

mips.elf New Fork (PID: 6376, Parent: 6357)

mips.elf New Fork (PID: 6269, Parent: 6266)

mips.elf New Fork (PID: 6272, Parent: 6266)

mips.elf New Fork (PID: 6299, Parent: 6272)

mips.elf New Fork (PID: 6301, Parent: 6299)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mips.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6268.1.00007fa574400000.00007fa574416000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6266.1.00007fa574400000.00007fa574416000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mips.elf

ReversingLabs: Detection: 23%

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 185.72.8.231 ports 6593,17265,3417,3,3523,5,6,9,15005,14576,2736
Source: global traffic	TCP traffic: 176.32.32.113 ports 21334,6982,1,2,3,4,17721
Source: global traffic	TCP traffic: 80.78.26.121 ports 15571,7662,22716,21729,1,2,7,9
Source: global traffic	TCP traffic: 212.64.215.71 ports 5189,22511,1,2,5,13113
Source: global traffic	TCP traffic: 212.192.13.95 ports 9720,21678,0,6708,13309,24020,6,7,8
Source: global traffic	TCP traffic: 212.60.5.153 ports 21729,21404,0,1,5,15005,17988
Source: global traffic	TCP traffic: 86.107.100.19 ports 6593,21334,3,5,6,16866,9

Sends malformed DNS queries

Source: global traffic	DNS traffic detected: malformed DNS query: catvision.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: hikvision.geek. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: shitrocket.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: catlovingfools.geek. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:58444 -> 86.107.100.19:6593
Source: global traffic	TCP traffic: 192.168.2.23:34284 -> 185.72.8.231:6593
Source: global traffic	TCP traffic: 192.168.2.23:50556 -> 176.32.32.113:21334
Source: global traffic	TCP traffic: 192.168.2.23:58356 -> 212.192.13.95:6708
Source: global traffic	TCP traffic: 192.168.2.23:42356 -> 212.60.5.153:15005
Source: global traffic	TCP traffic: 192.168.2.23:38744 -> 80.78.26.121:21729
Source: global traffic	TCP traffic: 192.168.2.23:49168 -> 212.64.215.71:22511

Source: /tmp/mips.elf (PID: 6266)

Socket: 127.0.0.1:1172

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown	UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown	UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 109.91.184.21
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24

Source: global traffic	DNS traffic detected: DNS query: catvision.dyn
Source: global traffic	DNS traffic detected: DNS query: shitrocket.dyn
Source: global traffic	DNS traffic detected: DNS query: catvision.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: hikvision.geek
Source: global traffic	DNS traffic detected: DNS query: catlovingfools.geek
Source: global traffic	DNS traffic detected: DNS query: hikvision.geek. [malformed]
Source: global traffic	DNS traffic detected: DNS query: shitrocket.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: catlovingfools.geek. [malformed]

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/0@81/0

Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6450/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6441/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6088/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6440/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6451/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6443/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6442/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6445/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6444/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6436/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6447/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6446/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6438/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6449/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6437/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6448/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6342)	File opened: /proc/6439/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6450/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6342/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6441/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6088/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6440/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6451/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6344/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6344/cmdline	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6443/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6376/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6442/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6357/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6445/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6444/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6436/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6447/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6446/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6438/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6449/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6437/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6448/status	Jump to behavior
Source: /tmp/mips.elf (PID: 6269)	File opened: /proc/6439/status	Jump to behavior

Source: /usr/bin/dash (PID: 6244)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.wCP1PA9yai /tmp/tmp.HfuxCb1bPx /tmp/tmp.XSRV98qGVS			Jump to behavior
Source: /usr/bin/dash (PID: 6253)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.wCP1PA9yai /tmp/tmp.HfuxCb1bPx /tmp/tmp.XSRV98qGVS			Jump to behavior

Source: /tmp/mips.elf (PID: 6266)

Queries kernel information via 'uname':

Jump to behavior

Source: mips.elf, 6266.1.0000563d26e1d000.0000563d26eea000.rw-.sdmp, mips.elf, 6268.1.0000563d26e1d000.0000563d26eea000.rw-.sdmp	Binary or memory string: &=V!/etc/qemu-binfmt/mips
Source: mips.elf, 6266.1.0000563d26e1d000.0000563d26eea000.rw-.sdmp, mips.elf, 6268.1.0000563d26e1d000.0000563d26eea000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 6268.1.0000563d26e1d000.0000563d26eea000.rw-.sdmp	Binary or memory string: &=V0!/usr/bin/vmtoolsd
Source: mips.elf, 6268.1.0000563d26e1d000.0000563d26eea000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: mips.elf, 6266.1.00007ffc92ae7000.00007ffc92b08000.rw-.sdmp, mips.elf, 6268.1.00007ffc92ae7000.00007ffc92b08000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 6266.1.00007ffc92ae7000.00007ffc92b08000.rw-.sdmp, mips.elf, 6268.1.00007ffc92ae7000.00007ffc92b08000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: mips.elf, type: SAMPLE
Source: Yara match	File source: 6268.1.00007fa574400000.00007fa574416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.00007fa574400000.00007fa574416000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: mips.elf, type: SAMPLE
Source: Yara match	File source: 6268.1.00007fa574400000.00007fa574416000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.00007fa574400000.00007fa574416000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mips.elf	24%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
catvision.dyn	176.32.32.113	true	false	high
shitrocket.dyn	212.60.5.153	true	false	high
catlovingfools.geek	80.78.26.121	true	false	high
hikvision.geek	176.32.32.113	true	false	high
catlovingfools.geek. [malformed]	unknown	unknown	false	high
hikvision.geek. [malformed]	unknown	unknown	false	high
shitrocket.dyn. [malformed]	unknown	unknown	false	high
catvision.dyn. [malformed]	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
185.72.8.231	unknown	Russian Federation	57844	SPD-NETTR	true
176.32.32.113	catvision.dyn	Russian Federation	51659	ASBAXETRU	false
80.78.26.121	catlovingfools.geek	Cyprus	37560	CYBERDYNELR	false
212.64.215.71	unknown	Turkey	15395	RACKSPACE-LONGB	true
212.192.13.95	unknown	Russian Federation	49392	ASBAXETNRU	true
212.60.5.153	shitrocket.dyn	Russian Federation	49392	ASBAXETNRU	false
86.107.100.19	unknown	Romania	38995	AMG-ASRO	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.32.32.113	ppc.elf	Get hash	malicious	Mirai	Browse
176.32.32.113	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
80.78.26.121	ppc.elf	Get hash	malicious	Mirai	Browse
	nshkppc.elf	Get hash	malicious	Unknown	Browse
	nshkmpsl.elf	Get hash	malicious	Unknown	Browse
	nshkmips.elf	Get hash	malicious	Unknown	Browse
	nshkarm7.elf	Get hash	malicious	Unknown	Browse
	nshkarm5.elf	Get hash	malicious	Unknown	Browse
	nshkarm.elf	Get hash	malicious	Unknown	Browse
212.64.215.71	ppc.elf	Get hash	malicious	Mirai	Browse
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
	nshkppc.elf	Get hash	malicious	Unknown	Browse
	nshkmpsl.elf	Get hash	malicious	Unknown	Browse
	nshkmips.elf	Get hash	malicious	Unknown	Browse
	nshkarm7.elf	Get hash	malicious	Unknown	Browse
	nshkarm5.elf	Get hash	malicious	Unknown	Browse
	nshkarm.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
212.192.13.95	ppc.elf	Get hash	malicious	Mirai	Browse
212.192.13.95	nshkmpsl.elf	Get hash	malicious	Mirai	Browse
185.72.8.231	ppc.elf	Get hash	malicious	Mirai	Browse
185.72.8.231	nshkmpsl.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
catlovingfools.geek	nshkarm7.elf	Get hash	malicious	Mirai	Browse	212.192.13.95
catlovingfools.geek	nshkmips.elf	Get hash	malicious	Mirai	Browse	80.78.26.121
hikvision.geek	nshkarm7.elf	Get hash	malicious	Mirai	Browse	212.192.13.95
	nshkmips.elf	Get hash	malicious	Mirai	Browse	80.78.26.121
	arm4.elf	Get hash	malicious	Mirai	Browse	212.60.5.153
shitrocket.dyn	nshkmips.elf	Get hash	malicious	Mirai	Browse	176.32.32.113

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETRU	ppc.elf	Get hash	malicious	Mirai	Browse	176.32.32.113
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	176.32.32.113
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	176.32.38.130
	quotation.exe	Get hash	malicious	FormBook	Browse	176.32.38.130
	ppc.elf	Get hash	malicious	Unknown	Browse	45.147.200.148
	hmips.elf	Get hash	malicious	Unknown	Browse	45.147.200.148
	arm4.elf	Get hash	malicious	Unknown	Browse	45.140.169.21
	mips.elf	Get hash	malicious	Unknown	Browse	176.32.39.112
	ppc.elf	Get hash	malicious	Unknown	Browse	176.32.39.112
	hmips.elf	Get hash	malicious	Unknown	Browse	185.22.155.152
SPD-NETTR	ppc.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	2.58.124.230
	63Blg3Psdt.exe	Get hash	malicious	DCRat	Browse	185.118.143.220
	https://vmehy.daxizzobui.top/	Get hash	malicious	Unknown	Browse	195.133.45.183
	http://umjkitjtsk.top/crp/325gewfkj345	Get hash	malicious	Unknown	Browse	195.133.45.183
	http://draggedline.org	Get hash	malicious	Unknown	Browse	45.12.65.149
	LisectAVT_2403002C_106.exe	Get hash	malicious	Darkbot	Browse	195.133.45.237
	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Get hash	malicious	Bdaejec, PrivateLoader	Browse	212.193.30.29
	wO2hW34tnC.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	45.158.226.175
RACKSPACE-LONGB	ppc.elf	Get hash	malicious	Mirai	Browse	212.64.215.71
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	212.64.215.71
	1.elf	Get hash	malicious	Unknown	Browse	146.177.192.99
	nshkppc.elf	Get hash	malicious	Unknown	Browse	212.64.215.71
	nshkmpsl.elf	Get hash	malicious	Unknown	Browse	212.64.215.71
	nshkmips.elf	Get hash	malicious	Unknown	Browse	212.64.215.71
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	212.64.215.71
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	212.64.215.71
	nshkarm.elf	Get hash	malicious	Unknown	Browse	212.64.215.71
	i686.elf	Get hash	malicious	Mirai	Browse	92.52.99.131
CYBERDYNELR	ppc.elf	Get hash	malicious	Mirai	Browse	80.78.26.121
	nshkppc.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkmpsl.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkmips.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	nshkarm.elf	Get hash	malicious	Unknown	Browse	80.78.26.121
	GjNVpV53SR.exe	Get hash	malicious	Quasar	Browse	80.78.28.83
	p-p.c-440.DUSK.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.193.127.129
	PhysXCooking64.dll.dll	Get hash	malicious	Bazar Loader	Browse	80.78.24.30
INIT7CH	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.i686.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.x86_64.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dbus.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	CONSTANT_STRATEGY.elf	Get hash	malicious	Sliver	Browse	109.202.202.202
	10000.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.445794919595574
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mips.elf
File size:	93'276 bytes
MD5:	32c6f75edeee7332e753b4ecb610839f
SHA1:	19e3545fcce9507d03669edae161f61c20808e86
SHA256:	3335f6ae1285a05c10dc94041ae1501bdd5c2dc6126d2c9c05e39851b13e936b
SHA512:	01389652ce9d2c785fd684c1f288197ed6fce387efac2e731a46c7e33e88aa25e700caa999b09bee232a7415339889d21ebad7d985bae5230938dbd3c2aae67b
SSDEEP:	1536:fqCEsrio6fj8cCPc3IhiahilHiGhk9PZN+uRtSXqe65AFgrknnws:/9rR7ch3uPZ0unS76rknnws
TLSH:	B893D81F5E328FACF66D823447B38A31A79933D237E1C685D26CE6111E6024E645FFA4
File Content Preview:	.ELF.....................@.`...4..j,.....4. ...(.............@...@....W...W...............`..E`..E`.......[H........dt.Q............................<...'..L...!'.......................<...'..(...!... ....'9... ......................<...'......!........'9;

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	92716
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x13b20	0x0	0x6	AX	16
.fini	PROGBITS	0x413c40	0x13c40	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x413ca0	0x13ca0	0x1b10	0x0	0x2	A	16
.ctors	PROGBITS	0x456000	0x16000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x456008	0x16008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x456014	0x16014	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x456020	0x16020	0x3c8	0x0	0x3	WA	16
.got	PROGBITS	0x4563f0	0x163f0	0x5d8	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4569c8	0x169c8	0x28	0x0	0x10000003	WAp	4
.bss	NOBITS	0x4569f0	0x169c8	0x5158	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xc3c	0x169c8	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x169c8	0x64	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x157b0	0x157b0	5.5622	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x16000	0x456000	0x456000	0x9c8	0x5b48	3.8165	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 04:12:07.894099951 CET	43928	443	192.168.2.23	91.189.91.42
Dec 21, 2024 04:12:08.916301966 CET	58444	6593	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:08.966528893 CET	34284	6593	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:09.036312103 CET	6593	58444	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:09.036567926 CET	58444	6593	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:09.036681890 CET	58444	6593	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:09.086082935 CET	6593	34284	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:09.086164951 CET	34284	6593	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:09.086385012 CET	34284	6593	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:09.121797085 CET	48592	21334	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:09.147830963 CET	50556	21334	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:09.156090021 CET	6593	58444	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:09.156152010 CET	58444	6593	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:09.205965996 CET	6593	34284	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:09.206036091 CET	34284	6593	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:09.241441965 CET	21334	48592	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:09.241523027 CET	48592	21334	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:09.241807938 CET	48592	21334	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:09.267327070 CET	21334	50556	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:09.267386913 CET	50556	21334	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:09.267584085 CET	50556	21334	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:09.275612116 CET	6593	58444	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:09.325472116 CET	6593	34284	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:09.361217022 CET	21334	48592	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:09.361293077 CET	48592	21334	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:09.387046099 CET	21334	50556	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:09.387099028 CET	50556	21334	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:09.480812073 CET	21334	48592	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:09.506666899 CET	21334	50556	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:10.444371939 CET	6593	34284	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:10.444437027 CET	34284	6593	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:10.444583893 CET	34284	6593	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:10.870326996 CET	6593	58444	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:10.870461941 CET	58444	6593	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:10.870688915 CET	58444	6593	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:11.073127031 CET	21334	48592	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:11.073231936 CET	48592	21334	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:11.073373079 CET	48592	21334	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:11.477487087 CET	42516	80	192.168.2.23	109.202.202.202
Dec 21, 2024 04:12:13.269205093 CET	42836	443	192.168.2.23	91.189.91.43
Dec 21, 2024 04:12:15.689905882 CET	58356	6708	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:15.809607029 CET	6708	58356	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:15.809711933 CET	58356	6708	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:15.809712887 CET	58356	6708	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:15.929637909 CET	6708	58356	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:15.929722071 CET	58356	6708	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:16.049328089 CET	6708	58356	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:16.114213943 CET	42356	15005	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:16.233844995 CET	15005	42356	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:16.234177113 CET	42356	15005	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:16.234196901 CET	42356	15005	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:16.316708088 CET	35508	15005	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:16.355381966 CET	15005	42356	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:16.355431080 CET	42356	15005	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:16.437908888 CET	15005	35508	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:16.438002110 CET	35508	15005	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:16.438002110 CET	35508	15005	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:16.474966049 CET	15005	42356	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:16.557781935 CET	15005	35508	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:16.557857037 CET	35508	15005	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:16.677390099 CET	15005	35508	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:17.794492960 CET	15005	35508	185.72.8.231	192.168.2.23
Dec 21, 2024 04:12:17.794564009 CET	35508	15005	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:17.794615984 CET	35508	15005	192.168.2.23	185.72.8.231
Dec 21, 2024 04:12:19.272491932 CET	50556	21334	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:19.392406940 CET	21334	50556	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:23.293770075 CET	39924	21404	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:23.414975882 CET	21404	39924	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:23.415045977 CET	39924	21404	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:23.415066004 CET	39924	21404	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:23.536221981 CET	21404	39924	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:23.536284924 CET	39924	21404	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:23.655944109 CET	21404	39924	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:25.817404032 CET	58356	6708	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:25.937253952 CET	6708	58356	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:26.239510059 CET	42356	15005	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:26.359186888 CET	15005	42356	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:29.139049053 CET	43928	443	192.168.2.23	91.189.91.42
Dec 21, 2024 04:12:31.159410000 CET	21334	50556	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:31.159774065 CET	50556	21334	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:31.279498100 CET	21334	50556	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:33.422529936 CET	39924	21404	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:33.542310953 CET	21404	39924	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:36.399784088 CET	60054	16866	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:36.519407034 CET	16866	60054	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:36.519476891 CET	60054	16866	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:36.519512892 CET	60054	16866	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:36.639254093 CET	16866	60054	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:36.639328957 CET	60054	16866	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:36.758805037 CET	16866	60054	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:37.721853971 CET	6708	58356	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:37.721987009 CET	58356	6708	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:37.841614962 CET	6708	58356	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:38.128438950 CET	15005	42356	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:38.128614902 CET	42356	15005	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:38.248223066 CET	15005	42356	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:38.348542929 CET	16866	60054	86.107.100.19	192.168.2.23
Dec 21, 2024 04:12:38.348608971 CET	60054	16866	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:38.348649025 CET	60054	16866	192.168.2.23	86.107.100.19
Dec 21, 2024 04:12:39.377621889 CET	42836	443	192.168.2.23	91.189.91.43
Dec 21, 2024 04:12:41.425373077 CET	42516	80	192.168.2.23	109.202.202.202
Dec 21, 2024 04:12:42.972625017 CET	39492	13309	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:43.092294931 CET	13309	39492	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:43.092391968 CET	39492	13309	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:43.092540026 CET	39492	13309	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:43.212021112 CET	13309	39492	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:43.212141991 CET	39492	13309	192.168.2.23	212.192.13.95
Dec 21, 2024 04:12:43.331861019 CET	13309	39492	212.192.13.95	192.168.2.23
Dec 21, 2024 04:12:43.636405945 CET	38744	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:12:43.756055117 CET	21729	38744	80.78.26.121	192.168.2.23
Dec 21, 2024 04:12:43.756134033 CET	38744	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:12:43.756134033 CET	38744	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:12:43.843130112 CET	41032	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:43.876496077 CET	21729	38744	80.78.26.121	192.168.2.23
Dec 21, 2024 04:12:43.876554012 CET	38744	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:12:43.962847948 CET	21729	41032	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:43.962930918 CET	41032	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:43.962932110 CET	41032	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:43.996867895 CET	21729	38744	80.78.26.121	192.168.2.23
Dec 21, 2024 04:12:44.082647085 CET	21729	41032	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:44.082767010 CET	41032	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:44.202415943 CET	21729	41032	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:45.300390959 CET	21404	39924	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:45.300517082 CET	39924	21404	192.168.2.23	212.60.5.153
Dec 21, 2024 04:12:45.420207024 CET	21404	39924	212.60.5.153	192.168.2.23
Dec 21, 2024 04:12:50.791949987 CET	44844	6982	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:50.911581039 CET	6982	44844	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:50.911701918 CET	44844	6982	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:50.911701918 CET	44844	6982	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:51.031474113 CET	6982	44844	176.32.32.113	192.168.2.23
Dec 21, 2024 04:12:51.031761885 CET	44844	6982	192.168.2.23	176.32.32.113
Dec 21, 2024 04:12:51.151494980 CET	6982	44844	176.32.32.113	192.168.2.23
Dec 21, 2024 04:13:05.003695011 CET	13309	39492	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:05.003875971 CET	39492	13309	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:05.123574972 CET	13309	39492	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:05.691368103 CET	21729	38744	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:05.691636086 CET	38744	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:05.811285019 CET	21729	38744	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:05.878598928 CET	21729	41032	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:05.878932953 CET	41032	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:05.998512983 CET	21729	41032	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:10.093460083 CET	43928	443	192.168.2.23	91.189.91.42
Dec 21, 2024 04:13:10.265738010 CET	42186	17265	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:10.385303020 CET	17265	42186	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:10.385402918 CET	42186	17265	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:10.385438919 CET	42186	17265	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:10.505156040 CET	17265	42186	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:10.505237103 CET	42186	17265	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:10.625029087 CET	17265	42186	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:11.685868979 CET	38752	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:11.752904892 CET	17265	42186	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:11.753052950 CET	42186	17265	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:11.753101110 CET	42186	17265	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:11.805486917 CET	21729	38752	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:11.805594921 CET	38752	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:11.805659056 CET	38752	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:11.873583078 CET	41040	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:11.925296068 CET	21729	38752	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:11.925460100 CET	38752	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:11.993227959 CET	21729	41040	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:11.993392944 CET	41040	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:11.993459940 CET	41040	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:12.045036077 CET	21729	38752	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:12.113203049 CET	21729	41040	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:12.113353968 CET	41040	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:12.232906103 CET	21729	41040	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:12.832025051 CET	6982	44844	176.32.32.113	192.168.2.23
Dec 21, 2024 04:13:12.832201004 CET	44844	6982	192.168.2.23	176.32.32.113
Dec 21, 2024 04:13:12.951889992 CET	6982	44844	176.32.32.113	192.168.2.23
Dec 21, 2024 04:13:16.994915009 CET	45120	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:17.114701986 CET	7662	45120	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:17.114839077 CET	45120	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:17.114870071 CET	45120	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:17.234541893 CET	7662	45120	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:17.234651089 CET	45120	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:17.354651928 CET	7662	45120	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:18.148608923 CET	49168	22511	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:18.268608093 CET	22511	49168	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:18.268752098 CET	49168	22511	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:18.268752098 CET	49168	22511	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:18.388837099 CET	22511	49168	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:18.388964891 CET	49168	22511	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:18.508739948 CET	22511	49168	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:19.736268044 CET	22511	49168	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:19.736402988 CET	49168	22511	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:19.736510992 CET	49168	22511	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:25.045790911 CET	54074	21678	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:25.165692091 CET	21678	54074	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:25.165930033 CET	54074	21678	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:25.165930033 CET	54074	21678	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:25.285645962 CET	21678	54074	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:25.285923004 CET	54074	21678	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:25.405620098 CET	21678	54074	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:27.099364042 CET	21678	54074	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:27.099472046 CET	54074	21678	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:27.099554062 CET	54074	21678	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:32.341907978 CET	40242	24020	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:32.461698055 CET	24020	40242	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:32.461916924 CET	40242	24020	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:32.461916924 CET	40242	24020	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:32.581582069 CET	24020	40242	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:32.581820965 CET	40242	24020	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:32.703926086 CET	24020	40242	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:33.707587957 CET	21729	38752	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:33.707854986 CET	38752	21729	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:33.827502012 CET	21729	38752	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:33.896493912 CET	21729	41040	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:33.896719933 CET	41040	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:34.016659975 CET	21729	41040	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:34.403882027 CET	24020	40242	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:34.404292107 CET	40242	24020	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:34.404293060 CET	40242	24020	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:39.004688978 CET	7662	45120	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:39.004873991 CET	45120	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:39.124731064 CET	7662	45120	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:39.647396088 CET	56958	5189	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:39.766976118 CET	5189	56958	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:39.767051935 CET	56958	5189	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:39.767132998 CET	56958	5189	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:39.791879892 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:39.886722088 CET	5189	56958	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:39.886948109 CET	56958	5189	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:39.911519051 CET	14576	54102	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:39.911777973 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:39.911777973 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:39.958834887 CET	41054	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:40.007975101 CET	5189	56958	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:40.032246113 CET	14576	54102	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:40.032332897 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:40.078538895 CET	21729	41054	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:40.078876972 CET	41054	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:40.078983068 CET	41054	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:40.152091026 CET	14576	54102	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:40.198641062 CET	21729	41054	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:40.198744059 CET	41054	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:13:40.318403959 CET	21729	41054	212.60.5.153	192.168.2.23
Dec 21, 2024 04:13:41.215487957 CET	5189	56958	212.64.215.71	192.168.2.23
Dec 21, 2024 04:13:41.215779066 CET	56958	5189	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:41.215842962 CET	56958	5189	192.168.2.23	212.64.215.71
Dec 21, 2024 04:13:45.082541943 CET	45134	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:45.202239037 CET	7662	45134	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:45.202411890 CET	45134	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:45.202455997 CET	45134	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:45.322061062 CET	7662	45134	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:45.322204113 CET	45134	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:13:45.441773891 CET	7662	45134	80.78.26.121	192.168.2.23
Dec 21, 2024 04:13:46.473592997 CET	56590	9720	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:46.593283892 CET	9720	56590	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:46.593547106 CET	56590	9720	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:46.593592882 CET	56590	9720	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:46.713246107 CET	9720	56590	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:46.713423967 CET	56590	9720	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:46.833038092 CET	9720	56590	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:48.530576944 CET	9720	56590	212.192.13.95	192.168.2.23
Dec 21, 2024 04:13:48.530765057 CET	56590	9720	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:48.530765057 CET	56590	9720	192.168.2.23	212.192.13.95
Dec 21, 2024 04:13:53.859673023 CET	55586	2736	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:53.979439974 CET	2736	55586	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:53.980149031 CET	55586	2736	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:53.980149031 CET	55586	2736	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:54.099994898 CET	2736	55586	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:54.100194931 CET	55586	2736	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:54.220067024 CET	2736	55586	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:55.355201006 CET	2736	55586	185.72.8.231	192.168.2.23
Dec 21, 2024 04:13:55.355671883 CET	55586	2736	192.168.2.23	185.72.8.231
Dec 21, 2024 04:13:55.355673075 CET	55586	2736	192.168.2.23	185.72.8.231
Dec 21, 2024 04:14:01.381308079 CET	43514	22716	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:01.501193047 CET	22716	43514	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:01.501296043 CET	43514	22716	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:01.501450062 CET	43514	22716	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:01.621042967 CET	22716	43514	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:01.621263981 CET	43514	22716	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:01.741070986 CET	22716	43514	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:01.974261999 CET	21729	41054	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:01.974406958 CET	41054	21729	192.168.2.23	212.60.5.153
Dec 21, 2024 04:14:02.094023943 CET	21729	41054	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:07.130613089 CET	7662	45134	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:07.130806923 CET	45134	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:07.218089104 CET	59664	17988	192.168.2.23	212.60.5.153
Dec 21, 2024 04:14:07.250552893 CET	7662	45134	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:07.338890076 CET	17988	59664	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:07.338999033 CET	59664	17988	192.168.2.23	212.60.5.153
Dec 21, 2024 04:14:07.339042902 CET	59664	17988	192.168.2.23	212.60.5.153
Dec 21, 2024 04:14:07.460830927 CET	17988	59664	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:07.460968971 CET	59664	17988	192.168.2.23	212.60.5.153
Dec 21, 2024 04:14:07.580982924 CET	17988	59664	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:09.933399916 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:14:10.054258108 CET	14576	54102	185.72.8.231	192.168.2.23
Dec 21, 2024 04:14:10.396495104 CET	14576	54102	185.72.8.231	192.168.2.23
Dec 21, 2024 04:14:10.396804094 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:14:13.121370077 CET	45144	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:13.241103888 CET	7662	45144	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:13.241216898 CET	45144	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:13.241266966 CET	45144	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:13.360939980 CET	7662	45144	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:13.361051083 CET	45144	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:13.480600119 CET	7662	45144	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:17.344270945 CET	59664	17988	192.168.2.23	212.60.5.153
Dec 21, 2024 04:14:17.464066982 CET	17988	59664	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:23.247503042 CET	45144	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:23.367270947 CET	7662	45144	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:23.416055918 CET	22716	43514	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:23.416203022 CET	43514	22716	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:23.535779953 CET	22716	43514	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:28.669080973 CET	35008	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:28.788887978 CET	15571	35008	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:28.789153099 CET	35008	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:28.789154053 CET	35008	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:28.908927917 CET	15571	35008	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:28.909123898 CET	35008	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:29.028862000 CET	15571	35008	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:29.239773035 CET	17988	59664	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:29.240015030 CET	59664	17988	192.168.2.23	212.60.5.153
Dec 21, 2024 04:14:29.359596014 CET	17988	59664	212.60.5.153	192.168.2.23
Dec 21, 2024 04:14:34.517707109 CET	49914	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:34.637290001 CET	13113	49914	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:34.637389898 CET	49914	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:34.637455940 CET	49914	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:34.757535934 CET	13113	49914	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:34.757625103 CET	49914	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:34.877396107 CET	13113	49914	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:35.177535057 CET	7662	45144	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:35.177673101 CET	45144	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:35.297303915 CET	7662	45144	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:36.084741116 CET	13113	49914	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:36.084846020 CET	49914	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:36.084944010 CET	49914	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:45.988526106 CET	45150	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:46.108118057 CET	7662	45150	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:46.108207941 CET	45150	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:46.108295918 CET	45150	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:46.227996111 CET	7662	45150	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:46.228152037 CET	45150	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:46.347764015 CET	7662	45150	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:50.709175110 CET	15571	35008	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:50.709372997 CET	35008	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:50.828944921 CET	15571	35008	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:51.590625048 CET	49918	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:51.710614920 CET	13113	49918	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:51.710756063 CET	49918	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:51.710834026 CET	49918	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:51.832710981 CET	13113	49918	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:51.832818985 CET	49918	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:51.953919888 CET	13113	49918	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:53.160797119 CET	13113	49918	212.64.215.71	192.168.2.23
Dec 21, 2024 04:14:53.160890102 CET	49918	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:53.160990953 CET	49918	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:14:56.688153028 CET	35016	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:56.809514046 CET	15571	35016	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:56.809622049 CET	35016	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:56.809622049 CET	35016	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:56.929837942 CET	15571	35016	80.78.26.121	192.168.2.23
Dec 21, 2024 04:14:56.929919958 CET	35016	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:14:57.049537897 CET	15571	35016	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:03.910445929 CET	49922	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:15:04.031502962 CET	13113	49922	212.64.215.71	192.168.2.23
Dec 21, 2024 04:15:04.031754017 CET	49922	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:15:04.031754017 CET	49922	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:15:04.152406931 CET	13113	49922	212.64.215.71	192.168.2.23
Dec 21, 2024 04:15:04.152683020 CET	49922	13113	192.168.2.23	212.64.215.71
Dec 21, 2024 04:15:04.272294998 CET	13113	49922	212.64.215.71	192.168.2.23
Dec 21, 2024 04:15:06.818094969 CET	35016	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:15:06.937948942 CET	15571	35016	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:08.006805897 CET	7662	45150	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:08.007155895 CET	45150	7662	192.168.2.23	80.78.26.121
Dec 21, 2024 04:15:08.128452063 CET	7662	45150	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:18.502455950 CET	44760	3417	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:18.622100115 CET	3417	44760	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:18.622306108 CET	44760	3417	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:18.622430086 CET	44760	3417	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:18.709559917 CET	15571	35016	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:18.709943056 CET	35016	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:15:18.741918087 CET	3417	44760	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:18.742006063 CET	44760	3417	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:18.829463959 CET	15571	35016	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:18.861634970 CET	3417	44760	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:19.974116087 CET	3417	44760	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:19.974380016 CET	44760	3417	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:19.974380016 CET	44760	3417	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:25.210009098 CET	39850	3523	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:25.329963923 CET	3523	39850	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:25.330073118 CET	39850	3523	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:25.330152988 CET	39850	3523	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:25.449932098 CET	3523	39850	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:25.450037003 CET	39850	3523	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:25.569689035 CET	3523	39850	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:26.716125965 CET	3523	39850	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:26.716309071 CET	39850	3523	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:26.716394901 CET	39850	3523	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:30.455513954 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:30.575388908 CET	14576	54102	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:30.917213917 CET	14576	54102	185.72.8.231	192.168.2.23
Dec 21, 2024 04:15:30.917495012 CET	54102	14576	192.168.2.23	185.72.8.231
Dec 21, 2024 04:15:31.991909981 CET	59778	17721	192.168.2.23	176.32.32.113
Dec 21, 2024 04:15:32.112067938 CET	17721	59778	176.32.32.113	192.168.2.23
Dec 21, 2024 04:15:32.112224102 CET	59778	17721	192.168.2.23	176.32.32.113
Dec 21, 2024 04:15:32.112304926 CET	59778	17721	192.168.2.23	176.32.32.113
Dec 21, 2024 04:15:32.232182980 CET	17721	59778	176.32.32.113	192.168.2.23
Dec 21, 2024 04:15:32.232333899 CET	59778	17721	192.168.2.23	176.32.32.113
Dec 21, 2024 04:15:32.352082968 CET	17721	59778	176.32.32.113	192.168.2.23
Dec 21, 2024 04:15:34.290582895 CET	35026	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:15:34.410290003 CET	15571	35026	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:34.410449028 CET	35026	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:15:34.410502911 CET	35026	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:15:34.530045033 CET	15571	35026	80.78.26.121	192.168.2.23
Dec 21, 2024 04:15:34.530267000 CET	35026	15571	192.168.2.23	80.78.26.121
Dec 21, 2024 04:15:34.650299072 CET	15571	35026	80.78.26.121	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 04:12:08.654308081 CET	37368	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:12:08.702086926 CET	58979	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:12:08.857248068 CET	51782	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:12:08.881510973 CET	39216	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:12:08.913803101 CET	53	37368	185.181.61.24	192.168.2.23
Dec 21, 2024 04:12:08.965436935 CET	53	58979	185.181.61.24	192.168.2.23
Dec 21, 2024 04:12:09.120484114 CET	53	51782	185.181.61.24	192.168.2.23
Dec 21, 2024 04:12:09.146370888 CET	53	39216	185.181.61.24	192.168.2.23
Dec 21, 2024 04:12:15.449970961 CET	44217	53	192.168.2.23	217.160.70.42
Dec 21, 2024 04:12:15.688335896 CET	53	44217	217.160.70.42	192.168.2.23
Dec 21, 2024 04:12:15.876081944 CET	34086	53	192.168.2.23	217.160.70.42
Dec 21, 2024 04:12:16.077043056 CET	57381	53	192.168.2.23	217.160.70.42
Dec 21, 2024 04:12:16.113535881 CET	53	34086	217.160.70.42	192.168.2.23
Dec 21, 2024 04:12:16.315808058 CET	53	57381	217.160.70.42	192.168.2.23
Dec 21, 2024 04:12:22.795491934 CET	38969	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:12:23.043950081 CET	53	38969	202.61.197.122	192.168.2.23
Dec 21, 2024 04:12:23.044709921 CET	53948	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:12:23.293402910 CET	53	53948	152.53.15.127	192.168.2.23
Dec 21, 2024 04:12:36.160797119 CET	59821	53	192.168.2.23	217.160.70.42
Dec 21, 2024 04:12:36.399377108 CET	53	59821	217.160.70.42	192.168.2.23
Dec 21, 2024 04:12:42.722640991 CET	58020	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:12:42.971673965 CET	53	58020	202.61.197.122	192.168.2.23
Dec 21, 2024 04:12:43.130230904 CET	34025	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:12:43.349798918 CET	58679	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:12:43.382530928 CET	53	34025	202.61.197.122	192.168.2.23
Dec 21, 2024 04:12:43.383459091 CET	51463	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:12:43.596822977 CET	53	58679	202.61.197.122	192.168.2.23
Dec 21, 2024 04:12:43.598660946 CET	48867	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:12:43.636007071 CET	53	51463	152.53.15.127	192.168.2.23
Dec 21, 2024 04:12:43.842709064 CET	53	48867	152.53.15.127	192.168.2.23
Dec 21, 2024 04:12:50.301153898 CET	40877	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:12:50.542742014 CET	53	40877	202.61.197.122	192.168.2.23
Dec 21, 2024 04:12:50.543483019 CET	60450	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:12:50.791567087 CET	53	60450	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:10.005044937 CET	58925	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:13:10.265043974 CET	53	58925	185.181.61.24	192.168.2.23
Dec 21, 2024 04:13:10.693183899 CET	45425	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:13:10.880413055 CET	58819	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:13:10.945882082 CET	53	45425	202.61.197.122	192.168.2.23
Dec 21, 2024 04:13:10.946913958 CET	49220	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:13:11.127149105 CET	53	58819	202.61.197.122	192.168.2.23
Dec 21, 2024 04:13:11.128681898 CET	53128	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:13:11.191338062 CET	53	49220	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:11.192783117 CET	52655	53	192.168.2.23	81.169.136.222
Dec 21, 2024 04:13:11.377214909 CET	53	53128	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:11.378612041 CET	35555	53	192.168.2.23	81.169.136.222
Dec 21, 2024 04:13:11.430675030 CET	53	52655	81.169.136.222	192.168.2.23
Dec 21, 2024 04:13:11.432146072 CET	53860	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:13:11.616281986 CET	53	35555	81.169.136.222	192.168.2.23
Dec 21, 2024 04:13:11.617844105 CET	48644	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:13:11.684979916 CET	53	53860	202.61.197.122	192.168.2.23
Dec 21, 2024 04:13:11.872637033 CET	53	48644	202.61.197.122	192.168.2.23
Dec 21, 2024 04:13:16.755042076 CET	41275	53	192.168.2.23	51.158.108.203
Dec 21, 2024 04:13:16.994303942 CET	53	41275	51.158.108.203	192.168.2.23
Dec 21, 2024 04:13:17.834232092 CET	46351	53	192.168.2.23	109.91.184.21
Dec 21, 2024 04:13:18.147604942 CET	53	46351	109.91.184.21	192.168.2.23
Dec 21, 2024 04:13:24.738436937 CET	40197	53	192.168.2.23	168.235.111.72
Dec 21, 2024 04:13:25.045037031 CET	53	40197	168.235.111.72	192.168.2.23
Dec 21, 2024 04:13:32.101465940 CET	51471	53	192.168.2.23	81.169.136.222
Dec 21, 2024 04:13:32.340996981 CET	53	51471	81.169.136.222	192.168.2.23
Dec 21, 2024 04:13:38.710091114 CET	42803	53	192.168.2.23	168.235.111.72
Dec 21, 2024 04:13:38.899013996 CET	35864	53	192.168.2.23	168.235.111.72
Dec 21, 2024 04:13:39.030940056 CET	53	42803	168.235.111.72	192.168.2.23
Dec 21, 2024 04:13:39.032577038 CET	39180	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:13:39.205621004 CET	53	35864	168.235.111.72	192.168.2.23
Dec 21, 2024 04:13:39.207242012 CET	50227	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:13:39.295308113 CET	53	39180	185.181.61.24	192.168.2.23
Dec 21, 2024 04:13:39.297015905 CET	48347	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:13:39.406014919 CET	41106	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:13:39.467279911 CET	53	50227	185.181.61.24	192.168.2.23
Dec 21, 2024 04:13:39.468782902 CET	59951	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:13:39.539956093 CET	53	48347	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:39.541239977 CET	57884	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:13:39.646616936 CET	53	41106	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:39.714123964 CET	53	59951	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:39.715343952 CET	45797	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:13:39.791286945 CET	53	57884	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:39.957999945 CET	53	45797	194.36.144.87	192.168.2.23
Dec 21, 2024 04:13:44.007415056 CET	34911	53	192.168.2.23	81.169.136.222
Dec 21, 2024 04:13:44.245131016 CET	53	34911	81.169.136.222	192.168.2.23
Dec 21, 2024 04:13:44.246648073 CET	57077	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:13:44.491614103 CET	53	57077	202.61.197.122	192.168.2.23
Dec 21, 2024 04:13:44.493024111 CET	41354	53	192.168.2.23	168.235.111.72
Dec 21, 2024 04:13:44.808500051 CET	53	41354	168.235.111.72	192.168.2.23
Dec 21, 2024 04:13:44.810072899 CET	57292	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:13:45.081590891 CET	53	57292	185.181.61.24	192.168.2.23
Dec 21, 2024 04:13:46.218044043 CET	50847	53	192.168.2.23	202.61.197.122
Dec 21, 2024 04:13:46.472595930 CET	53	50847	202.61.197.122	192.168.2.23
Dec 21, 2024 04:13:53.534607887 CET	50209	53	192.168.2.23	168.235.111.72
Dec 21, 2024 04:13:53.857623100 CET	53	50209	168.235.111.72	192.168.2.23
Dec 21, 2024 04:14:00.358669996 CET	55118	53	192.168.2.23	51.158.108.203
Dec 21, 2024 04:14:00.598155022 CET	53	55118	51.158.108.203	192.168.2.23
Dec 21, 2024 04:14:00.600022078 CET	45235	53	192.168.2.23	213.202.211.221
Dec 21, 2024 04:14:00.832386017 CET	53	45235	213.202.211.221	192.168.2.23
Dec 21, 2024 04:14:00.834198952 CET	48750	53	192.168.2.23	109.91.184.21
Dec 21, 2024 04:14:01.118586063 CET	53	48750	109.91.184.21	192.168.2.23
Dec 21, 2024 04:14:01.120779991 CET	49010	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:14:01.380031109 CET	53	49010	185.181.61.24	192.168.2.23
Dec 21, 2024 04:14:06.977473021 CET	56348	53	192.168.2.23	217.160.70.42
Dec 21, 2024 04:14:07.216274977 CET	53	56348	217.160.70.42	192.168.2.23
Dec 21, 2024 04:14:12.133519888 CET	35375	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:14:12.384923935 CET	53	35375	194.36.144.87	192.168.2.23
Dec 21, 2024 04:14:12.387778044 CET	38164	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:14:12.636769056 CET	53	38164	194.36.144.87	192.168.2.23
Dec 21, 2024 04:14:12.638583899 CET	38029	53	192.168.2.23	217.160.70.42
Dec 21, 2024 04:14:12.877724886 CET	53	38029	217.160.70.42	192.168.2.23
Dec 21, 2024 04:14:12.880186081 CET	38845	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:14:13.120273113 CET	53	38845	152.53.15.127	192.168.2.23
Dec 21, 2024 04:14:28.418970108 CET	37583	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:14:28.668180943 CET	53	37583	152.53.15.127	192.168.2.23
Dec 21, 2024 04:14:34.241982937 CET	60428	53	192.168.2.23	109.91.184.21
Dec 21, 2024 04:14:34.516763926 CET	53	60428	109.91.184.21	192.168.2.23
Dec 21, 2024 04:14:40.179949999 CET	43213	53	192.168.2.23	168.235.111.72
Dec 21, 2024 04:14:40.492604017 CET	53	43213	168.235.111.72	192.168.2.23
Dec 21, 2024 04:14:40.493869066 CET	43971	53	192.168.2.23	80.152.203.134
Dec 21, 2024 04:14:41.086723089 CET	53413	53	192.168.2.23	80.152.203.134
Dec 21, 2024 04:14:45.497651100 CET	55777	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:14:45.746026993 CET	53	55777	152.53.15.127	192.168.2.23
Dec 21, 2024 04:14:45.747733116 CET	40815	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:14:45.987525940 CET	53	40815	152.53.15.127	192.168.2.23
Dec 21, 2024 04:14:46.089760065 CET	44990	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:14:46.337577105 CET	53	44990	152.53.15.127	192.168.2.23
Dec 21, 2024 04:14:46.339354992 CET	39231	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:14:46.583520889 CET	53	39231	152.53.15.127	192.168.2.23
Dec 21, 2024 04:14:46.585180998 CET	45011	53	192.168.2.23	168.138.12.137
Dec 21, 2024 04:14:55.711594105 CET	36433	53	192.168.2.23	213.202.211.221
Dec 21, 2024 04:14:55.944778919 CET	53	36433	213.202.211.221	192.168.2.23
Dec 21, 2024 04:14:55.946261883 CET	49204	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:14:56.195910931 CET	53	49204	194.36.144.87	192.168.2.23
Dec 21, 2024 04:14:56.196711063 CET	58032	53	192.168.2.23	194.36.144.87
Dec 21, 2024 04:14:56.445905924 CET	53	58032	194.36.144.87	192.168.2.23
Dec 21, 2024 04:14:56.446943998 CET	45920	53	192.168.2.23	217.160.70.42
Dec 21, 2024 04:14:56.687521935 CET	53	45920	217.160.70.42	192.168.2.23
Dec 21, 2024 04:14:58.162746906 CET	38150	53	192.168.2.23	213.202.211.221
Dec 21, 2024 04:14:58.395359993 CET	53	38150	213.202.211.221	192.168.2.23
Dec 21, 2024 04:14:58.396974087 CET	43312	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:14:58.641350031 CET	53	43312	152.53.15.127	192.168.2.23
Dec 21, 2024 04:14:58.643187046 CET	48349	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:14:58.903672934 CET	53	48349	185.181.61.24	192.168.2.23
Dec 21, 2024 04:14:58.905180931 CET	58724	53	192.168.2.23	80.152.203.134
Dec 21, 2024 04:15:13.010210991 CET	56549	53	192.168.2.23	168.138.12.137
Dec 21, 2024 04:15:18.016450882 CET	42330	53	192.168.2.23	213.202.211.221
Dec 21, 2024 04:15:18.249682903 CET	53	42330	213.202.211.221	192.168.2.23
Dec 21, 2024 04:15:18.250901937 CET	35672	53	192.168.2.23	152.53.15.127
Dec 21, 2024 04:15:18.501153946 CET	53	35672	152.53.15.127	192.168.2.23
Dec 21, 2024 04:15:23.712497950 CET	38109	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:15:23.975440025 CET	53	38109	185.181.61.24	192.168.2.23
Dec 21, 2024 04:15:23.977351904 CET	46928	53	192.168.2.23	109.91.184.21
Dec 21, 2024 04:15:24.283171892 CET	53	46928	109.91.184.21	192.168.2.23
Dec 21, 2024 04:15:24.284862995 CET	52798	53	192.168.2.23	109.91.184.21
Dec 21, 2024 04:15:24.976891041 CET	57971	53	192.168.2.23	213.202.211.221
Dec 21, 2024 04:15:25.208915949 CET	53	57971	213.202.211.221	192.168.2.23
Dec 21, 2024 04:15:29.287640095 CET	51374	53	192.168.2.23	80.152.203.134
Dec 21, 2024 04:15:31.719173908 CET	50833	53	192.168.2.23	185.181.61.24
Dec 21, 2024 04:15:31.990021944 CET	53	50833	185.181.61.24	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 04:12:08.654308081 CET	192.168.2.23	185.181.61.24	0x916	Standard query (0)	catvision.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.702086926 CET	192.168.2.23	185.181.61.24	0x916	Standard query (0)	catvision.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.857248068 CET	192.168.2.23	185.181.61.24	0x916	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.881510973 CET	192.168.2.23	185.181.61.24	0x916	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.449970961 CET	192.168.2.23	217.160.70.42	0xf90	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.876081944 CET	192.168.2.23	217.160.70.42	0xf90	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.077043056 CET	192.168.2.23	217.160.70.42	0xf90	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:22.795491934 CET	192.168.2.23	202.61.197.122	0x4733	Standard query (0)	catvision.dyn. [malformed]	256	279	false
Dec 21, 2024 04:12:23.044709921 CET	192.168.2.23	152.53.15.127	0xf135	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.160797119 CET	192.168.2.23	217.160.70.42	0xf90	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.722640991 CET	192.168.2.23	202.61.197.122	0x4733	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.130230904 CET	192.168.2.23	202.61.197.122	0x4733	Standard query (0)	catvision.dyn. [malformed]	256	299	false
Dec 21, 2024 04:12:43.349798918 CET	192.168.2.23	202.61.197.122	0x4733	Standard query (0)	catvision.dyn. [malformed]	256	299	false
Dec 21, 2024 04:12:43.383459091 CET	192.168.2.23	152.53.15.127	0xf135	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.598660946 CET	192.168.2.23	152.53.15.127	0xf135	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.301153898 CET	192.168.2.23	202.61.197.122	0x7bdf	Standard query (0)	catvision.dyn. [malformed]	256	306	false
Dec 21, 2024 04:12:50.543483019 CET	192.168.2.23	194.36.144.87	0xdd9d	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.005044937 CET	192.168.2.23	185.181.61.24	0xb898	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.693183899 CET	192.168.2.23	202.61.197.122	0x7bdf	Standard query (0)	hikvision.geek. [malformed]	256	326	false
Dec 21, 2024 04:13:10.880413055 CET	192.168.2.23	202.61.197.122	0x7bdf	Standard query (0)	shitrocket.dyn. [malformed]	256	326	false
Dec 21, 2024 04:13:10.946913958 CET	192.168.2.23	194.36.144.87	0xdd9d	Standard query (0)	shitrocket.dyn. [malformed]	256	327	false
Dec 21, 2024 04:13:11.128681898 CET	192.168.2.23	194.36.144.87	0xdd9d	Standard query (0)	catvision.dyn. [malformed]	256	327	false
Dec 21, 2024 04:13:11.192783117 CET	192.168.2.23	81.169.136.222	0x8585	Standard query (0)	catlovingfools.geek. [malformed]	256	327	false
Dec 21, 2024 04:13:11.378612041 CET	192.168.2.23	81.169.136.222	0x8585	Standard query (0)	catlovingfools.geek. [malformed]	256	327	false
Dec 21, 2024 04:13:11.432146072 CET	192.168.2.23	202.61.197.122	0xec25	Standard query (0)	catvision.dyn. [malformed]	256	327	false
Dec 21, 2024 04:13:11.617844105 CET	192.168.2.23	202.61.197.122	0xec25	Standard query (0)	hikvision.geek. [malformed]	256	327	false
Dec 21, 2024 04:13:16.755042076 CET	192.168.2.23	51.158.108.203	0xad3d	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:17.834232092 CET	192.168.2.23	109.91.184.21	0x9946	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:24.738436937 CET	192.168.2.23	168.235.111.72	0x44ba	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.101465940 CET	192.168.2.23	81.169.136.222	0x2abf	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:38.710091114 CET	192.168.2.23	168.235.111.72	0x44ba	Standard query (0)	catlovingfools.geek. [malformed]	256	354	false
Dec 21, 2024 04:13:38.899013996 CET	192.168.2.23	168.235.111.72	0x44ba	Standard query (0)	catlovingfools.geek. [malformed]	256	355	false
Dec 21, 2024 04:13:39.032577038 CET	192.168.2.23	185.181.61.24	0x897	Standard query (0)	hikvision.geek. [malformed]	256	355	false
Dec 21, 2024 04:13:39.207242012 CET	192.168.2.23	185.181.61.24	0x897	Standard query (0)	shitrocket.dyn. [malformed]	256	355	false
Dec 21, 2024 04:13:39.297015905 CET	192.168.2.23	194.36.144.87	0xaa29	Standard query (0)	catvision.dyn. [malformed]	256	355	false
Dec 21, 2024 04:13:39.406014919 CET	192.168.2.23	194.36.144.87	0xf1d9	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.468782902 CET	192.168.2.23	194.36.144.87	0xaa29	Standard query (0)	hikvision.geek. [malformed]	256	355	false
Dec 21, 2024 04:13:39.541239977 CET	192.168.2.23	194.36.144.87	0xf1d9	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.715343952 CET	192.168.2.23	194.36.144.87	0xf1d9	Standard query (0)	catvision.dyn. [malformed]	256	355	false
Dec 21, 2024 04:13:44.007415056 CET	192.168.2.23	81.169.136.222	0x8585	Standard query (0)	shitrocket.dyn. [malformed]	256	360	false
Dec 21, 2024 04:13:44.246648073 CET	192.168.2.23	202.61.197.122	0xec25	Standard query (0)	hikvision.geek. [malformed]	256	360	false
Dec 21, 2024 04:13:44.493024111 CET	192.168.2.23	168.235.111.72	0x44ba	Standard query (0)	catlovingfools.geek. [malformed]	256	360	false
Dec 21, 2024 04:13:44.810072899 CET	192.168.2.23	185.181.61.24	0x897	Standard query (0)	catvision.dyn. [malformed]	256	361	false
Dec 21, 2024 04:13:46.218044043 CET	192.168.2.23	202.61.197.122	0x7a0c	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.534607887 CET	192.168.2.23	168.235.111.72	0xd656	Standard query (0)	catlovingfools.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:00.358669996 CET	192.168.2.23	51.158.108.203	0x6531	Standard query (0)	hikvision.geek. [malformed]	256	376	false
Dec 21, 2024 04:14:00.600022078 CET	192.168.2.23	213.202.211.221	0x78b3	Standard query (0)	catlovingfools.geek. [malformed]	256	376	false
Dec 21, 2024 04:14:00.834198952 CET	192.168.2.23	109.91.184.21	0xe466	Standard query (0)	catvision.dyn. [malformed]	256	377	false
Dec 21, 2024 04:14:01.120779991 CET	192.168.2.23	185.181.61.24	0xa777	Standard query (0)	shitrocket.dyn	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:06.977473021 CET	192.168.2.23	217.160.70.42	0x91a1	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:12.133519888 CET	192.168.2.23	194.36.144.87	0xaa29	Standard query (0)	catvision.dyn. [malformed]	256	388	false
Dec 21, 2024 04:14:12.387778044 CET	192.168.2.23	194.36.144.87	0xf1d9	Standard query (0)	catlovingfools.geek. [malformed]	256	388	false
Dec 21, 2024 04:14:12.638583899 CET	192.168.2.23	217.160.70.42	0x91a1	Standard query (0)	shitrocket.dyn. [malformed]	256	388	false
Dec 21, 2024 04:14:12.880186081 CET	192.168.2.23	152.53.15.127	0x86b6	Standard query (0)	hikvision.geek. [malformed]	256	389	false
Dec 21, 2024 04:14:28.418970108 CET	192.168.2.23	152.53.15.127	0x9f93	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:34.241982937 CET	192.168.2.23	109.91.184.21	0xb7f1	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:40.179949999 CET	192.168.2.23	168.235.111.72	0xd656	Standard query (0)	catvision.dyn. [malformed]	256	416	false
Dec 21, 2024 04:14:40.493869066 CET	192.168.2.23	80.152.203.134	0x5873	Standard query (0)	catlovingfools.geek. [malformed]	256	417	false
Dec 21, 2024 04:14:41.086723089 CET	192.168.2.23	80.152.203.134	0x5873	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:45.497651100 CET	192.168.2.23	152.53.15.127	0x98f9	Standard query (0)	shitrocket.dyn. [malformed]	256	421	false
Dec 21, 2024 04:14:45.747733116 CET	192.168.2.23	152.53.15.127	0xdeba	Standard query (0)	hikvision.geek. [malformed]	256	421	false
Dec 21, 2024 04:14:46.089760065 CET	192.168.2.23	152.53.15.127	0x98f9	Standard query (0)	catvision.dyn. [malformed]	256	422	false
Dec 21, 2024 04:14:46.339354992 CET	192.168.2.23	152.53.15.127	0xdeba	Standard query (0)	catlovingfools.geek. [malformed]	256	422	false
Dec 21, 2024 04:14:46.585180998 CET	192.168.2.23	168.138.12.137	0x2825	Standard query (0)	shitrocket.dyn. [malformed]	256	426	false
Dec 21, 2024 04:14:55.711594105 CET	192.168.2.23	213.202.211.221	0xcc13	Standard query (0)	catlovingfools.geek. [malformed]	256	431	false
Dec 21, 2024 04:14:55.946261883 CET	192.168.2.23	194.36.144.87	0xe46c	Standard query (0)	shitrocket.dyn. [malformed]	256	432	false
Dec 21, 2024 04:14:56.196711063 CET	192.168.2.23	194.36.144.87	0xe1fa	Standard query (0)	hikvision.geek. [malformed]	256	432	false
Dec 21, 2024 04:14:56.446943998 CET	192.168.2.23	217.160.70.42	0xb31e	Standard query (0)	catvision.dyn. [malformed]	256	432	false
Dec 21, 2024 04:14:58.162746906 CET	192.168.2.23	213.202.211.221	0x6ab	Standard query (0)	shitrocket.dyn. [malformed]	256	434	false
Dec 21, 2024 04:14:58.396974087 CET	192.168.2.23	152.53.15.127	0x9f93	Standard query (0)	hikvision.geek. [malformed]	256	434	false
Dec 21, 2024 04:14:58.643187046 CET	192.168.2.23	185.181.61.24	0xc446	Standard query (0)	catlovingfools.geek. [malformed]	256	434	false
Dec 21, 2024 04:14:58.905180931 CET	192.168.2.23	80.152.203.134	0xa08	Standard query (0)	catvision.dyn. [malformed]	256	439	false
Dec 21, 2024 04:15:13.010210991 CET	192.168.2.23	168.138.12.137	0x2825	Standard query (0)	catlovingfools.geek. [malformed]	256	454	false
Dec 21, 2024 04:15:18.016450882 CET	192.168.2.23	213.202.211.221	0x6ab	Standard query (0)	catvision.dyn. [malformed]	256	454	false
Dec 21, 2024 04:15:18.250901937 CET	192.168.2.23	152.53.15.127	0x9f93	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:23.712497950 CET	192.168.2.23	185.181.61.24	0xad01	Standard query (0)	catlovingfools.geek. [malformed]	256	459	false
Dec 21, 2024 04:15:23.977351904 CET	192.168.2.23	109.91.184.21	0x3e3b	Standard query (0)	shitrocket.dyn. [malformed]	256	460	false
Dec 21, 2024 04:15:24.284862995 CET	192.168.2.23	109.91.184.21	0x7493	Standard query (0)	hikvision.geek. [malformed]	256	460	false
Dec 21, 2024 04:15:24.976891041 CET	192.168.2.23	213.202.211.221	0xcc13	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:29.287640095 CET	192.168.2.23	80.152.203.134	0x36b2	Standard query (0)	catvision.dyn. [malformed]	256	466	false
Dec 21, 2024 04:15:31.719173908 CET	192.168.2.23	185.181.61.24	0xdcde	Standard query (0)	hikvision.geek	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 04:12:08.913803101 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.913803101 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.913803101 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.913803101 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.913803101 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.913803101 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.913803101 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.965436935 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.965436935 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.965436935 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.965436935 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.965436935 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.965436935 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:08.965436935 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	catvision.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.120484114 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.120484114 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.120484114 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.120484114 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.120484114 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.120484114 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.120484114 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.146370888 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.146370888 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.146370888 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.146370888 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.146370888 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.146370888 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:09.146370888 CET	185.181.61.24	192.168.2.23	0x916	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.688335896 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.688335896 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.688335896 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.688335896 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.688335896 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.688335896 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:15.688335896 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.113535881 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.113535881 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.113535881 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.113535881 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.113535881 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.113535881 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.113535881 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.315808058 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.315808058 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.315808058 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.315808058 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.315808058 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.315808058 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:16.315808058 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:23.293402910 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:23.293402910 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:23.293402910 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:23.293402910 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:23.293402910 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:23.293402910 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:23.293402910 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.399377108 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.399377108 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.399377108 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.399377108 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.399377108 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.399377108 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:36.399377108 CET	217.160.70.42	192.168.2.23	0xf90	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.971673965 CET	202.61.197.122	192.168.2.23	0x4733	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.971673965 CET	202.61.197.122	192.168.2.23	0x4733	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.971673965 CET	202.61.197.122	192.168.2.23	0x4733	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.971673965 CET	202.61.197.122	192.168.2.23	0x4733	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.971673965 CET	202.61.197.122	192.168.2.23	0x4733	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.971673965 CET	202.61.197.122	192.168.2.23	0x4733	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:42.971673965 CET	202.61.197.122	192.168.2.23	0x4733	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.636007071 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.636007071 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.636007071 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.636007071 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.636007071 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.636007071 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.636007071 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.842709064 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.842709064 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.842709064 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.842709064 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.842709064 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.842709064 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:43.842709064 CET	152.53.15.127	192.168.2.23	0xf135	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.791567087 CET	194.36.144.87	192.168.2.23	0xdd9d	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.791567087 CET	194.36.144.87	192.168.2.23	0xdd9d	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.791567087 CET	194.36.144.87	192.168.2.23	0xdd9d	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.791567087 CET	194.36.144.87	192.168.2.23	0xdd9d	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.791567087 CET	194.36.144.87	192.168.2.23	0xdd9d	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.791567087 CET	194.36.144.87	192.168.2.23	0xdd9d	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:12:50.791567087 CET	194.36.144.87	192.168.2.23	0xdd9d	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.265043974 CET	185.181.61.24	192.168.2.23	0xb898	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.265043974 CET	185.181.61.24	192.168.2.23	0xb898	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.265043974 CET	185.181.61.24	192.168.2.23	0xb898	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.265043974 CET	185.181.61.24	192.168.2.23	0xb898	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.265043974 CET	185.181.61.24	192.168.2.23	0xb898	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.265043974 CET	185.181.61.24	192.168.2.23	0xb898	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:10.265043974 CET	185.181.61.24	192.168.2.23	0xb898	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:11.191338062 CET	194.36.144.87	192.168.2.23	0xdd9d	Format error (1)	shitrocket.dyn. [malformed]	none	none	256	327	false
Dec 21, 2024 04:13:11.377214909 CET	194.36.144.87	192.168.2.23	0xdd9d	Format error (1)	catvision.dyn. [malformed]	none	none	256	327	false
Dec 21, 2024 04:13:16.994303942 CET	51.158.108.203	192.168.2.23	0xad3d	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:16.994303942 CET	51.158.108.203	192.168.2.23	0xad3d	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:18.147604942 CET	109.91.184.21	192.168.2.23	0x9946	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:18.147604942 CET	109.91.184.21	192.168.2.23	0x9946	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:18.147604942 CET	109.91.184.21	192.168.2.23	0x9946	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:18.147604942 CET	109.91.184.21	192.168.2.23	0x9946	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:18.147604942 CET	109.91.184.21	192.168.2.23	0x9946	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:18.147604942 CET	109.91.184.21	192.168.2.23	0x9946	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:18.147604942 CET	109.91.184.21	192.168.2.23	0x9946	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:25.045037031 CET	168.235.111.72	192.168.2.23	0x44ba	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:25.045037031 CET	168.235.111.72	192.168.2.23	0x44ba	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:25.045037031 CET	168.235.111.72	192.168.2.23	0x44ba	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:25.045037031 CET	168.235.111.72	192.168.2.23	0x44ba	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:25.045037031 CET	168.235.111.72	192.168.2.23	0x44ba	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:25.045037031 CET	168.235.111.72	192.168.2.23	0x44ba	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:25.045037031 CET	168.235.111.72	192.168.2.23	0x44ba	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.340996981 CET	81.169.136.222	192.168.2.23	0x2abf	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.340996981 CET	81.169.136.222	192.168.2.23	0x2abf	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.340996981 CET	81.169.136.222	192.168.2.23	0x2abf	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.340996981 CET	81.169.136.222	192.168.2.23	0x2abf	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.340996981 CET	81.169.136.222	192.168.2.23	0x2abf	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.340996981 CET	81.169.136.222	192.168.2.23	0x2abf	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:32.340996981 CET	81.169.136.222	192.168.2.23	0x2abf	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.539956093 CET	194.36.144.87	192.168.2.23	0xaa29	Format error (1)	catvision.dyn. [malformed]	none	none	256	355	false
Dec 21, 2024 04:13:39.646616936 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.646616936 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.646616936 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.646616936 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.646616936 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.646616936 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.646616936 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.714123964 CET	194.36.144.87	192.168.2.23	0xaa29	Format error (1)	hikvision.geek. [malformed]	none	none	256	355	false
Dec 21, 2024 04:13:39.791286945 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.791286945 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.791286945 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.791286945 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.791286945 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.791286945 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.791286945 CET	194.36.144.87	192.168.2.23	0xf1d9	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:39.957999945 CET	194.36.144.87	192.168.2.23	0xf1d9	Format error (1)	catvision.dyn. [malformed]	none	none	256	355	false
Dec 21, 2024 04:13:46.472595930 CET	202.61.197.122	192.168.2.23	0x7a0c	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:46.472595930 CET	202.61.197.122	192.168.2.23	0x7a0c	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:46.472595930 CET	202.61.197.122	192.168.2.23	0x7a0c	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:46.472595930 CET	202.61.197.122	192.168.2.23	0x7a0c	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:46.472595930 CET	202.61.197.122	192.168.2.23	0x7a0c	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:46.472595930 CET	202.61.197.122	192.168.2.23	0x7a0c	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:46.472595930 CET	202.61.197.122	192.168.2.23	0x7a0c	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.857623100 CET	168.235.111.72	192.168.2.23	0xd656	No error (0)	catlovingfools.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.857623100 CET	168.235.111.72	192.168.2.23	0xd656	No error (0)	catlovingfools.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.857623100 CET	168.235.111.72	192.168.2.23	0xd656	No error (0)	catlovingfools.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.857623100 CET	168.235.111.72	192.168.2.23	0xd656	No error (0)	catlovingfools.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.857623100 CET	168.235.111.72	192.168.2.23	0xd656	No error (0)	catlovingfools.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.857623100 CET	168.235.111.72	192.168.2.23	0xd656	No error (0)	catlovingfools.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:13:53.857623100 CET	168.235.111.72	192.168.2.23	0xd656	No error (0)	catlovingfools.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:00.598155022 CET	51.158.108.203	192.168.2.23	0x6531	Format error (1)	hikvision.geek. [malformed]	none	none	256	376	false
Dec 21, 2024 04:14:01.118586063 CET	109.91.184.21	192.168.2.23	0xe466	Format error (1)	catvision.dyn. [malformed]	none	none	256	377	false
Dec 21, 2024 04:14:01.380031109 CET	185.181.61.24	192.168.2.23	0xa777	No error (0)	shitrocket.dyn		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:01.380031109 CET	185.181.61.24	192.168.2.23	0xa777	No error (0)	shitrocket.dyn		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:01.380031109 CET	185.181.61.24	192.168.2.23	0xa777	No error (0)	shitrocket.dyn		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:01.380031109 CET	185.181.61.24	192.168.2.23	0xa777	No error (0)	shitrocket.dyn		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:01.380031109 CET	185.181.61.24	192.168.2.23	0xa777	No error (0)	shitrocket.dyn		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:01.380031109 CET	185.181.61.24	192.168.2.23	0xa777	No error (0)	shitrocket.dyn		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:01.380031109 CET	185.181.61.24	192.168.2.23	0xa777	No error (0)	shitrocket.dyn		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:07.216274977 CET	217.160.70.42	192.168.2.23	0x91a1	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:07.216274977 CET	217.160.70.42	192.168.2.23	0x91a1	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:07.216274977 CET	217.160.70.42	192.168.2.23	0x91a1	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:07.216274977 CET	217.160.70.42	192.168.2.23	0x91a1	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:07.216274977 CET	217.160.70.42	192.168.2.23	0x91a1	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:07.216274977 CET	217.160.70.42	192.168.2.23	0x91a1	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:07.216274977 CET	217.160.70.42	192.168.2.23	0x91a1	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:12.384923935 CET	194.36.144.87	192.168.2.23	0xaa29	Format error (1)	catvision.dyn. [malformed]	none	none	256	388	false
Dec 21, 2024 04:14:12.636769056 CET	194.36.144.87	192.168.2.23	0xf1d9	Format error (1)	catlovingfools.geek. [malformed]	none	none	256	388	false
Dec 21, 2024 04:14:13.120273113 CET	152.53.15.127	192.168.2.23	0x86b6	Format error (1)	hikvision.geek. [malformed]	none	none	256	389	false
Dec 21, 2024 04:14:28.668180943 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:28.668180943 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:28.668180943 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:28.668180943 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:28.668180943 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:28.668180943 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:28.668180943 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:34.516763926 CET	109.91.184.21	192.168.2.23	0xb7f1	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:34.516763926 CET	109.91.184.21	192.168.2.23	0xb7f1	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:14:45.746026993 CET	152.53.15.127	192.168.2.23	0x98f9	Format error (1)	shitrocket.dyn. [malformed]	none	none	256	421	false
Dec 21, 2024 04:14:45.987525940 CET	152.53.15.127	192.168.2.23	0xdeba	Format error (1)	hikvision.geek. [malformed]	none	none	256	421	false
Dec 21, 2024 04:14:46.337577105 CET	152.53.15.127	192.168.2.23	0x98f9	Format error (1)	catvision.dyn. [malformed]	none	none	256	422	false
Dec 21, 2024 04:14:46.583520889 CET	152.53.15.127	192.168.2.23	0xdeba	Format error (1)	catlovingfools.geek. [malformed]	none	none	256	422	false
Dec 21, 2024 04:14:56.195910931 CET	194.36.144.87	192.168.2.23	0xe46c	Format error (1)	shitrocket.dyn. [malformed]	none	none	256	432	false
Dec 21, 2024 04:14:56.445905924 CET	194.36.144.87	192.168.2.23	0xe1fa	Format error (1)	hikvision.geek. [malformed]	none	none	256	432	false
Dec 21, 2024 04:14:58.641350031 CET	152.53.15.127	192.168.2.23	0x9f93	Format error (1)	hikvision.geek. [malformed]	none	none	256	434	false
Dec 21, 2024 04:15:18.501153946 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:18.501153946 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:18.501153946 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:18.501153946 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:18.501153946 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:18.501153946 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:18.501153946 CET	152.53.15.127	192.168.2.23	0x9f93	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:24.283171892 CET	109.91.184.21	192.168.2.23	0x3e3b	Format error (1)	shitrocket.dyn. [malformed]	none	none	256	460	false
Dec 21, 2024 04:15:25.208915949 CET	213.202.211.221	192.168.2.23	0xcc13	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:25.208915949 CET	213.202.211.221	192.168.2.23	0xcc13	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:25.208915949 CET	213.202.211.221	192.168.2.23	0xcc13	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:25.208915949 CET	213.202.211.221	192.168.2.23	0xcc13	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:25.208915949 CET	213.202.211.221	192.168.2.23	0xcc13	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:25.208915949 CET	213.202.211.221	192.168.2.23	0xcc13	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:25.208915949 CET	213.202.211.221	192.168.2.23	0xcc13	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:31.990021944 CET	185.181.61.24	192.168.2.23	0xdcde	No error (0)	hikvision.geek		80.78.26.121	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:31.990021944 CET	185.181.61.24	192.168.2.23	0xdcde	No error (0)	hikvision.geek		212.60.5.153	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:31.990021944 CET	185.181.61.24	192.168.2.23	0xdcde	No error (0)	hikvision.geek		176.32.32.113	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:31.990021944 CET	185.181.61.24	192.168.2.23	0xdcde	No error (0)	hikvision.geek		212.192.13.95	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:31.990021944 CET	185.181.61.24	192.168.2.23	0xdcde	No error (0)	hikvision.geek		86.107.100.19	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:31.990021944 CET	185.181.61.24	192.168.2.23	0xdcde	No error (0)	hikvision.geek		185.72.8.231	A (IP address)	IN (0x0001)	false
Dec 21, 2024 04:15:31.990021944 CET	185.181.61.24	192.168.2.23	0xdcde	No error (0)	hikvision.geek		212.64.215.71	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 6244, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6244, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.wCP1PA9yai /tmp/tmp.HfuxCb1bPx /tmp/tmp.XSRV98qGVS
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6245, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6245, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.wCP1PA9yai
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6246, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6246, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6247, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6247, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6248, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6248, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6249, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6249, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.wCP1PA9yai
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6250, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6250, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6251, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6251, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6252, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6252, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6253, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6253, Parent PID: 4338

General

Start time (UTC):	03:12:00
Start date (UTC):	21/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.wCP1PA9yai /tmp/tmp.HfuxCb1bPx /tmp/tmp.XSRV98qGVS
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: mips.elf PID: 6266, Parent PID: 6178

General

Start time (UTC):	03:12:07
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	/tmp/mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6268, Parent PID: 6266

General

Start time (UTC):	03:12:07
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6342, Parent PID: 6268

General

Start time (UTC):	03:12:08
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6344, Parent PID: 6268

General

Start time (UTC):	03:12:08
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6357, Parent PID: 6344

General

Start time (UTC):	03:12:08
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6376, Parent PID: 6357

General

Start time (UTC):	03:12:08
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6269, Parent PID: 6266

General

Start time (UTC):	03:12:07
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6272, Parent PID: 6266

General

Start time (UTC):	03:12:07
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6299, Parent PID: 6272

General

Start time (UTC):	03:12:07
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: mips.elf PID: 6301, Parent PID: 6299

General

Start time (UTC):	03:12:07
Start date (UTC):	21/12/2024
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 6244, Parent PID: 4338

General

Chronological Activities

Analysis Process: rm PID: 6244, Parent PID: 4338

General

Chronological Activities

Analysis Process: dash PID: 6245, Parent PID: 4338

General

Chronological Activities

Analysis Process: cat PID: 6245, Parent PID: 4338

General

Chronological Activities

Analysis Process: dash PID: 6246, Parent PID: 4338

General

Chronological Activities

Analysis Process: head PID: 6246, Parent PID: 4338

General

Linux Analysis Report
mips.elf