Edit tour

Linux Analysis Report
Aqua.m68k.elf

Overview

General Information

Sample name:	Aqua.m68k.elf
Analysis ID:	1580712
MD5:	7cc8d85d69cdef108b5826d41aa71bf8
SHA1:	09955ab2072d6d8c046a9093632c8dab9830e588
SHA256:	62d070976b6f0af4f39f4a5e71d2768895628b3296292c0e857f0a5eae3af5d2
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample deletes itself

Sends malformed DNS queries

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580712
Start date and time:	2024-12-25 17:49:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.m68k.elf
Detection:	MAL
Classification:	mal56.troj.evad.linELF@0/1@100/0

Warnings

VT rate limit hit for: 45.148.10.84. [malformed]

Runtime Messages

Command:	/tmp/Aqua.m68k.elf
PID:	6251
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.m68k.elf (PID: 6251, Parent: 6177, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/Aqua.m68k.elf

Aqua.m68k.elf New Fork (PID: 6253, Parent: 6251)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Aqua.m68k.elf

ReversingLabs: Detection: 18%

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: 45.148.10.84. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown

DNS traffic detected: query: 45.148.10.84 replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic	DNS traffic detected: DNS query: 45.148.10.84
Source: global traffic	DNS traffic detected: DNS query: 45.148.10.84. [malformed]

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.troj.evad.linELF@0/1@100/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.m68k.elf (PID: 6253)

File: /tmp/Aqua.m68k.elf

Jump to behavior

Source: /tmp/Aqua.m68k.elf (PID: 6251)

Queries kernel information via 'uname':

Jump to behavior

Source: Aqua.m68k.elf, 6251.1.00007fff41ade000.00007fff41aff000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.LPVC3R\Dn;
Source: Aqua.m68k.elf, 6251.1.00007fff41ade000.00007fff41aff000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.LPVC3R
Source: Aqua.m68k.elf, 6251.1.00007fff41ade000.00007fff41aff000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: Aqua.m68k.elf, 6251.1.000055e77aedb000.000055e77af60000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: Aqua.m68k.elf, 6251.1.00007fff41ade000.00007fff41aff000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: Aqua.m68k.elf, 6251.1.000055e77aedb000.000055e77af60000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: Aqua.m68k.elf, 6251.1.00007fff41ade000.00007fff41aff000.rw-.sdmp	Binary or memory string: wGx86_64/usr/bin/qemu-m68k/tmp/Aqua.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.m68k.elf

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.m68k.elf	18%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
45.148.10.84	unknown	unknown	false		high
45.148.10.84. [malformed]	unknown	unknown	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.LPVC3R (deleted)

Download File

Process:	/tmp/Aqua.m68k.elf
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.254195650150781
Encrypted:	false
SSDEEP:	3:Tg9s+HJN:Tg9FJN
MD5:	F3F397AFAB5A2FAFD3ED15D9AC539FA5
SHA1:	00B3C1035E9A9C328B0F37AD2E20410918634831
SHA-256:	813A791800A8D59AC86723939917FF66B9D438D4A6BB7C81203E842AFF6C6FD8
SHA-512:	B241A66C747803C1B652C0B3613148CAB9E743389B5EB8E139EA3D2496A3BF7E375BD5F89CFCD5D20FA0CDCB47A6BDE4C42BEEAD18C89F5063CE0D277EDB9428
Malicious:	false
Reputation:	low
Preview:	/tmp/Aqua.m68k.elf.nwlrbbmqbh

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.213949179468479
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.m68k.elf
File size:	56'288 bytes
MD5:	7cc8d85d69cdef108b5826d41aa71bf8
SHA1:	09955ab2072d6d8c046a9093632c8dab9830e588
SHA256:	62d070976b6f0af4f39f4a5e71d2768895628b3296292c0e857f0a5eae3af5d2
SHA512:	4d60ca4b4615970ad10db2b01f1eb1ad785b1c5707bf09eedf8e5978a5a2d3835c1c22e2c1574ea026817e36fc463fabe042da4a401f70355e2df35e90d28646
SSDEEP:	768:F8e0pHIIShTU6nnH2laI8bDvzVAv/+98qZIeD3mFDjgMPIfU:iFpHwU6nW183BAv/s8qeeD3mFDsAz
TLSH:	22432BD6F801DD7CF80FD67F4463490AF270A75111830B3A63ABFE936D722A40966E86
File Content Preview:	.ELF.......................D...4...P.....4. ...(.......................`...`...... ........d...d...d......%P...... .dt.Q............................NV..a....da....4N^NuNV..J9....f>"y...\| QJ.g.X.#....\|N."y...\| QJ.f.A.....J.g.Hy...`N.X.........N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	55888
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xc45e	0x0	0x6	AX	4
.fini	PROGBITS	0x8000c506	0xc506	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000c514	0xc514	0x114c	0x0	0x2	A	2
.ctors	PROGBITS	0x8000f664	0xd664	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8000f66c	0xd66c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8000f678	0xd678	0x398	0x0	0x3	WA	4
.bss	NOBITS	0x8000fa10	0xda10	0x21a4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xda10	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0xd660	0xd660	6.2549	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0xd664	0x8000f664	0x8000f664	0x3ac	0x2550	3.3008	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:50:42.987004995 CET	42516	80	192.168.2.23	109.202.202.202
Dec 25, 2024 17:50:45.290688992 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 17:50:50.666120052 CET	42836	443	192.168.2.23	91.189.91.43
Dec 25, 2024 17:51:06.791842937 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 17:51:12.934885979 CET	42516	80	192.168.2.23	109.202.202.202
Dec 25, 2024 17:51:17.030410051 CET	42836	443	192.168.2.23	91.189.91.43
Dec 25, 2024 17:51:47.746166945 CET	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:50:45.169640064 CET	36820	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:45.304999113 CET	53	36820	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:45.305996895 CET	59862	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:45.440232992 CET	53	59862	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:45.441235065 CET	34708	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:45.575761080 CET	53	34708	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:45.576785088 CET	48533	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:45.712316990 CET	53	48533	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:45.713496923 CET	52165	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:45.847831011 CET	53	52165	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:45.849384069 CET	47828	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:45.982984066 CET	53	47828	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:45.984180927 CET	50858	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:46.109998941 CET	53	50858	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:46.111247063 CET	35896	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:46.239737034 CET	53	35896	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:46.240952015 CET	32955	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:46.363508940 CET	53	32955	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:46.365271091 CET	38557	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:46.498645067 CET	53	38557	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:49.502473116 CET	54993	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:49.626080036 CET	53	54993	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:49.627159119 CET	57764	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:49.764312029 CET	53	57764	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:49.765712023 CET	48905	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:49.890579939 CET	53	48905	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:49.891737938 CET	51151	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:50.016437054 CET	53	51151	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:50.017122984 CET	48173	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:50.142405033 CET	53	48173	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:50.143527985 CET	38659	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:50.284126043 CET	53	38659	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:50.285135984 CET	58761	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:50.407903910 CET	53	58761	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:50.408636093 CET	41611	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:50.536580086 CET	53	41611	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:50.538183928 CET	36247	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:50.667960882 CET	53	36247	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:50.669359922 CET	44613	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:50.791774035 CET	53	44613	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:58.794769049 CET	50174	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:58.918231964 CET	53	50174	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:58.920017958 CET	47330	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.049907923 CET	53	47330	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.051495075 CET	32910	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.179270029 CET	53	32910	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.180841923 CET	42639	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.309452057 CET	53	42639	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.311073065 CET	56268	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.433501959 CET	53	56268	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.435231924 CET	34525	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.569354057 CET	53	34525	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.570770025 CET	33378	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.693702936 CET	53	33378	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.695090055 CET	58175	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.817586899 CET	53	58175	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.818909883 CET	43850	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:50:59.944215059 CET	53	43850	8.8.8.8	192.168.2.23
Dec 25, 2024 17:50:59.945310116 CET	53133	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:00.067785978 CET	53	53133	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.071964979 CET	50520	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:01.206495047 CET	53	50520	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.207725048 CET	53642	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:01.342222929 CET	53	53642	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.343494892 CET	35913	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:01.468786001 CET	53	35913	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.469775915 CET	47696	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:01.592025042 CET	53	47696	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.593056917 CET	34805	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:01.721847057 CET	53	34805	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.723181009 CET	37707	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:01.845601082 CET	53	37707	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.847083092 CET	41535	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:01.970232964 CET	53	41535	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:01.971935034 CET	53886	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:02.095132113 CET	53	53886	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:02.096549988 CET	58072	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:02.230071068 CET	53	58072	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:02.231353998 CET	47495	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:02.354188919 CET	53	47495	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:12.355998039 CET	46318	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:12.481245041 CET	53	46318	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:12.482093096 CET	40809	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:12.604674101 CET	53	40809	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:12.605578899 CET	43689	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:12.728029013 CET	53	43689	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:12.729141951 CET	53060	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:12.851444006 CET	53	53060	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:12.852744102 CET	53961	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:12.987277985 CET	53	53961	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:12.988807917 CET	42950	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:13.111148119 CET	53	42950	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:13.112565041 CET	49312	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:13.246695042 CET	53	49312	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:13.247649908 CET	44405	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:13.381176949 CET	53	44405	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:13.382415056 CET	32960	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:13.505620003 CET	53	32960	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:13.506684065 CET	38656	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:13.629199982 CET	53	38656	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:17.632927895 CET	50646	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:17.755595922 CET	53	50646	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:17.757181883 CET	57381	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:17.890818119 CET	53	57381	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:17.892679930 CET	60720	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.015409946 CET	53	60720	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:18.016827106 CET	58558	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.150486946 CET	53	58558	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:18.152357101 CET	45088	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.275109053 CET	53	45088	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:18.277115107 CET	41637	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.399818897 CET	53	41637	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:18.402123928 CET	50963	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.524653912 CET	53	50963	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:18.526438951 CET	54347	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.660026073 CET	53	54347	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:18.662240028 CET	49775	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.790440083 CET	53	49775	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:18.791714907 CET	58804	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:18.914232016 CET	53	58804	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:25.917462111 CET	35575	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.039849997 CET	53	35575	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.041742086 CET	57898	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.164097071 CET	53	57898	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.165904999 CET	56244	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.299662113 CET	53	56244	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.301306963 CET	56934	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.434792042 CET	53	56934	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.436563015 CET	43171	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.558877945 CET	53	43171	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.560606956 CET	47404	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.682861090 CET	53	47404	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.684262037 CET	32925	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.809727907 CET	53	32925	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.811410904 CET	54649	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:26.944778919 CET	53	54649	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:26.946585894 CET	53359	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:27.074533939 CET	53	53359	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:27.076543093 CET	44787	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:27.210298061 CET	53	44787	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:28.215584040 CET	53056	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:28.337869883 CET	53	53056	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:28.339984894 CET	55806	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:28.462719917 CET	53	55806	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:28.464580059 CET	58819	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:28.586930037 CET	53	58819	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:28.588613033 CET	32914	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:28.711422920 CET	53	32914	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:28.713560104 CET	36001	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:28.836200953 CET	53	36001	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:28.838275909 CET	41150	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:28.972449064 CET	53	41150	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:28.974339008 CET	35154	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:29.100661993 CET	53	35154	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:29.102797985 CET	56688	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:29.236722946 CET	53	56688	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:29.238603115 CET	41630	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:29.361083031 CET	53	41630	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:29.362992048 CET	54524	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:29.485269070 CET	53	54524	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:36.490088940 CET	60133	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:36.625775099 CET	53	60133	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:36.628063917 CET	54672	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:36.762366056 CET	53	54672	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:36.764583111 CET	48253	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:36.886941910 CET	53	48253	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:36.888766050 CET	59478	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:37.013253927 CET	53	59478	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:37.014597893 CET	36524	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:37.137121916 CET	53	36524	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:37.138534069 CET	42822	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:37.260921001 CET	53	42822	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:37.262677908 CET	58235	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:37.396425009 CET	53	58235	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:37.398478985 CET	38866	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:37.532340050 CET	53	38866	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:37.534178019 CET	34341	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:37.662349939 CET	53	34341	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:37.664428949 CET	45253	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:37.787050962 CET	53	45253	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:40.791203976 CET	60280	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:40.913662910 CET	53	60280	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:40.915112019 CET	57544	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.048876047 CET	53	57544	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.050344944 CET	48131	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.178548098 CET	53	48131	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.180490017 CET	40803	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.302952051 CET	53	40803	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.305011988 CET	46542	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.427341938 CET	53	46542	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.429481983 CET	36920	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.552567005 CET	53	36920	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.554220915 CET	33325	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.679341078 CET	53	33325	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.681222916 CET	51162	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.803708076 CET	53	51162	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.805286884 CET	46757	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:41.927752972 CET	53	46757	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:41.929330111 CET	51480	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:42.051678896 CET	53	51480	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.055294037 CET	43057	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:49.177975893 CET	53	43057	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.179410934 CET	34832	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:49.302328110 CET	53	34832	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.303642035 CET	44691	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:49.426126957 CET	53	44691	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.427664995 CET	54194	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:49.563589096 CET	53	54194	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.565332890 CET	33503	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:49.687757969 CET	53	33503	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.688885927 CET	53299	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:49.817418098 CET	53	53299	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.818862915 CET	57436	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:49.947052956 CET	53	57436	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:49.948554993 CET	42916	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:50.070844889 CET	53	42916	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:50.071923971 CET	42108	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:50.194551945 CET	53	42108	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:50.195943117 CET	50251	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:50.319155931 CET	53	50251	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:52.323635101 CET	37296	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:52.448771954 CET	53	37296	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:52.450119972 CET	33027	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:52.572555065 CET	53	33027	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:52.574367046 CET	57760	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:52.696752071 CET	53	57760	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:52.698615074 CET	55076	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:52.821028948 CET	53	55076	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:52.823003054 CET	54280	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:52.963227987 CET	53	54280	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:52.965064049 CET	35780	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:53.119342089 CET	53	35780	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:53.121237040 CET	54126	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:53.254730940 CET	53	54126	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:53.256604910 CET	57768	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:53.379817963 CET	53	57768	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:53.381376982 CET	60596	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:53.508616924 CET	53	60596	8.8.8.8	192.168.2.23
Dec 25, 2024 17:51:53.510468960 CET	52073	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:51:53.633888960 CET	53	52073	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:02.638345957 CET	59383	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:02.772815943 CET	53	59383	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:02.774692059 CET	41217	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:02.901118994 CET	53	41217	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:02.903377056 CET	37116	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.029124975 CET	53	37116	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:03.031196117 CET	54309	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.157978058 CET	53	54309	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:03.159679890 CET	58291	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.288065910 CET	53	58291	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:03.289958954 CET	49354	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.428930998 CET	53	49354	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:03.430785894 CET	54854	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.558713913 CET	53	54854	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:03.560866117 CET	48436	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.688929081 CET	53	48436	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:03.690495968 CET	38881	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.812900066 CET	53	38881	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:03.814843893 CET	46558	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:03.938002110 CET	53	46558	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:11.941720963 CET	53310	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.064842939 CET	53	53310	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.066447973 CET	60747	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.189213037 CET	53	60747	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.190918922 CET	57615	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.315429926 CET	53	57615	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.317282915 CET	56972	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.445528984 CET	53	56972	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.447509050 CET	59083	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.575334072 CET	53	59083	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.577203035 CET	48938	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.700828075 CET	53	48938	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.701839924 CET	32775	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.827385902 CET	53	32775	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.828300953 CET	43276	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:12.953713894 CET	53	43276	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:12.954828024 CET	48638	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:13.077127934 CET	53	48638	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:13.078057051 CET	53612	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:13.200299025 CET	53	53612	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:23.202496052 CET	41210	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:23.325159073 CET	53	41210	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:23.328031063 CET	60708	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:23.450933933 CET	53	60708	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:23.452554941 CET	52652	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:23.586818933 CET	53	52652	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:23.588506937 CET	41644	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:23.710788012 CET	53	41644	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:23.712502003 CET	40963	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:23.834948063 CET	53	40963	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:23.837116957 CET	52584	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:23.959532976 CET	53	52584	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:23.961340904 CET	53347	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:24.095413923 CET	53	53347	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:24.096872091 CET	51532	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:24.231517076 CET	53	51532	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:24.232853889 CET	58880	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:24.381113052 CET	53	58880	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:24.382438898 CET	54129	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:24.507982016 CET	53	54129	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:27.512018919 CET	46912	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:27.645570040 CET	53	46912	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:27.647177935 CET	53850	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:27.781364918 CET	53	53850	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:27.783479929 CET	40830	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:27.918618917 CET	53	40830	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:27.920789003 CET	54462	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:28.043052912 CET	53	54462	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:28.045176029 CET	44106	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:28.167510033 CET	53	44106	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:28.169441938 CET	46921	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:28.291846991 CET	53	46921	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:28.294024944 CET	48173	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:28.423291922 CET	53	48173	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:28.425283909 CET	46297	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:28.547574997 CET	53	46297	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:28.549442053 CET	34618	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:28.671797991 CET	53	34618	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:28.673530102 CET	35650	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:28.795743942 CET	53	35650	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:29.800116062 CET	36932	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:29.923911095 CET	53	36932	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:29.925910950 CET	52567	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.048305988 CET	53	52567	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.050170898 CET	35990	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.172606945 CET	53	35990	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.174302101 CET	42662	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.299397945 CET	53	42662	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.301229954 CET	45311	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.429224968 CET	53	45311	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.431093931 CET	46389	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.556592941 CET	53	46389	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.558428049 CET	43102	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.693073988 CET	53	43102	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.694976091 CET	56410	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.819973946 CET	53	56410	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.821933031 CET	55325	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:30.947604895 CET	53	55325	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:30.949273109 CET	33099	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:31.075160980 CET	53	33099	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.079994917 CET	56008	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:34.202286959 CET	53	56008	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.204579115 CET	57047	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:34.332554102 CET	53	57047	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.334419966 CET	43806	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:34.460572958 CET	53	43806	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.462645054 CET	36544	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:34.584917068 CET	53	36544	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.586960077 CET	54530	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:34.709491014 CET	53	54530	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.711673975 CET	36828	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:34.837553978 CET	53	36828	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.839703083 CET	47266	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:34.962081909 CET	53	47266	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:34.964270115 CET	37078	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:35.086715937 CET	53	37078	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:35.088754892 CET	55841	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:35.216893911 CET	53	55841	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:35.219070911 CET	43591	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:35.355581999 CET	53	43591	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:39.360210896 CET	40513	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:39.482453108 CET	53	40513	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:39.484082937 CET	59936	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:39.606281996 CET	53	59936	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:39.607641935 CET	50396	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:39.730005026 CET	53	50396	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:39.731384993 CET	44221	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:39.856863976 CET	53	44221	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:39.858292103 CET	43317	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:39.980618954 CET	53	43317	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:39.982055902 CET	35851	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:40.107460976 CET	53	35851	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:40.108649015 CET	33881	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:40.231081963 CET	53	33881	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:40.231935024 CET	34447	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:40.354826927 CET	53	34447	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:40.356211901 CET	47747	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:40.481534004 CET	53	47747	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:40.482780933 CET	57876	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:40.675718069 CET	53	57876	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:48.678891897 CET	33718	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:48.803502083 CET	53	33718	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:48.805042028 CET	40294	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:48.930217028 CET	53	40294	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:48.931730986 CET	46955	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.067687035 CET	53	46955	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:49.069354057 CET	59664	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.191836119 CET	53	59664	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:49.193608046 CET	45738	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.326992989 CET	53	45738	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:49.328654051 CET	52777	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.454438925 CET	53	52777	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:49.455935001 CET	52525	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.578821898 CET	53	52525	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:49.580538988 CET	44677	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.703445911 CET	53	44677	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:49.705123901 CET	49616	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.834388018 CET	53	49616	8.8.8.8	192.168.2.23
Dec 25, 2024 17:52:49.835995913 CET	46449	53	192.168.2.23	8.8.8.8
Dec 25, 2024 17:52:49.971432924 CET	53	46449	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 17:50:45.169640064 CET	192.168.2.23	8.8.8.8	0xea7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.305996895 CET	192.168.2.23	8.8.8.8	0xea7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.441235065 CET	192.168.2.23	8.8.8.8	0xea7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.576785088 CET	192.168.2.23	8.8.8.8	0xea7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.713496923 CET	192.168.2.23	8.8.8.8	0xea7e	Standard query (0)	45.148.10.84	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:49.502473116 CET	192.168.2.23	8.8.8.8	0x35f2	Standard query (0)	45.148.10.84. [malformed]	256	489	false
Dec 25, 2024 17:50:49.627159119 CET	192.168.2.23	8.8.8.8	0x35f2	Standard query (0)	45.148.10.84. [malformed]	256	489	false
Dec 25, 2024 17:50:49.765712023 CET	192.168.2.23	8.8.8.8	0x35f2	Standard query (0)	45.148.10.84. [malformed]	256	489	false
Dec 25, 2024 17:50:49.891737938 CET	192.168.2.23	8.8.8.8	0x35f2	Standard query (0)	45.148.10.84. [malformed]	256	490	false
Dec 25, 2024 17:50:50.017122984 CET	192.168.2.23	8.8.8.8	0x35f2	Standard query (0)	45.148.10.84. [malformed]	256	490	false
Dec 25, 2024 17:50:58.794769049 CET	192.168.2.23	8.8.8.8	0x3041	Standard query (0)	45.148.10.84. [malformed]	256	498	false
Dec 25, 2024 17:50:58.920017958 CET	192.168.2.23	8.8.8.8	0x3041	Standard query (0)	45.148.10.84. [malformed]	256	499	false
Dec 25, 2024 17:50:59.051495075 CET	192.168.2.23	8.8.8.8	0x3041	Standard query (0)	45.148.10.84. [malformed]	256	499	false
Dec 25, 2024 17:50:59.180841923 CET	192.168.2.23	8.8.8.8	0x3041	Standard query (0)	45.148.10.84. [malformed]	256	499	false
Dec 25, 2024 17:50:59.311073065 CET	192.168.2.23	8.8.8.8	0x3041	Standard query (0)	45.148.10.84. [malformed]	256	499	false
Dec 25, 2024 17:51:01.071964979 CET	192.168.2.23	8.8.8.8	0x526	Standard query (0)	45.148.10.84. [malformed]	256	501	false
Dec 25, 2024 17:51:01.207725048 CET	192.168.2.23	8.8.8.8	0x526	Standard query (0)	45.148.10.84. [malformed]	256	501	false
Dec 25, 2024 17:51:01.343494892 CET	192.168.2.23	8.8.8.8	0x526	Standard query (0)	45.148.10.84. [malformed]	256	501	false
Dec 25, 2024 17:51:01.469775915 CET	192.168.2.23	8.8.8.8	0x526	Standard query (0)	45.148.10.84. [malformed]	256	501	false
Dec 25, 2024 17:51:01.593056917 CET	192.168.2.23	8.8.8.8	0x526	Standard query (0)	45.148.10.84. [malformed]	256	501	false
Dec 25, 2024 17:51:12.355998039 CET	192.168.2.23	8.8.8.8	0x2ba4	Standard query (0)	45.148.10.84. [malformed]	256	256	false
Dec 25, 2024 17:51:12.482093096 CET	192.168.2.23	8.8.8.8	0x2ba4	Standard query (0)	45.148.10.84. [malformed]	256	256	false
Dec 25, 2024 17:51:12.605578899 CET	192.168.2.23	8.8.8.8	0x2ba4	Standard query (0)	45.148.10.84. [malformed]	256	256	false
Dec 25, 2024 17:51:12.729141951 CET	192.168.2.23	8.8.8.8	0x2ba4	Standard query (0)	45.148.10.84. [malformed]	256	256	false
Dec 25, 2024 17:51:12.852744102 CET	192.168.2.23	8.8.8.8	0x2ba4	Standard query (0)	45.148.10.84. [malformed]	256	256	false
Dec 25, 2024 17:51:17.632927895 CET	192.168.2.23	8.8.8.8	0x86ad	Standard query (0)	45.148.10.84. [malformed]	256	261	false
Dec 25, 2024 17:51:17.757181883 CET	192.168.2.23	8.8.8.8	0x86ad	Standard query (0)	45.148.10.84. [malformed]	256	261	false
Dec 25, 2024 17:51:17.892679930 CET	192.168.2.23	8.8.8.8	0x86ad	Standard query (0)	45.148.10.84. [malformed]	256	262	false
Dec 25, 2024 17:51:18.016827106 CET	192.168.2.23	8.8.8.8	0x86ad	Standard query (0)	45.148.10.84. [malformed]	256	262	false
Dec 25, 2024 17:51:18.152357101 CET	192.168.2.23	8.8.8.8	0x86ad	Standard query (0)	45.148.10.84. [malformed]	256	262	false
Dec 25, 2024 17:51:25.917462111 CET	192.168.2.23	8.8.8.8	0xb549	Standard query (0)	45.148.10.84. [malformed]	256	270	false
Dec 25, 2024 17:51:26.041742086 CET	192.168.2.23	8.8.8.8	0xb549	Standard query (0)	45.148.10.84. [malformed]	256	270	false
Dec 25, 2024 17:51:26.165904999 CET	192.168.2.23	8.8.8.8	0xb549	Standard query (0)	45.148.10.84. [malformed]	256	270	false
Dec 25, 2024 17:51:26.301306963 CET	192.168.2.23	8.8.8.8	0xb549	Standard query (0)	45.148.10.84. [malformed]	256	270	false
Dec 25, 2024 17:51:26.436563015 CET	192.168.2.23	8.8.8.8	0xb549	Standard query (0)	45.148.10.84. [malformed]	256	270	false
Dec 25, 2024 17:51:28.215584040 CET	192.168.2.23	8.8.8.8	0xc85e	Standard query (0)	45.148.10.84. [malformed]	256	272	false
Dec 25, 2024 17:51:28.339984894 CET	192.168.2.23	8.8.8.8	0xc85e	Standard query (0)	45.148.10.84. [malformed]	256	272	false
Dec 25, 2024 17:51:28.464580059 CET	192.168.2.23	8.8.8.8	0xc85e	Standard query (0)	45.148.10.84. [malformed]	256	272	false
Dec 25, 2024 17:51:28.588613033 CET	192.168.2.23	8.8.8.8	0xc85e	Standard query (0)	45.148.10.84. [malformed]	256	272	false
Dec 25, 2024 17:51:28.713560104 CET	192.168.2.23	8.8.8.8	0xc85e	Standard query (0)	45.148.10.84. [malformed]	256	272	false
Dec 25, 2024 17:51:36.490088940 CET	192.168.2.23	8.8.8.8	0x83cc	Standard query (0)	45.148.10.84. [malformed]	256	280	false
Dec 25, 2024 17:51:36.628063917 CET	192.168.2.23	8.8.8.8	0x83cc	Standard query (0)	45.148.10.84. [malformed]	256	280	false
Dec 25, 2024 17:51:36.764583111 CET	192.168.2.23	8.8.8.8	0x83cc	Standard query (0)	45.148.10.84. [malformed]	256	280	false
Dec 25, 2024 17:51:36.888766050 CET	192.168.2.23	8.8.8.8	0x83cc	Standard query (0)	45.148.10.84. [malformed]	256	281	false
Dec 25, 2024 17:51:37.014597893 CET	192.168.2.23	8.8.8.8	0x83cc	Standard query (0)	45.148.10.84. [malformed]	256	281	false
Dec 25, 2024 17:51:40.791203976 CET	192.168.2.23	8.8.8.8	0x7a60	Standard query (0)	45.148.10.84. [malformed]	256	284	false
Dec 25, 2024 17:51:40.915112019 CET	192.168.2.23	8.8.8.8	0x7a60	Standard query (0)	45.148.10.84. [malformed]	256	285	false
Dec 25, 2024 17:51:41.050344944 CET	192.168.2.23	8.8.8.8	0x7a60	Standard query (0)	45.148.10.84. [malformed]	256	285	false
Dec 25, 2024 17:51:41.180490017 CET	192.168.2.23	8.8.8.8	0x7a60	Standard query (0)	45.148.10.84. [malformed]	256	285	false
Dec 25, 2024 17:51:41.305011988 CET	192.168.2.23	8.8.8.8	0x7a60	Standard query (0)	45.148.10.84. [malformed]	256	285	false
Dec 25, 2024 17:51:49.055294037 CET	192.168.2.23	8.8.8.8	0x1f9c	Standard query (0)	45.148.10.84. [malformed]	256	293	false
Dec 25, 2024 17:51:49.179410934 CET	192.168.2.23	8.8.8.8	0x1f9c	Standard query (0)	45.148.10.84. [malformed]	256	293	false
Dec 25, 2024 17:51:49.303642035 CET	192.168.2.23	8.8.8.8	0x1f9c	Standard query (0)	45.148.10.84. [malformed]	256	293	false
Dec 25, 2024 17:51:49.427664995 CET	192.168.2.23	8.8.8.8	0x1f9c	Standard query (0)	45.148.10.84. [malformed]	256	293	false
Dec 25, 2024 17:51:49.565332890 CET	192.168.2.23	8.8.8.8	0x1f9c	Standard query (0)	45.148.10.84. [malformed]	256	293	false
Dec 25, 2024 17:51:52.323635101 CET	192.168.2.23	8.8.8.8	0xdeb9	Standard query (0)	45.148.10.84. [malformed]	256	296	false
Dec 25, 2024 17:51:52.450119972 CET	192.168.2.23	8.8.8.8	0xdeb9	Standard query (0)	45.148.10.84. [malformed]	256	296	false
Dec 25, 2024 17:51:52.574367046 CET	192.168.2.23	8.8.8.8	0xdeb9	Standard query (0)	45.148.10.84. [malformed]	256	296	false
Dec 25, 2024 17:51:52.698615074 CET	192.168.2.23	8.8.8.8	0xdeb9	Standard query (0)	45.148.10.84. [malformed]	256	296	false
Dec 25, 2024 17:51:52.823003054 CET	192.168.2.23	8.8.8.8	0xdeb9	Standard query (0)	45.148.10.84. [malformed]	256	296	false
Dec 25, 2024 17:52:02.638345957 CET	192.168.2.23	8.8.8.8	0x2294	Standard query (0)	45.148.10.84. [malformed]	256	306	false
Dec 25, 2024 17:52:02.774692059 CET	192.168.2.23	8.8.8.8	0x2294	Standard query (0)	45.148.10.84. [malformed]	256	306	false
Dec 25, 2024 17:52:02.903377056 CET	192.168.2.23	8.8.8.8	0x2294	Standard query (0)	45.148.10.84. [malformed]	256	307	false
Dec 25, 2024 17:52:03.031196117 CET	192.168.2.23	8.8.8.8	0x2294	Standard query (0)	45.148.10.84. [malformed]	256	307	false
Dec 25, 2024 17:52:03.159679890 CET	192.168.2.23	8.8.8.8	0x2294	Standard query (0)	45.148.10.84. [malformed]	256	307	false
Dec 25, 2024 17:52:11.941720963 CET	192.168.2.23	8.8.8.8	0x6492	Standard query (0)	45.148.10.84. [malformed]	256	316	false
Dec 25, 2024 17:52:12.066447973 CET	192.168.2.23	8.8.8.8	0x6492	Standard query (0)	45.148.10.84. [malformed]	256	316	false
Dec 25, 2024 17:52:12.190918922 CET	192.168.2.23	8.8.8.8	0x6492	Standard query (0)	45.148.10.84. [malformed]	256	316	false
Dec 25, 2024 17:52:12.317282915 CET	192.168.2.23	8.8.8.8	0x6492	Standard query (0)	45.148.10.84. [malformed]	256	316	false
Dec 25, 2024 17:52:12.447509050 CET	192.168.2.23	8.8.8.8	0x6492	Standard query (0)	45.148.10.84. [malformed]	256	316	false
Dec 25, 2024 17:52:23.202496052 CET	192.168.2.23	8.8.8.8	0x260b	Standard query (0)	45.148.10.84. [malformed]	256	327	false
Dec 25, 2024 17:52:23.328031063 CET	192.168.2.23	8.8.8.8	0x260b	Standard query (0)	45.148.10.84. [malformed]	256	327	false
Dec 25, 2024 17:52:23.452554941 CET	192.168.2.23	8.8.8.8	0x260b	Standard query (0)	45.148.10.84. [malformed]	256	327	false
Dec 25, 2024 17:52:23.588506937 CET	192.168.2.23	8.8.8.8	0x260b	Standard query (0)	45.148.10.84. [malformed]	256	327	false
Dec 25, 2024 17:52:23.712502003 CET	192.168.2.23	8.8.8.8	0x260b	Standard query (0)	45.148.10.84. [malformed]	256	327	false
Dec 25, 2024 17:52:27.512018919 CET	192.168.2.23	8.8.8.8	0xf1e5	Standard query (0)	45.148.10.84. [malformed]	256	331	false
Dec 25, 2024 17:52:27.647177935 CET	192.168.2.23	8.8.8.8	0xf1e5	Standard query (0)	45.148.10.84. [malformed]	256	331	false
Dec 25, 2024 17:52:27.783479929 CET	192.168.2.23	8.8.8.8	0xf1e5	Standard query (0)	45.148.10.84. [malformed]	256	331	false
Dec 25, 2024 17:52:27.920789003 CET	192.168.2.23	8.8.8.8	0xf1e5	Standard query (0)	45.148.10.84. [malformed]	256	332	false
Dec 25, 2024 17:52:28.045176029 CET	192.168.2.23	8.8.8.8	0xf1e5	Standard query (0)	45.148.10.84. [malformed]	256	332	false
Dec 25, 2024 17:52:29.800116062 CET	192.168.2.23	8.8.8.8	0x3c7a	Standard query (0)	45.148.10.84. [malformed]	256	333	false
Dec 25, 2024 17:52:29.925910950 CET	192.168.2.23	8.8.8.8	0x3c7a	Standard query (0)	45.148.10.84. [malformed]	256	334	false
Dec 25, 2024 17:52:30.050170898 CET	192.168.2.23	8.8.8.8	0x3c7a	Standard query (0)	45.148.10.84. [malformed]	256	334	false
Dec 25, 2024 17:52:30.174302101 CET	192.168.2.23	8.8.8.8	0x3c7a	Standard query (0)	45.148.10.84. [malformed]	256	334	false
Dec 25, 2024 17:52:30.301229954 CET	192.168.2.23	8.8.8.8	0x3c7a	Standard query (0)	45.148.10.84. [malformed]	256	334	false
Dec 25, 2024 17:52:34.079994917 CET	192.168.2.23	8.8.8.8	0xf85f	Standard query (0)	45.148.10.84. [malformed]	256	338	false
Dec 25, 2024 17:52:34.204579115 CET	192.168.2.23	8.8.8.8	0xf85f	Standard query (0)	45.148.10.84. [malformed]	256	338	false
Dec 25, 2024 17:52:34.334419966 CET	192.168.2.23	8.8.8.8	0xf85f	Standard query (0)	45.148.10.84. [malformed]	256	338	false
Dec 25, 2024 17:52:34.462645054 CET	192.168.2.23	8.8.8.8	0xf85f	Standard query (0)	45.148.10.84. [malformed]	256	338	false
Dec 25, 2024 17:52:34.586960077 CET	192.168.2.23	8.8.8.8	0xf85f	Standard query (0)	45.148.10.84. [malformed]	256	338	false
Dec 25, 2024 17:52:39.360210896 CET	192.168.2.23	8.8.8.8	0xaa6e	Standard query (0)	45.148.10.84. [malformed]	256	343	false
Dec 25, 2024 17:52:39.484082937 CET	192.168.2.23	8.8.8.8	0xaa6e	Standard query (0)	45.148.10.84. [malformed]	256	343	false
Dec 25, 2024 17:52:39.607641935 CET	192.168.2.23	8.8.8.8	0xaa6e	Standard query (0)	45.148.10.84. [malformed]	256	343	false
Dec 25, 2024 17:52:39.731384993 CET	192.168.2.23	8.8.8.8	0xaa6e	Standard query (0)	45.148.10.84. [malformed]	256	343	false
Dec 25, 2024 17:52:39.858292103 CET	192.168.2.23	8.8.8.8	0xaa6e	Standard query (0)	45.148.10.84. [malformed]	256	343	false
Dec 25, 2024 17:52:48.678891897 CET	192.168.2.23	8.8.8.8	0x2044	Standard query (0)	45.148.10.84. [malformed]	256	352	false
Dec 25, 2024 17:52:48.805042028 CET	192.168.2.23	8.8.8.8	0x2044	Standard query (0)	45.148.10.84. [malformed]	256	352	false
Dec 25, 2024 17:52:48.931730986 CET	192.168.2.23	8.8.8.8	0x2044	Standard query (0)	45.148.10.84. [malformed]	256	353	false
Dec 25, 2024 17:52:49.069354057 CET	192.168.2.23	8.8.8.8	0x2044	Standard query (0)	45.148.10.84. [malformed]	256	353	false
Dec 25, 2024 17:52:49.193608046 CET	192.168.2.23	8.8.8.8	0x2044	Standard query (0)	45.148.10.84. [malformed]	256	353	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 17:50:45.304999113 CET	8.8.8.8	192.168.2.23	0xea7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.440232992 CET	8.8.8.8	192.168.2.23	0xea7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.575761080 CET	8.8.8.8	192.168.2.23	0xea7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.712316990 CET	8.8.8.8	192.168.2.23	0xea7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:50:45.847831011 CET	8.8.8.8	192.168.2.23	0xea7e	Name error (3)	45.148.10.84	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Aqua.m68k.elf PID: 6251, Parent PID: 6177

General

Start time (UTC):	16:50:43
Start date (UTC):	25/12/2024
Path:	/tmp/Aqua.m68k.elf
Arguments:	/tmp/Aqua.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: Aqua.m68k.elf PID: 6253, Parent PID: 6251

General

Start time (UTC):	16:50:44
Start date (UTC):	25/12/2024
Path:	/tmp/Aqua.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.LPVC3R (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Aqua.m68k.elf PID: 6251, Parent PID: 6177

General

Chronological Activities

Analysis Process: Aqua.m68k.elf PID: 6253, Parent PID: 6251

General

Chronological Activities

Linux Analysis Report
Aqua.m68k.elf