Edit tour

Linux Analysis Report
wlw68k.elf

Overview

General Information

Sample name:	wlw68k.elf
Analysis ID:	1580761
MD5:	31c5f506f09a530b2bd8a5dc24b6e488
SHA1:	877140c5f10d355863564e51a01f7a0fa062027c
SHA256:	55bcce02390de9520e6c3eedb674375f481556e5f75673822174e0d3ea10491b
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample deletes itself

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580761
Start date and time:	2024-12-26 04:17:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wlw68k.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/1@126/0

Runtime Messages

Command:	/tmp/wlw68k.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

wlw68k.elf (PID: 5435, Parent: 5362, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/wlw68k.elf

wlw68k.elf New Fork (PID: 5438, Parent: 5435)

wlw68k.elf New Fork (PID: 5440, Parent: 5438)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wlw68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wlw68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2061a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2062e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20642:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20656:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2066a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2067e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20692:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2070a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2071e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20732:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20746:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2075a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2076e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20782:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20796:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x207aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.00007f3d24001000.00007f3d24025000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.00007f3d24001000.00007f3d24025000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2061a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2062e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20642:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20656:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2066a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2067e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20692:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2070a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2071e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20732:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20746:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2075a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2076e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20782:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20796:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x207aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wlw68k.elf PID: 5435	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wlw68k.elf PID: 5435	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2fe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x304c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x309c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x313c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wlw68k.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: wlw68k.elf

ReversingLabs: Detection: 50%

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.cardiacpure.ru. [malformed]

Source: global traffic

TCP traffic: 192.168.2.13:44220 -> 178.215.238.25:33966

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wlw68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5435.1.00007f3d24001000.00007f3d24025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wlw68k.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/telnetsshwatchdogsshd/usr/compress/bin//compress/bin/compress/usr/bashmain_x86main_x86_64main_mipsmain_mipselmain_armmain_arm5main_arm6main_arm7main_ppcmain_m68kmain_sh4main_spchttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//tmp/var/mnt/boot/home/dev/..//root(deleted)raw.cardiacpure.ruabcdefghijklmnopqrstuvwxyz/proc/%d/cmdline/proc/%d/proc/self/proc/self/exe

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wlw68k.elf (PID: 5440)

SIGKILL sent: pid: 2, result: successful

Jump to behavior

Source: wlw68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5435.1.00007f3d24001000.00007f3d24025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wlw68k.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.troj.evad.linELF@0/1@126/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wlw68k.elf (PID: 5438)

File: /tmp/wlw68k.elf

Jump to behavior

Source: /tmp/wlw68k.elf (PID: 5435)

Queries kernel information via 'uname':

Jump to behavior

Source: wlw68k.elf, 5435.1.00007ffcf71c8000.00007ffcf71e9000.rw-.sdmp	Binary or memory string: ` V/tmp/qemu-open.2Nnqwc\4
Source: wlw68k.elf, 5435.1.00007ffcf71c8000.00007ffcf71e9000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: wlw68k.elf, 5435.1.00007ffcf71c8000.00007ffcf71e9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: wlw68k.elf, 5435.1.00007ffcf71c8000.00007ffcf71e9000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.2Nnqwc
Source: wlw68k.elf, 5435.1.00005620633fc000.0000562063481000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: wlw68k.elf, 5435.1.00007ffcf71c8000.00007ffcf71e9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/wlw68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wlw68k.elf
Source: wlw68k.elf, 5435.1.00005620633fc000.0000562063481000.rw-.sdmp	Binary or memory string: ?c V!/etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wlw68k.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f3d24001000.00007f3d24025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wlw68k.elf PID: 5435, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wlw68k.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f3d24001000.00007f3d24025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wlw68k.elf PID: 5435, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wlw68k.elf	50%	ReversingLabs	Linux.Trojan.Mirai
wlw68k.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.cardiacpure.ru	178.215.238.25	true	false		high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
178.215.238.25	raw.cardiacpure.ru	Germany		10753	LVLT-10753US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	main_mips.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	159.100.14.33-boatnet.arm7-2024-12-25T14_32_39.elf	Get hash	malicious	Mirai	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
178.215.238.25	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wiewa64.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.cardiacpure.ru	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	kqibeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wiewa64.elf	Get hash	malicious	Mirai	Browse	178.215.238.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	njvwa4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_x86_64.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
LVLT-10753US	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	armv6l.elf	Get hash	malicious	Mirai	Browse	217.22.7.57
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	94.154.174.150
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	45.129.149.6
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	147.207.230.32
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	178.215.238.74
	boatnet.i686.elf	Get hash	malicious	Mirai	Browse	178.215.238.74
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	178.215.238.74

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.2Nnqwc (deleted)

Download File

Process:	/tmp/wlw68k.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.9979526986606917
Encrypted:	false
SSDEEP:	3:Tg6STsHJN:Tg6SqJN
MD5:	BF3111512D872AB9E3B5A48F0AC80966
SHA1:	03B3640020F5687894E33E25C95FC7568D1C7CB1
SHA-256:	F4210DA08F35288FB3DEDBD7C658D9F05C3E77AB90788EA6EA4CCAC7E29BEE0B
SHA-512:	B96928302693ED844F0B671BB7198095ABEF666CE81EF389C904F1FDA80A4D70C1260E5266C13AA6391B274977140AF7CC0B725C67F36D5E6A565A3361888036
Malicious:	false
Reputation:	low
Preview:	/tmp/wlw68k.elf.nwlrbbmqbh

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.7835202322622035
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wlw68k.elf
File size:	163'072 bytes
MD5:	31c5f506f09a530b2bd8a5dc24b6e488
SHA1:	877140c5f10d355863564e51a01f7a0fa062027c
SHA256:	55bcce02390de9520e6c3eedb674375f481556e5f75673822174e0d3ea10491b
SHA512:	25eafc0c00235b8c3f344393b7470c59f27d6fdd16a6a3748094814dec0937914fe2df87ef913ed5db115b0e32df5daba00d06ff651c8a7723eee74d994a8f9c
SSDEEP:	3072:h4D8oZsd2+JgtwnzRRj7neVs8k7DVcjbiILR2tyxa/NYng:OIoP6nzRd7eG8k8LYyxUNYng
TLSH:	87F33ACBF801CDBDF80AF33648270D19B530B7D151825B3B2257B96BED3A1991963E86
File Content Preview:	.ELF.......................D...4..{p.....4. ...(......................1...1....... .......1...Q...Q...I........... .dt.Q............................NV..a....da....hN^NuNV..J9...0f>"y..Q. QJ.g.X.#...Q.N."y..Q. QJ.f.A.....J.g.Hy..1.N.X........0N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	162672
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x20492	0x0	0x6	AX	4
.fini	PROGBITS	0x8002053a	0x2053a	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x80020548	0x20548	0x2c52	0x0	0x2	A	2
.ctors	PROGBITS	0x800251a0	0x231a0	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x800251ac	0x231ac	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800251c0	0x231c0	0x4970	0x0	0x3	WA	32
.bss	NOBITS	0x80029b30	0x27b30	0x4584	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x27b30	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x2319a	0x2319a	6.1884	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x231a0	0x800251a0	0x800251a0	0x4990	0x8f14	0.5090	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 04:17:46.370476961 CET	44220	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:46.489998102 CET	33966	44220	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:46.490147114 CET	44220	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:46.492310047 CET	44220	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:46.611730099 CET	33966	44220	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:46.611874104 CET	44220	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:46.731353998 CET	33966	44220	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:47.755196095 CET	33966	44220	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:47.755280018 CET	44220	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:47.755491972 CET	44220	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:48.997997046 CET	44222	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:49.117707968 CET	33966	44222	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:49.117767096 CET	44222	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:49.119918108 CET	44222	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:49.239417076 CET	33966	44222	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:49.239486933 CET	44222	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:49.359112024 CET	33966	44222	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:50.382304907 CET	33966	44222	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:50.382400990 CET	44222	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:50.382435083 CET	44222	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:51.623009920 CET	44224	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:51.742568970 CET	33966	44224	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:51.742691994 CET	44224	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:51.743511915 CET	44224	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:51.863110065 CET	33966	44224	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:51.863257885 CET	44224	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:51.982867956 CET	33966	44224	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:53.008215904 CET	33966	44224	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:53.008313894 CET	44224	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:53.008371115 CET	44224	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:54.243443012 CET	44226	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:54.363121033 CET	33966	44226	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:54.363234997 CET	44226	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:54.364068985 CET	44226	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:54.483570099 CET	33966	44226	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:54.483650923 CET	44226	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:54.603177071 CET	33966	44226	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:55.628438950 CET	33966	44226	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:55.628561020 CET	44226	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:55.628561020 CET	44226	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:56.868272066 CET	44228	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:56.987896919 CET	33966	44228	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:56.987951994 CET	44228	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:56.989377975 CET	44228	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:57.108963966 CET	33966	44228	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:57.109172106 CET	44228	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:57.228740931 CET	33966	44228	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:57.976052999 CET	48202	443	192.168.2.13	185.125.190.26
Dec 26, 2024 04:17:58.253145933 CET	33966	44228	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:58.253339052 CET	44228	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:58.253339052 CET	44228	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:59.488518000 CET	44230	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:59.608083963 CET	33966	44230	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:59.608256102 CET	44230	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:59.609066963 CET	44230	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:59.728576899 CET	33966	44230	178.215.238.25	192.168.2.13
Dec 26, 2024 04:17:59.728770018 CET	44230	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:17:59.848437071 CET	33966	44230	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:00.894628048 CET	33966	44230	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:00.894790888 CET	44230	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:00.894790888 CET	44230	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:02.129127979 CET	44232	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:02.248763084 CET	33966	44232	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:02.248946905 CET	44232	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:02.249578953 CET	44232	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:02.369137049 CET	33966	44232	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:02.369187117 CET	44232	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:02.488724947 CET	33966	44232	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:03.516722918 CET	33966	44232	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:03.516838074 CET	44232	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:03.516863108 CET	44232	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:04.748931885 CET	44234	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:04.868428946 CET	33966	44234	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:04.868612051 CET	44234	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:04.869539976 CET	44234	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:04.989120960 CET	33966	44234	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:04.989178896 CET	44234	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:05.108974934 CET	33966	44234	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:06.134227991 CET	33966	44234	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:06.134306908 CET	44234	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:06.134354115 CET	44234	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:07.367999077 CET	44236	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:07.487579107 CET	33966	44236	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:07.487672091 CET	44236	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:07.488492966 CET	44236	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:07.608020067 CET	33966	44236	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:07.608134985 CET	44236	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:07.727675915 CET	33966	44236	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:28.695995092 CET	48202	443	192.168.2.13	185.125.190.26
Dec 26, 2024 04:18:29.832993031 CET	33966	44236	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:29.833205938 CET	44236	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:29.953764915 CET	33966	44236	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:32.072449923 CET	44238	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:32.192009926 CET	33966	44238	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:32.192167997 CET	44238	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:32.192944050 CET	44238	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:32.312449932 CET	33966	44238	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:32.312566042 CET	44238	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:32.432109118 CET	33966	44238	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:33.458658934 CET	33966	44238	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:33.458838940 CET	44238	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:33.458839893 CET	44238	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:34.697201967 CET	44240	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:34.817825079 CET	33966	44240	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:34.818027020 CET	44240	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:34.819281101 CET	44240	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:34.940193892 CET	33966	44240	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:34.940268993 CET	44240	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:35.065114975 CET	33966	44240	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:36.084078074 CET	33966	44240	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:36.084140062 CET	44240	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:36.084291935 CET	44240	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:37.320415974 CET	44242	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:37.444901943 CET	33966	44242	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:37.445199966 CET	44242	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:37.446193933 CET	44242	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:37.565685034 CET	33966	44242	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:37.565953016 CET	44242	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:37.685507059 CET	33966	44242	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:38.732556105 CET	33966	44242	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:38.732863903 CET	44242	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:38.732863903 CET	44242	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:39.970290899 CET	44244	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:40.089993954 CET	33966	44244	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:40.090071917 CET	44244	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:40.091089010 CET	44244	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:40.210773945 CET	33966	44244	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:40.210845947 CET	44244	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:40.330504894 CET	33966	44244	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:41.356281042 CET	33966	44244	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:41.356367111 CET	44244	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:41.356403112 CET	44244	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:42.592319965 CET	44246	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:42.711957932 CET	33966	44246	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:42.712203026 CET	44246	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:42.712934017 CET	44246	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:42.832461119 CET	33966	44246	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:42.832561970 CET	44246	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:42.952161074 CET	33966	44246	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:43.976952076 CET	33966	44246	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:43.977418900 CET	44246	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:43.977418900 CET	44246	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:45.211585045 CET	44248	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:45.331229925 CET	33966	44248	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:45.331461906 CET	44248	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:45.332248926 CET	44248	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:45.451765060 CET	33966	44248	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:45.451900959 CET	44248	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:45.571433067 CET	33966	44248	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:46.600224972 CET	33966	44248	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:46.600451946 CET	44248	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:46.600537062 CET	44248	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:47.838746071 CET	44250	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:47.958404064 CET	33966	44250	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:47.958615065 CET	44250	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:47.959774017 CET	44250	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:48.079293013 CET	33966	44250	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:48.079502106 CET	44250	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:48.199162006 CET	33966	44250	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:49.222884893 CET	33966	44250	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:49.223110914 CET	44250	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:49.223110914 CET	44250	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:50.458707094 CET	44252	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:50.578311920 CET	33966	44252	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:50.578495026 CET	44252	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:50.579612017 CET	44252	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:50.699124098 CET	33966	44252	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:50.699170113 CET	44252	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:50.818778038 CET	33966	44252	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:51.844233990 CET	33966	44252	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:51.844492912 CET	44252	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:51.844492912 CET	44252	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:53.083362103 CET	44254	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:53.203129053 CET	33966	44254	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:53.203454018 CET	44254	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:53.204900980 CET	44254	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:53.325320005 CET	33966	44254	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:53.325448990 CET	44254	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:53.445067883 CET	33966	44254	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:54.469877958 CET	33966	44254	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:54.470145941 CET	44254	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:54.470145941 CET	44254	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:55.709851027 CET	44256	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:55.829499960 CET	33966	44256	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:55.829669952 CET	44256	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:55.831051111 CET	44256	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:55.950556040 CET	33966	44256	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:55.950839043 CET	44256	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:56.070434093 CET	33966	44256	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:57.094175100 CET	33966	44256	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:57.094355106 CET	44256	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:57.094506025 CET	44256	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:58.330492973 CET	44258	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:58.450963020 CET	33966	44258	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:58.451157093 CET	44258	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:58.451778889 CET	44258	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:58.571305037 CET	33966	44258	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:58.571634054 CET	44258	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:58.691301107 CET	33966	44258	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:59.716121912 CET	33966	44258	178.215.238.25	192.168.2.13
Dec 26, 2024 04:18:59.716207027 CET	44258	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:18:59.716279984 CET	44258	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:00.951173067 CET	44260	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:01.071017027 CET	33966	44260	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:01.071192026 CET	44260	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:01.072242022 CET	44260	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:01.191775084 CET	33966	44260	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:01.191941023 CET	44260	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:01.312453032 CET	33966	44260	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:02.335577965 CET	33966	44260	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:02.335674047 CET	44260	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:02.335772991 CET	44260	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:03.573765993 CET	44262	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:03.693396091 CET	33966	44262	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:03.693536043 CET	44262	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:03.694677114 CET	44262	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:03.814214945 CET	33966	44262	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:03.814270973 CET	44262	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:03.933861971 CET	33966	44262	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:04.959362030 CET	33966	44262	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:04.959577084 CET	44262	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:04.959577084 CET	44262	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:06.200787067 CET	44264	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:06.320347071 CET	33966	44264	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:06.320563078 CET	44264	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:06.321893930 CET	44264	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:06.441437960 CET	33966	44264	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:06.441752911 CET	44264	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:06.561310053 CET	33966	44264	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:07.585360050 CET	33966	44264	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:07.585609913 CET	44264	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:07.585609913 CET	44264	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:08.825159073 CET	44266	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:08.944776058 CET	33966	44266	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:08.944848061 CET	44266	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:08.946129084 CET	44266	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:09.065779924 CET	33966	44266	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:09.065870047 CET	44266	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:09.185585022 CET	33966	44266	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:10.210613966 CET	33966	44266	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:10.210776091 CET	44266	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:10.210776091 CET	44266	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:11.448282003 CET	44268	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:11.568022966 CET	33966	44268	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:11.568156958 CET	44268	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:11.569191933 CET	44268	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:11.688738108 CET	33966	44268	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:11.688831091 CET	44268	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:11.808479071 CET	33966	44268	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:12.833995104 CET	33966	44268	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:12.834167004 CET	44268	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:12.834167957 CET	44268	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:14.069561005 CET	44270	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:14.189428091 CET	33966	44270	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:14.189637899 CET	44270	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:14.190442085 CET	44270	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:14.309983015 CET	33966	44270	178.215.238.25	192.168.2.13
Dec 26, 2024 04:19:14.310180902 CET	44270	33966	192.168.2.13	178.215.238.25
Dec 26, 2024 04:19:14.429796934 CET	33966	44270	178.215.238.25	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 04:17:45.513720036 CET	52377	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:45.751569033 CET	53	52377	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:45.753055096 CET	53416	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:45.875274897 CET	53	53416	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:45.876662970 CET	35966	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:45.998986006 CET	53	35966	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:46.000308037 CET	40793	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:46.122627020 CET	53	40793	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:46.123768091 CET	40193	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:46.246084929 CET	53	40193	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:46.247555017 CET	35027	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:46.369741917 CET	53	35027	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:47.758308887 CET	48553	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:47.880611897 CET	53	48553	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:47.881748915 CET	40566	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.004132986 CET	53	40566	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.005414009 CET	57709	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.127794027 CET	53	57709	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.130094051 CET	35237	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.252412081 CET	53	35237	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.254829884 CET	56593	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.377121925 CET	53	56593	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.379618883 CET	49852	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.501956940 CET	53	49852	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.503001928 CET	36739	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.625369072 CET	53	36739	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.626447916 CET	43562	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.748811007 CET	53	43562	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.750124931 CET	58605	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.872450113 CET	53	58605	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:48.874558926 CET	56694	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:48.997025013 CET	53	56694	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:50.384433985 CET	34930	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:50.506724119 CET	53	34930	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:50.508990049 CET	33308	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:50.631284952 CET	53	33308	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:50.632456064 CET	42199	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:50.754761934 CET	53	42199	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:50.756129980 CET	48353	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:50.879163027 CET	53	48353	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:50.881203890 CET	48140	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:51.003551960 CET	53	48140	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:51.005095005 CET	33474	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:51.127528906 CET	53	33474	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:51.128792048 CET	50382	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:51.251104116 CET	53	50382	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:51.253357887 CET	37357	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:51.375715017 CET	53	37357	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:51.376822948 CET	32786	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:51.499124050 CET	53	32786	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:51.500098944 CET	41413	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:51.622463942 CET	53	41413	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.009241104 CET	51852	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.131962061 CET	53	51852	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.133023024 CET	53766	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.255239964 CET	53	53766	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.256489038 CET	47730	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.379439116 CET	53	47730	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.380377054 CET	54693	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.502629042 CET	53	54693	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.503915071 CET	48137	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.626177073 CET	53	48137	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.626929998 CET	58420	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.749214888 CET	53	58420	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.750415087 CET	45751	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.872730970 CET	53	45751	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.873599052 CET	36904	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:53.995943069 CET	53	36904	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:53.996741056 CET	39729	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:54.119541883 CET	53	39729	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:54.120544910 CET	39462	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:54.242763996 CET	53	39462	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:55.629839897 CET	36755	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:55.753662109 CET	53	36755	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:55.754686117 CET	52270	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:55.877011061 CET	53	52270	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:55.878242016 CET	47997	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.001514912 CET	53	47997	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:56.002233982 CET	42902	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.124948025 CET	53	42902	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:56.126018047 CET	59299	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.248405933 CET	53	59299	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:56.249589920 CET	56979	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.372863054 CET	53	56979	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:56.373913050 CET	46638	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.497045994 CET	53	46638	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:56.498219013 CET	52722	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.620647907 CET	53	52722	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:56.621745110 CET	59496	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.744210005 CET	53	59496	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:56.745244026 CET	56778	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:56.867561102 CET	53	56778	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:58.254415989 CET	47731	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:58.376818895 CET	53	47731	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:58.377779007 CET	33943	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:58.500145912 CET	53	33943	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:58.501360893 CET	38140	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:58.623745918 CET	53	38140	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:58.624958992 CET	57080	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:58.747338057 CET	53	57080	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:58.748409033 CET	37736	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:58.870742083 CET	53	37736	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:58.871815920 CET	46683	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:58.994226933 CET	53	46683	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:58.995692015 CET	55598	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:59.118130922 CET	53	55598	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:59.119298935 CET	42796	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:59.241663933 CET	53	42796	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:59.242644072 CET	45426	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:59.364907980 CET	53	45426	8.8.8.8	192.168.2.13
Dec 26, 2024 04:17:59.365700006 CET	54695	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:17:59.487937927 CET	53	54695	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:00.895411968 CET	52165	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.017786980 CET	53	52165	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.019081116 CET	60687	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.141518116 CET	53	60687	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.142277956 CET	53290	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.264580965 CET	53	53290	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.265503883 CET	60265	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.387934923 CET	53	60265	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.388879061 CET	52468	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.511115074 CET	53	52468	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.511898041 CET	39912	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.634422064 CET	53	39912	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.635339022 CET	37470	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.757692099 CET	53	37470	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.758461952 CET	44656	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:01.880786896 CET	53	44656	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:01.881628990 CET	52242	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:02.004817963 CET	53	52242	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:02.006030083 CET	42153	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:02.128566980 CET	53	42153	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:03.517520905 CET	40268	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:03.639980078 CET	53	40268	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:03.640786886 CET	44304	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:03.763037920 CET	53	44304	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:03.763798952 CET	56142	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:03.885962963 CET	53	56142	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:03.886632919 CET	47977	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:04.008867979 CET	53	47977	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:04.009643078 CET	58208	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:04.132199049 CET	53	58208	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:04.132978916 CET	44011	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:04.255273104 CET	53	44011	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:04.256032944 CET	33214	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:04.378609896 CET	53	33214	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:04.379451990 CET	36362	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:04.502039909 CET	53	36362	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:04.502960920 CET	40303	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:04.625267029 CET	53	40303	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:04.625971079 CET	47979	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:04.748290062 CET	53	47979	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.135138035 CET	52651	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:06.257324934 CET	53	52651	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.258260012 CET	54270	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:06.380703926 CET	53	54270	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.381570101 CET	59596	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:06.503999949 CET	53	59596	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.504829884 CET	59282	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:06.627146959 CET	53	59282	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.628256083 CET	44874	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:06.750471115 CET	53	44874	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.751465082 CET	55387	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:06.873742104 CET	53	55387	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.874803066 CET	60500	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:06.997066975 CET	53	60500	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:06.998034954 CET	40185	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:07.120321989 CET	53	40185	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:07.121342897 CET	38682	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:07.243724108 CET	53	38682	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:07.244863033 CET	55853	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:07.367196083 CET	53	55853	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:30.836128950 CET	44306	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:30.959275007 CET	53	44306	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:30.960352898 CET	38636	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.082866907 CET	53	38636	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.083976030 CET	32821	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.206227064 CET	53	32821	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.207545996 CET	46406	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.330451965 CET	53	46406	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.331552982 CET	33089	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.454488039 CET	53	33089	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.455149889 CET	42092	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.577863932 CET	53	42092	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.579205036 CET	33661	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.701560020 CET	53	33661	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.702501059 CET	45688	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.825022936 CET	53	45688	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.826037884 CET	51475	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:31.948554993 CET	53	51475	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:31.949740887 CET	36796	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:32.072060108 CET	53	36796	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:33.459621906 CET	50692	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:33.581983089 CET	53	50692	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:33.582930088 CET	56108	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:33.705298901 CET	53	56108	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:33.706232071 CET	60924	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:33.828680038 CET	53	60924	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:33.829863071 CET	59232	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:33.952204943 CET	53	59232	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:33.953052998 CET	33266	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:34.075401068 CET	53	33266	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:34.076627016 CET	49152	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:34.199078083 CET	53	49152	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:34.200037956 CET	60328	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:34.322438002 CET	53	60328	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:34.323647976 CET	41581	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:34.445935011 CET	53	41581	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:34.446950912 CET	56644	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:34.572104931 CET	53	56644	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:34.573112965 CET	42318	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:34.696527004 CET	53	42318	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.085184097 CET	49984	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:36.208790064 CET	53	49984	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.209827900 CET	39085	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:36.332189083 CET	53	39085	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.333158970 CET	48191	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:36.455445051 CET	53	48191	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.456443071 CET	43984	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:36.578749895 CET	53	43984	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.579755068 CET	45658	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:36.702806950 CET	53	45658	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.703907967 CET	58159	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:36.826203108 CET	53	58159	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.827285051 CET	47929	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:36.949747086 CET	53	47929	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:36.950707912 CET	48004	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:37.073051929 CET	53	48004	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:37.074048996 CET	38460	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:37.196532965 CET	53	38460	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:37.197571993 CET	36478	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:37.319921970 CET	53	36478	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:38.733897924 CET	38001	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:38.856177092 CET	53	38001	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:38.857297897 CET	53864	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:38.979648113 CET	53	53864	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:38.981111050 CET	57490	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.103588104 CET	53	57490	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:39.104950905 CET	56652	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.227353096 CET	53	56652	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:39.228583097 CET	38218	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.350955009 CET	53	38218	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:39.352304935 CET	57775	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.474689007 CET	53	57775	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:39.475784063 CET	58500	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.598248005 CET	53	58500	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:39.599566936 CET	60947	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.721968889 CET	53	60947	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:39.723231077 CET	51899	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.845602036 CET	53	51899	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:39.846925020 CET	48203	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:39.969402075 CET	53	48203	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:41.357367039 CET	49420	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:41.479633093 CET	53	49420	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:41.480755091 CET	45529	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:41.603010893 CET	53	45529	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:41.604254961 CET	36944	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:41.726558924 CET	53	36944	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:41.729038954 CET	51629	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:41.851239920 CET	53	51629	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:41.852437019 CET	51710	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:41.974757910 CET	53	51710	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:41.975766897 CET	52628	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:42.098175049 CET	53	52628	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:42.099422932 CET	34853	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:42.221669912 CET	53	34853	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:42.222543955 CET	54803	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:42.344862938 CET	53	54803	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:42.345726967 CET	38364	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:42.468003035 CET	53	38364	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:42.469223022 CET	53134	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:42.591655016 CET	53	53134	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:43.978169918 CET	55411	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.100460052 CET	53	55411	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.101488113 CET	49884	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.224061012 CET	53	49884	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.225114107 CET	42347	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.347387075 CET	53	42347	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.348196983 CET	34824	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.470482111 CET	53	34824	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.471431971 CET	54047	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.594501019 CET	53	54047	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.595439911 CET	37923	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.717850924 CET	53	37923	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.718872070 CET	33563	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.841263056 CET	53	33563	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.842220068 CET	35540	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:44.964580059 CET	53	35540	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:44.965580940 CET	53145	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:45.087852001 CET	53	53145	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:45.088781118 CET	50071	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:45.211061954 CET	53	50071	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:46.601531029 CET	46378	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:46.724488974 CET	53	46378	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:46.725951910 CET	51432	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:46.848309040 CET	53	51432	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:46.849436045 CET	40240	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:46.971977949 CET	53	40240	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:46.973494053 CET	40558	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:47.095932007 CET	53	40558	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:47.097132921 CET	44486	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:47.219640017 CET	53	44486	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:47.220995903 CET	47776	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:47.343311071 CET	53	47776	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:47.344587088 CET	34710	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:47.467055082 CET	53	34710	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:47.468537092 CET	49920	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:47.590862989 CET	53	49920	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:47.591979980 CET	34932	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:47.714253902 CET	53	34932	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:47.715138912 CET	34672	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:47.837835073 CET	53	34672	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:49.224143982 CET	54444	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:49.346395969 CET	53	54444	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:49.347692966 CET	39494	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:49.470020056 CET	53	39494	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:49.471071959 CET	35590	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:49.593357086 CET	53	35590	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:49.594156981 CET	35767	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:49.716546059 CET	53	35767	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:49.717796087 CET	53035	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:49.840101004 CET	53	53035	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:49.840792894 CET	57966	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:49.963329077 CET	53	57966	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:49.964860916 CET	34762	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:50.087248087 CET	53	34762	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:50.088723898 CET	35784	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:50.211214066 CET	53	35784	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:50.211982965 CET	57849	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:50.334296942 CET	53	57849	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:50.335678101 CET	35430	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:50.457995892 CET	53	35430	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:51.845638037 CET	50280	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:51.967930079 CET	53	50280	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:51.969008923 CET	46912	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.091394901 CET	53	46912	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.092659950 CET	59158	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.214966059 CET	53	59158	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.216480970 CET	56944	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.338742018 CET	53	56944	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.340198040 CET	36291	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.462505102 CET	53	36291	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.464036942 CET	46996	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.586378098 CET	53	46996	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.587922096 CET	33092	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.710215092 CET	53	33092	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.711431980 CET	51555	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.834165096 CET	53	51555	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.835927963 CET	48747	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:52.958367109 CET	53	48747	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:52.960016966 CET	38771	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:53.082381010 CET	53	38771	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:54.471436977 CET	60938	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:54.593683958 CET	53	60938	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:54.595352888 CET	33740	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:54.717653990 CET	53	33740	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:54.719234943 CET	60262	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:54.841546059 CET	53	60262	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:54.843178988 CET	60734	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:54.965498924 CET	53	60734	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:54.967227936 CET	45167	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:55.089500904 CET	53	45167	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:55.091269970 CET	50971	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:55.213669062 CET	53	50971	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:55.215029001 CET	59373	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:55.337409973 CET	53	59373	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:55.338620901 CET	59111	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:55.461010933 CET	53	59111	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:55.462712049 CET	39116	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:55.585095882 CET	53	39116	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:55.586560011 CET	43928	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:55.708885908 CET	53	43928	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.095350027 CET	54860	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:57.217657089 CET	53	54860	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.218791008 CET	42157	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:57.341180086 CET	53	42157	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.342509031 CET	59810	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:57.464840889 CET	53	59810	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.466017008 CET	53106	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:57.588243961 CET	53	53106	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.589572906 CET	58242	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:57.711824894 CET	53	58242	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.712820053 CET	44386	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:57.835231066 CET	53	44386	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.836699009 CET	42738	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:57.959172010 CET	53	42738	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:57.960376024 CET	55606	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:58.082900047 CET	53	55606	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:58.084067106 CET	51279	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:58.206358910 CET	53	51279	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:58.207647085 CET	43362	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:58.329921007 CET	53	43362	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:59.716757059 CET	33283	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:59.838990927 CET	53	33283	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:59.839792013 CET	54105	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:18:59.962090969 CET	53	54105	8.8.8.8	192.168.2.13
Dec 26, 2024 04:18:59.963191986 CET	50399	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.085546970 CET	53	50399	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:00.086699009 CET	52649	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.209173918 CET	53	52649	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:00.210331917 CET	58340	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.332628012 CET	53	58340	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:00.333448887 CET	49851	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.455764055 CET	53	49851	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:00.457087994 CET	49458	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.579402924 CET	53	49458	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:00.580626011 CET	41899	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.702928066 CET	53	41899	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:00.704319954 CET	44829	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.826600075 CET	53	44829	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:00.827862978 CET	49742	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:00.950320005 CET	53	49742	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:02.336424112 CET	57930	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:02.458692074 CET	53	57930	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:02.459723949 CET	53293	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:02.582464933 CET	53	53293	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:02.583597898 CET	39217	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:02.707017899 CET	53	39217	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:02.708156109 CET	35952	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:02.830766916 CET	53	35952	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:02.832045078 CET	49167	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:02.954320908 CET	53	49167	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:02.956036091 CET	42231	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:03.078365088 CET	53	42231	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:03.079591036 CET	38171	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:03.201900005 CET	53	38171	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:03.203242064 CET	33034	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:03.325542927 CET	53	33034	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:03.326911926 CET	49501	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:03.449136972 CET	53	49501	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:03.450342894 CET	40731	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:03.572829008 CET	53	40731	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:04.960819960 CET	56508	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.083172083 CET	53	56508	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.085095882 CET	60662	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.207425117 CET	53	60662	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.209075928 CET	42710	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.331584930 CET	53	42710	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.333214045 CET	35609	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.455511093 CET	53	35609	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.457231045 CET	37170	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.579557896 CET	53	37170	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.581235886 CET	40503	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.703569889 CET	53	40503	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.705229998 CET	50219	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.827505112 CET	53	50219	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.829091072 CET	43982	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:05.951642036 CET	53	43982	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:05.953293085 CET	54318	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:06.075596094 CET	53	54318	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:06.077146053 CET	48078	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:06.199631929 CET	53	48078	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:07.586777925 CET	34065	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:07.709048986 CET	53	34065	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:07.710618019 CET	37128	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:07.832925081 CET	53	37128	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:07.834672928 CET	46886	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:07.957036972 CET	53	46886	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:07.958657026 CET	36944	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:08.081242085 CET	53	36944	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:08.082607985 CET	33732	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:08.205003023 CET	53	33732	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:08.206265926 CET	51212	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:08.328552961 CET	53	51212	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:08.330066919 CET	60050	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:08.452384949 CET	53	60050	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:08.453846931 CET	34372	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:08.576472044 CET	53	34372	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:08.577789068 CET	51111	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:08.700217009 CET	53	51111	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:08.701749086 CET	47916	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:08.824291945 CET	53	47916	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:10.211694956 CET	37220	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:10.333969116 CET	53	37220	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:10.335107088 CET	42381	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:10.458189011 CET	53	42381	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:10.459465981 CET	44255	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:10.581816912 CET	53	44255	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:10.583112001 CET	52417	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:10.705466032 CET	53	52417	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:10.706790924 CET	36585	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:10.829066038 CET	53	36585	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:10.830322027 CET	39816	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:10.952580929 CET	53	39816	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:10.953818083 CET	50481	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:11.076390028 CET	53	50481	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:11.077662945 CET	59602	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:11.200078964 CET	53	59602	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:11.201312065 CET	41025	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:11.323942900 CET	53	41025	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:11.325107098 CET	46154	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:11.447463989 CET	53	46154	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:12.835728884 CET	51185	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:12.958003044 CET	53	51185	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:12.959069967 CET	52872	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.081341028 CET	53	52872	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.082340002 CET	57843	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.205161095 CET	53	57843	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.206068039 CET	58263	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.328991890 CET	53	58263	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.330221891 CET	48125	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.452544928 CET	53	48125	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.453442097 CET	47388	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.575948954 CET	53	47388	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.576839924 CET	60401	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.699286938 CET	53	60401	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.700176954 CET	35602	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.822475910 CET	53	35602	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.823333979 CET	41114	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:13.945740938 CET	53	41114	8.8.8.8	192.168.2.13
Dec 26, 2024 04:19:13.946705103 CET	47654	53	192.168.2.13	8.8.8.8
Dec 26, 2024 04:19:14.069053888 CET	53	47654	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 26, 2024 04:17:45.513720036 CET	192.168.2.13	8.8.8.8	0x8076	Standard query (0)	raw.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Dec 26, 2024 04:17:47.758308887 CET	192.168.2.13	8.8.8.8	0x808d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	475	false
Dec 26, 2024 04:17:47.881748915 CET	192.168.2.13	8.8.8.8	0x808d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	476	false
Dec 26, 2024 04:17:48.005414009 CET	192.168.2.13	8.8.8.8	0x808d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	476	false
Dec 26, 2024 04:17:48.130094051 CET	192.168.2.13	8.8.8.8	0x808d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	476	false
Dec 26, 2024 04:17:48.254829884 CET	192.168.2.13	8.8.8.8	0x808d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	476	false
Dec 26, 2024 04:17:50.384433985 CET	192.168.2.13	8.8.8.8	0x9c43	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	478	false
Dec 26, 2024 04:17:50.508990049 CET	192.168.2.13	8.8.8.8	0x9c43	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	478	false
Dec 26, 2024 04:17:50.632456064 CET	192.168.2.13	8.8.8.8	0x9c43	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	478	false
Dec 26, 2024 04:17:50.756129980 CET	192.168.2.13	8.8.8.8	0x9c43	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	478	false
Dec 26, 2024 04:17:50.881203890 CET	192.168.2.13	8.8.8.8	0x9c43	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	479	false
Dec 26, 2024 04:17:53.009241104 CET	192.168.2.13	8.8.8.8	0x7999	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	481	false
Dec 26, 2024 04:17:53.133023024 CET	192.168.2.13	8.8.8.8	0x7999	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	481	false
Dec 26, 2024 04:17:53.256489038 CET	192.168.2.13	8.8.8.8	0x7999	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	481	false
Dec 26, 2024 04:17:53.380377054 CET	192.168.2.13	8.8.8.8	0x7999	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	481	false
Dec 26, 2024 04:17:53.503915071 CET	192.168.2.13	8.8.8.8	0x7999	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	481	false
Dec 26, 2024 04:17:55.629839897 CET	192.168.2.13	8.8.8.8	0x389e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Dec 26, 2024 04:17:55.754686117 CET	192.168.2.13	8.8.8.8	0x389e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Dec 26, 2024 04:17:55.878242016 CET	192.168.2.13	8.8.8.8	0x389e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 26, 2024 04:17:56.002233982 CET	192.168.2.13	8.8.8.8	0x389e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 26, 2024 04:17:56.126018047 CET	192.168.2.13	8.8.8.8	0x389e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 26, 2024 04:17:58.254415989 CET	192.168.2.13	8.8.8.8	0xed68	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 26, 2024 04:17:58.377779007 CET	192.168.2.13	8.8.8.8	0xed68	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 26, 2024 04:17:58.501360893 CET	192.168.2.13	8.8.8.8	0xed68	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 26, 2024 04:17:58.624958992 CET	192.168.2.13	8.8.8.8	0xed68	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 26, 2024 04:17:58.748409033 CET	192.168.2.13	8.8.8.8	0xed68	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 26, 2024 04:18:00.895411968 CET	192.168.2.13	8.8.8.8	0x7048	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 26, 2024 04:18:01.019081116 CET	192.168.2.13	8.8.8.8	0x7048	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 26, 2024 04:18:01.142277956 CET	192.168.2.13	8.8.8.8	0x7048	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 26, 2024 04:18:01.265503883 CET	192.168.2.13	8.8.8.8	0x7048	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 26, 2024 04:18:01.388879061 CET	192.168.2.13	8.8.8.8	0x7048	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 26, 2024 04:18:03.517520905 CET	192.168.2.13	8.8.8.8	0x5d18	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 26, 2024 04:18:03.640786886 CET	192.168.2.13	8.8.8.8	0x5d18	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 26, 2024 04:18:03.763798952 CET	192.168.2.13	8.8.8.8	0x5d18	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 26, 2024 04:18:03.886632919 CET	192.168.2.13	8.8.8.8	0x5d18	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	492	false
Dec 26, 2024 04:18:04.009643078 CET	192.168.2.13	8.8.8.8	0x5d18	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	492	false
Dec 26, 2024 04:18:06.135138035 CET	192.168.2.13	8.8.8.8	0x63b5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 26, 2024 04:18:06.258260012 CET	192.168.2.13	8.8.8.8	0x63b5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 26, 2024 04:18:06.381570101 CET	192.168.2.13	8.8.8.8	0x63b5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 26, 2024 04:18:06.504829884 CET	192.168.2.13	8.8.8.8	0x63b5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 26, 2024 04:18:06.628256083 CET	192.168.2.13	8.8.8.8	0x63b5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 26, 2024 04:18:30.836128950 CET	192.168.2.13	8.8.8.8	0x55e0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	262	false
Dec 26, 2024 04:18:30.960352898 CET	192.168.2.13	8.8.8.8	0x55e0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	263	false
Dec 26, 2024 04:18:31.083976030 CET	192.168.2.13	8.8.8.8	0x55e0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	263	false
Dec 26, 2024 04:18:31.207545996 CET	192.168.2.13	8.8.8.8	0x55e0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	263	false
Dec 26, 2024 04:18:31.331552982 CET	192.168.2.13	8.8.8.8	0x55e0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	263	false
Dec 26, 2024 04:18:33.459621906 CET	192.168.2.13	8.8.8.8	0x6618	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 26, 2024 04:18:33.582930088 CET	192.168.2.13	8.8.8.8	0x6618	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 26, 2024 04:18:33.706232071 CET	192.168.2.13	8.8.8.8	0x6618	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 26, 2024 04:18:33.829863071 CET	192.168.2.13	8.8.8.8	0x6618	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 26, 2024 04:18:33.953052998 CET	192.168.2.13	8.8.8.8	0x6618	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	266	false
Dec 26, 2024 04:18:36.085184097 CET	192.168.2.13	8.8.8.8	0xf9e2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 26, 2024 04:18:36.209827900 CET	192.168.2.13	8.8.8.8	0xf9e2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 26, 2024 04:18:36.333158970 CET	192.168.2.13	8.8.8.8	0xf9e2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 26, 2024 04:18:36.456443071 CET	192.168.2.13	8.8.8.8	0xf9e2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 26, 2024 04:18:36.579755068 CET	192.168.2.13	8.8.8.8	0xf9e2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 26, 2024 04:18:38.733897924 CET	192.168.2.13	8.8.8.8	0x3463	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	270	false
Dec 26, 2024 04:18:38.857297897 CET	192.168.2.13	8.8.8.8	0x3463	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	270	false
Dec 26, 2024 04:18:38.981111050 CET	192.168.2.13	8.8.8.8	0x3463	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 26, 2024 04:18:39.104950905 CET	192.168.2.13	8.8.8.8	0x3463	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 26, 2024 04:18:39.228583097 CET	192.168.2.13	8.8.8.8	0x3463	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 26, 2024 04:18:41.357367039 CET	192.168.2.13	8.8.8.8	0x50af	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 26, 2024 04:18:41.480755091 CET	192.168.2.13	8.8.8.8	0x50af	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 26, 2024 04:18:41.604254961 CET	192.168.2.13	8.8.8.8	0x50af	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 26, 2024 04:18:41.729038954 CET	192.168.2.13	8.8.8.8	0x50af	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 26, 2024 04:18:41.852437019 CET	192.168.2.13	8.8.8.8	0x50af	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 26, 2024 04:18:43.978169918 CET	192.168.2.13	8.8.8.8	0xc44f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 26, 2024 04:18:44.101488113 CET	192.168.2.13	8.8.8.8	0xc44f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 26, 2024 04:18:44.225114107 CET	192.168.2.13	8.8.8.8	0xc44f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 26, 2024 04:18:44.348196983 CET	192.168.2.13	8.8.8.8	0xc44f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 26, 2024 04:18:44.471431971 CET	192.168.2.13	8.8.8.8	0xc44f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 26, 2024 04:18:46.601531029 CET	192.168.2.13	8.8.8.8	0xc92f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	278	false
Dec 26, 2024 04:18:46.725951910 CET	192.168.2.13	8.8.8.8	0xc92f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	278	false
Dec 26, 2024 04:18:46.849436045 CET	192.168.2.13	8.8.8.8	0xc92f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	278	false
Dec 26, 2024 04:18:46.973494053 CET	192.168.2.13	8.8.8.8	0xc92f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 26, 2024 04:18:47.097132921 CET	192.168.2.13	8.8.8.8	0xc92f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 26, 2024 04:18:49.224143982 CET	192.168.2.13	8.8.8.8	0xdc7a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 26, 2024 04:18:49.347692966 CET	192.168.2.13	8.8.8.8	0xdc7a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 26, 2024 04:18:49.471071959 CET	192.168.2.13	8.8.8.8	0xdc7a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 26, 2024 04:18:49.594156981 CET	192.168.2.13	8.8.8.8	0xdc7a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 26, 2024 04:18:49.717796087 CET	192.168.2.13	8.8.8.8	0xdc7a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 26, 2024 04:18:51.845638037 CET	192.168.2.13	8.8.8.8	0x1258	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	283	false
Dec 26, 2024 04:18:51.969008923 CET	192.168.2.13	8.8.8.8	0x1258	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 26, 2024 04:18:52.092659950 CET	192.168.2.13	8.8.8.8	0x1258	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 26, 2024 04:18:52.216480970 CET	192.168.2.13	8.8.8.8	0x1258	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 26, 2024 04:18:52.340198040 CET	192.168.2.13	8.8.8.8	0x1258	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 26, 2024 04:18:54.471436977 CET	192.168.2.13	8.8.8.8	0xf83e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 26, 2024 04:18:54.595352888 CET	192.168.2.13	8.8.8.8	0xf83e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 26, 2024 04:18:54.719234943 CET	192.168.2.13	8.8.8.8	0xf83e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 26, 2024 04:18:54.843178988 CET	192.168.2.13	8.8.8.8	0xf83e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 26, 2024 04:18:54.967227936 CET	192.168.2.13	8.8.8.8	0xf83e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	287	false
Dec 26, 2024 04:18:57.095350027 CET	192.168.2.13	8.8.8.8	0x5a8f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 26, 2024 04:18:57.218791008 CET	192.168.2.13	8.8.8.8	0x5a8f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 26, 2024 04:18:57.342509031 CET	192.168.2.13	8.8.8.8	0x5a8f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 26, 2024 04:18:57.466017008 CET	192.168.2.13	8.8.8.8	0x5a8f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 26, 2024 04:18:57.589572906 CET	192.168.2.13	8.8.8.8	0x5a8f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 26, 2024 04:18:59.716757059 CET	192.168.2.13	8.8.8.8	0x3993	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	291	false
Dec 26, 2024 04:18:59.839792013 CET	192.168.2.13	8.8.8.8	0x3993	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	291	false
Dec 26, 2024 04:18:59.963191986 CET	192.168.2.13	8.8.8.8	0x3993	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 26, 2024 04:19:00.086699009 CET	192.168.2.13	8.8.8.8	0x3993	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 26, 2024 04:19:00.210331917 CET	192.168.2.13	8.8.8.8	0x3993	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 26, 2024 04:19:02.336424112 CET	192.168.2.13	8.8.8.8	0xc38e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	294	false
Dec 26, 2024 04:19:02.459723949 CET	192.168.2.13	8.8.8.8	0xc38e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	294	false
Dec 26, 2024 04:19:02.583597898 CET	192.168.2.13	8.8.8.8	0xc38e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	294	false
Dec 26, 2024 04:19:02.708156109 CET	192.168.2.13	8.8.8.8	0xc38e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	294	false
Dec 26, 2024 04:19:02.832045078 CET	192.168.2.13	8.8.8.8	0xc38e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	294	false
Dec 26, 2024 04:19:04.960819960 CET	192.168.2.13	8.8.8.8	0xb22f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 26, 2024 04:19:05.085095882 CET	192.168.2.13	8.8.8.8	0xb22f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 26, 2024 04:19:05.209075928 CET	192.168.2.13	8.8.8.8	0xb22f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 26, 2024 04:19:05.333214045 CET	192.168.2.13	8.8.8.8	0xb22f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 26, 2024 04:19:05.457231045 CET	192.168.2.13	8.8.8.8	0xb22f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 26, 2024 04:19:07.586777925 CET	192.168.2.13	8.8.8.8	0x5e23	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	299	false
Dec 26, 2024 04:19:07.710618019 CET	192.168.2.13	8.8.8.8	0x5e23	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	299	false
Dec 26, 2024 04:19:07.834672928 CET	192.168.2.13	8.8.8.8	0x5e23	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	299	false
Dec 26, 2024 04:19:07.958657026 CET	192.168.2.13	8.8.8.8	0x5e23	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	300	false
Dec 26, 2024 04:19:08.082607985 CET	192.168.2.13	8.8.8.8	0x5e23	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	300	false
Dec 26, 2024 04:19:10.211694956 CET	192.168.2.13	8.8.8.8	0x1680	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	302	false
Dec 26, 2024 04:19:10.335107088 CET	192.168.2.13	8.8.8.8	0x1680	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	302	false
Dec 26, 2024 04:19:10.459465981 CET	192.168.2.13	8.8.8.8	0x1680	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	302	false
Dec 26, 2024 04:19:10.583112001 CET	192.168.2.13	8.8.8.8	0x1680	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	302	false
Dec 26, 2024 04:19:10.706790924 CET	192.168.2.13	8.8.8.8	0x1680	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	302	false
Dec 26, 2024 04:19:12.835728884 CET	192.168.2.13	8.8.8.8	0x3675	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 26, 2024 04:19:12.959069967 CET	192.168.2.13	8.8.8.8	0x3675	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 26, 2024 04:19:13.082340002 CET	192.168.2.13	8.8.8.8	0x3675	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 26, 2024 04:19:13.206068039 CET	192.168.2.13	8.8.8.8	0x3675	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 26, 2024 04:19:13.330221891 CET	192.168.2.13	8.8.8.8	0x3675	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 04:17:45.751569033 CET	8.8.8.8	192.168.2.13	0x8076	No error (0)	raw.cardiacpure.ru		178.215.238.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: wlw68k.elf PID: 5435, Parent PID: 5362

General

Start time (UTC):	03:17:44
Start date (UTC):	26/12/2024
Path:	/tmp/wlw68k.elf
Arguments:	/tmp/wlw68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wlw68k.elf PID: 5438, Parent PID: 5435

General

Start time (UTC):	03:17:44
Start date (UTC):	26/12/2024
Path:	/tmp/wlw68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: wlw68k.elf PID: 5440, Parent PID: 5438

General

Start time (UTC):	03:17:44
Start date (UTC):	26/12/2024
Path:	/tmp/wlw68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wlw68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.2Nnqwc (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: wlw68k.elf PID: 5435, Parent PID: 5362

General

Chronological Activities

Analysis Process: wlw68k.elf PID: 5438, Parent PID: 5435

General

Chronological Activities

Analysis Process: wlw68k.elf PID: 5440, Parent PID: 5438

General

Chronological Activities

Linux Analysis Report
wlw68k.elf