Edit tour

Linux Analysis Report
Aqua.mips.elf

Overview

General Information

Sample name:	Aqua.mips.elf
Analysis ID:	1581758
MD5:	1bb01799f3a5c103c7343edb17b133e4
SHA1:	6f12a7bc26257cda9fd0f77cfaf8ceaced2941ff
SHA256:	c1ab2104828785c25c39af728faa7f236da146b3a4d1309d6fa3d6915b08dd51
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581758
Start date and time:	2024-12-28 22:22:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.mips.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/1@70/0

Warnings

VT rate limit hit for: raw.intenseapi.com

Runtime Messages

Command:	/tmp/Aqua.mips.elf
PID:	6251
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.mips.elf (PID: 6251, Parent: 6172, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/Aqua.mips.elf

Aqua.mips.elf New Fork (PID: 6253, Parent: 6251)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Aqua.mips.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Aqua.mips.elf	ReversingLabs: Detection: 27%
Source: Aqua.mips.elf	Virustotal: Detection: 32%			Perma Link

Source: global traffic

TCP traffic: 192.168.2.23:40842 -> 193.200.78.37:33966

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: raw.intenseapi.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal60.evad.linELF@0/1@70/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.mips.elf (PID: 6253)

File: /tmp/Aqua.mips.elf

Jump to behavior

Source: /tmp/Aqua.mips.elf (PID: 6251)

Queries kernel information via 'uname':

Jump to behavior

Source: Aqua.mips.elf, 6251.1.00007ffdac992000.00007ffdac9b3000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.14gx3T
Source: Aqua.mips.elf, 6251.1.0000561b9117b000.0000561b91202000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: Aqua.mips.elf, 6251.1.0000561b9117b000.0000561b91202000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: Aqua.mips.elf, 6251.1.00007ffdac992000.00007ffdac9b3000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: Aqua.mips.elf, 6251.1.00007ffdac992000.00007ffdac9b3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: Aqua.mips.elf, 6251.1.00007ffdac992000.00007ffdac9b3000.rw-.sdmp	Binary or memory string: wx86_64/usr/bin/qemu-mips/tmp/Aqua.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.mips.elf
Source: Aqua.mips.elf, 6251.1.00007ffdac992000.00007ffdac9b3000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.14gx3T\
Source: Aqua.mips.elf, 6251.1.00007ffdac992000.00007ffdac9b3000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.mips.elf	27%	ReversingLabs	Linux.Trojan.Mirai
Aqua.mips.elf	32%	Virustotal		Browse
Aqua.mips.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.intenseapi.com	193.200.78.37	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.200.78.37	raw.intenseapi.com	Switzerland	29496	LINK-SERVICE-ASUA	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	ngwa5.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	ngwa5.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ngwa5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	ngwa5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	ngwa5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm4.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	wkb86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
LINK-SERVICE-ASUA	KCmfLMBjHJ.elf	Get hash	malicious	Unknown	Browse	193.200.79.115
	assailant.i586	Get hash	malicious	Mirai	Browse	194.146.110.216
	9CSfviwl3l	Get hash	malicious	Mirai	Browse	193.200.79.137
	h5OUwxH9E5	Get hash	malicious	Mirai	Browse	193.200.79.128

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.14gx3T (deleted)

Download File

Process:	/tmp/Aqua.mips.elf
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.1852301329094015
Encrypted:	false
SSDEEP:	3:TgHWCL8HJN:Tg2BJN
MD5:	5DE8DFDDC7FAB7288CAFB40F58749EFE
SHA1:	E57A6BA66AE8E362D2683846F616A6693D95A81D
SHA-256:	E8AEB1E3E141F734EC9A546B30945CF93CBCB58DBCB931216DCE3C1F467035B2
SHA-512:	37F922569AEAEEB3DF5DBB21F0C9E91C41575A5B2CCBFC188DA1562F62F6499A7699FB0BE5476D4FF43267D96983A45740FE7C931A8AE9ACE5600F5B1DFE0635
Malicious:	false
Reputation:	low
Preview:	/tmp/Aqua.mips.elf.nwlrbbmqbh

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.3870226619093255
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.mips.elf
File size:	68'704 bytes
MD5:	1bb01799f3a5c103c7343edb17b133e4
SHA1:	6f12a7bc26257cda9fd0f77cfaf8ceaced2941ff
SHA256:	c1ab2104828785c25c39af728faa7f236da146b3a4d1309d6fa3d6915b08dd51
SHA512:	ba4ca7ddced972fbf2d2997c2be69180f6ed8b9ca8e9d5a35c1399e81484042c6c66f8dbf047e4cd1e8054f4aee5c6709244c50aa254e6d338a3c0fa352c761c
SSDEEP:	768:qeXr/3SwGEbwC1DEsl0d5P6HVGt/reJLDheEol0ANCxa1M8k40nw94RyBFMPQ106:pls61Are5Dhejnk4g/ReTaewe5bvWA
TLSH:	5D63A60E6E118FEDFB68C73507F78925A398338A36A1D685D16CD7105E6028E641FFE8
File Content Preview:	.ELF.....................@.`...4...X.....4. ...(.............@...@..... ... .................E...E........, ........dt.Q............................<...'..\...!'.......................<...'..8...!... ....'9... ......................<...'......!........'9.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	68184
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0xe750	0x0	0x6	AX	16
.fini	PROGBITS	0x40e870	0xe870	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x40e8d0	0xe8d0	0x1250	0x0	0x2	A	16
.ctors	PROGBITS	0x450000	0x10000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x450008	0x10008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x450020	0x10020	0x3e0	0x0	0x3	WA	16
.got	PROGBITS	0x450400	0x10400	0x600	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x450a00	0x10a00	0x14	0x0	0x10000003	WAp	4
.bss	NOBITS	0x450a20	0x10a00	0x2200	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xbe2	0x10a00	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x10a00	0x57	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xfb20	0xfb20	5.5189	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x10000	0x450000	0x450000	0xa00	0x2c20	3.1686	0x6	RW	0x10000	.ctors .dtors .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 22:22:51.987505913 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:52.107342958 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:52.107692003 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:52.108887911 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:52.228430033 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:52.228637934 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:52.258754969 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 22:22:52.348267078 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:53.343539953 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:53.343838930 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:53.343838930 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:54.061162949 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:54.180785894 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:54.181147099 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:54.182096004 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:54.301650047 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:54.301780939 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:54.421400070 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:55.535331964 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:55.535656929 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:55.535718918 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:55.808747053 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:55.931027889 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:55.931276083 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:55.932539940 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:56.052062988 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:56.052417040 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:56.172209024 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:57.213013887 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:57.213280916 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:57.213325024 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:57.484111071 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:57.605178118 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:57.605437040 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:57.606324911 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:57.725810051 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:57.726061106 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:57.845612049 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:57.890100002 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 22:22:58.913959026 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 22:22:58.917938948 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:58.918102980 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:58.918143988 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:59.641280890 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:59.760962963 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:59.761152983 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:59.762356043 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:22:59.882075071 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 22:22:59.882469893 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:00.002173901 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:01.089190960 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:01.089359045 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:01.089554071 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:01.354264975 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:01.474814892 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:01.474925041 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:01.476152897 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:01.595659971 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:01.595839024 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:01.715476036 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:02.764964104 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:02.765288115 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:02.765288115 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:03.038194895 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:03.159219027 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:03.159553051 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:03.160968065 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:03.280606985 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:03.280827999 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:03.400604010 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:04.413079023 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:04.413281918 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:04.413330078 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:04.905390024 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:05.025101900 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:05.025307894 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:05.026501894 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:05.146883965 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:05.147011995 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:05.266578913 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:06.353569031 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:06.353916883 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:06.353916883 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:06.625601053 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:06.745487928 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:06.745711088 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:06.747162104 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:06.867110014 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:06.867471933 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:06.987076998 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:08.035151958 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:08.035496950 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:08.035496950 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:08.307292938 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:08.426907063 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:08.427144051 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:08.428311110 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:08.547774076 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:08.547894001 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:08.667685986 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:09.756100893 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:09.756454945 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:09.756570101 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:10.027592897 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:10.147079945 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:10.147264004 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:10.148094893 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:10.267585993 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:10.267883062 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:10.387430906 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:11.429105997 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:11.429331064 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:11.429430962 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:11.700129032 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:11.819642067 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:11.819766045 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:11.820754051 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:11.940341949 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:11.940690994 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:12.060441017 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:12.992073059 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 22:23:13.086740017 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:13.087145090 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:13.087174892 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:13.358453035 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:13.478003025 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:13.478324890 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:13.479486942 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:13.599052906 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:13.599395037 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:13.719173908 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:14.767232895 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:14.767632961 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:14.767633915 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:15.039253950 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:15.159137964 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:15.159364939 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:15.160505056 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:15.280108929 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:15.280368090 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:15.400000095 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:16.448009014 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:16.448242903 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:16.448311090 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:16.719861031 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:16.839607954 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:16.839818001 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:16.841058016 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:16.960619926 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:16.960891008 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:17.080585957 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:18.175153017 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:18.175770998 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:18.175885916 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:18.448049068 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:18.567861080 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:18.568197012 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:18.569583893 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:18.689372063 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:18.689671040 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:18.809531927 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:19.869929075 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:19.870126009 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:19.870168924 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:20.130317926 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:20.250483036 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:20.250631094 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:20.251282930 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:20.370826006 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:20.371012926 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:20.490674973 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:21.533113003 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:21.533370018 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:21.533407927 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:21.805315018 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:21.925123930 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:21.925299883 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:21.926485062 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:22.046561956 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:22.046864986 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:22.166476011 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:23.167984962 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:23.168181896 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:23.168287992 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:23.438816071 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:23.558355093 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:23.558563948 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:23.559499979 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:23.679011106 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:23.679204941 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:23.798742056 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:24.801598072 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:24.801873922 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:24.801923990 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:25.072762966 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:25.192405939 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:25.192574978 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:25.193870068 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:25.278259039 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 22:23:25.313303947 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:25.313446045 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:25.432982922 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:26.474510908 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:26.474862099 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:26.474942923 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:26.746397972 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:26.865977049 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:26.866117001 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:26.867276907 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:26.986788034 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:26.987014055 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:27.106821060 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:28.194200039 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:28.194417953 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:28.194513083 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:28.454020977 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:28.573590994 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:28.573749065 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:28.574944019 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:28.694525003 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:28.694654942 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:28.814171076 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:29.373781919 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 22:23:29.812284946 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:29.812576056 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:29.812720060 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:30.085347891 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:30.204930067 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:30.205110073 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:30.206553936 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:30.326051950 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:30.326262951 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:30.445880890 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:31.494427919 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:31.494759083 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:31.494837999 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:31.755219936 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:31.874839067 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:31.875050068 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:31.876066923 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:31.995774031 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:31.996169090 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:32.116058111 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:33.118184090 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:33.118496895 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:33.118582010 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:33.380347013 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:33.500185966 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:33.500483990 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:33.501208067 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:33.620898962 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:33.621323109 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:33.740967035 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:34.782948971 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:34.783148050 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:34.783227921 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:35.043303967 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:35.163203955 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:35.163491011 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:35.164416075 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:35.283938885 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:35.284087896 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:35.405538082 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:36.452549934 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:36.452704906 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:36.452735901 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:36.723309040 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:36.843108892 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:36.843445063 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:36.844284058 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:36.963830948 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:36.964149952 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:37.083820105 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:38.126130104 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:38.126311064 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:38.126380920 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:38.387263060 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:38.506932974 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:38.507209063 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:38.509322882 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:38.628885031 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:38.629084110 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:38.748729944 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:39.743221998 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:39.743485928 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:39.743485928 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:40.015791893 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:40.135535002 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:40.135878086 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:40.137135983 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:40.256726027 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:40.257009983 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:40.376570940 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:41.469860077 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:41.470160007 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:41.470256090 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:41.731615067 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:41.851413965 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:41.851699114 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:41.852971077 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:41.972592115 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:41.972795963 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:42.092366934 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:43.090831995 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:43.091059923 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:43.091099977 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:43.588177919 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:43.708053112 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:43.708239079 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:43.709160089 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:43.828659058 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:43.828938007 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:43.948770046 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:45.048960924 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:45.049354076 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:45.049386978 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:45.309253931 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:45.429096937 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:45.429313898 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:45.430517912 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:45.550329924 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:45.550627947 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:45.670295000 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:46.673137903 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:46.673351049 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:46.673450947 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:46.921484947 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:47.042743921 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:47.042948008 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:47.043989897 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:47.163566113 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:47.163805962 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:47.283490896 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:48.278331041 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:48.278645992 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:48.278794050 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:48.526958942 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:48.646629095 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:48.646879911 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:48.648116112 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:48.767581940 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:48.767668962 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:48.887126923 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:49.889369011 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:49.889547110 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:49.889631033 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:50.163085938 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:50.282629013 CET	33966	40910	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:50.282907963 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:50.284133911 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:50.403565884 CET	33966	40910	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:50.403739929 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 22:23:50.523251057 CET	33966	40910	193.200.78.37	192.168.2.23
Dec 28, 2024 22:23:53.946293116 CET	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 22:22:51.270720005 CET	55185	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:51.626197100 CET	53	55185	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:51.627650023 CET	37053	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:51.986607075 CET	53	37053	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:53.344717979 CET	43328	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:53.706641912 CET	53	43328	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:53.708236933 CET	39039	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:54.060076952 CET	53	39039	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:55.536633968 CET	50370	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:55.671143055 CET	53	50370	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:55.672451973 CET	56723	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:55.807792902 CET	53	56723	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:57.214198112 CET	37341	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:57.348131895 CET	53	37341	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:57.349298954 CET	37101	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:57.483187914 CET	53	37101	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:58.919109106 CET	35443	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:59.277945995 CET	53	35443	8.8.8.8	192.168.2.23
Dec 28, 2024 22:22:59.280019045 CET	36142	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:22:59.640480995 CET	53	36142	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:01.090496063 CET	47567	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:01.224222898 CET	53	47567	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:01.231163025 CET	35299	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:01.353521109 CET	53	35299	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:02.766675949 CET	37512	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:02.901295900 CET	53	37512	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:02.902545929 CET	51693	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:03.037391901 CET	53	51693	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:04.414289951 CET	33793	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:04.767916918 CET	53	33793	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:04.769576073 CET	59633	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:04.904438972 CET	53	59633	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:06.355417013 CET	55820	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:06.489139080 CET	53	55820	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:06.490740061 CET	49385	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:06.624679089 CET	53	49385	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:08.036609888 CET	55504	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:08.170137882 CET	53	55504	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:08.171485901 CET	42243	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:08.305350065 CET	53	42243	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:09.758033991 CET	53331	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:09.891707897 CET	53	53331	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:09.892735958 CET	45728	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:10.027003050 CET	53	45728	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:11.430368900 CET	47460	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:11.564223051 CET	53	47460	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:11.565422058 CET	51912	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:11.699024916 CET	53	51912	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:13.088409901 CET	42030	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:13.222295046 CET	53	42030	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:13.223315001 CET	57570	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:13.357702017 CET	53	57570	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:14.768630028 CET	57255	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:14.902420998 CET	53	57255	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:14.904117107 CET	34563	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:15.038109064 CET	53	34563	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:16.449582100 CET	37989	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:16.583884954 CET	53	37989	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:16.585057020 CET	48916	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:16.718893051 CET	53	48916	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:18.177192926 CET	34968	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:18.310900927 CET	53	34968	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:18.312520027 CET	36662	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:18.446708918 CET	53	36662	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:19.871337891 CET	57834	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:19.993865967 CET	53	57834	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:19.995191097 CET	33384	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:20.129725933 CET	53	33384	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:21.534372091 CET	58253	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:21.669131041 CET	53	58253	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:21.670371056 CET	36921	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:21.804358959 CET	53	36921	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:23.169384956 CET	47307	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:23.303570986 CET	53	47307	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:23.304495096 CET	33955	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:23.438369989 CET	53	33955	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:24.802911043 CET	36897	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:24.936674118 CET	53	36897	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:24.938215017 CET	52824	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:25.071924925 CET	53	52824	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:26.476006985 CET	50423	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:26.609858990 CET	53	50423	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:26.611397028 CET	57882	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:26.745338917 CET	53	57882	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:28.195694923 CET	40274	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:28.318135977 CET	53	40274	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:28.319325924 CET	49165	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:28.452945948 CET	53	49165	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:29.813806057 CET	42937	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:29.948069096 CET	53	42937	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:29.949270964 CET	36250	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:30.084420919 CET	53	36250	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:31.496203899 CET	60777	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:31.619293928 CET	53	60777	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:31.620496035 CET	51353	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:31.754441977 CET	53	51353	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:33.119743109 CET	47563	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:33.254971981 CET	53	47563	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:33.256536007 CET	45150	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:33.379323006 CET	53	45150	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:34.784670115 CET	47703	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:34.918385029 CET	53	47703	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:34.919733047 CET	34104	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:35.042198896 CET	53	34104	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:36.453600883 CET	55202	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:36.587866068 CET	53	55202	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:36.588762999 CET	48782	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:36.722788095 CET	53	48782	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:38.127791882 CET	58637	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:38.250327110 CET	53	58637	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:38.252151966 CET	55751	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:38.386176109 CET	53	55751	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:39.744680882 CET	51556	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:39.878825903 CET	53	51556	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:39.880623102 CET	46255	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:40.014611959 CET	53	46255	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:41.471978903 CET	60327	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:41.606002092 CET	53	60327	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:41.608287096 CET	52970	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:41.730611086 CET	53	52970	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:43.092259884 CET	35162	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:43.451018095 CET	53	35162	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:43.452878952 CET	60102	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:43.587263107 CET	53	60102	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:45.050695896 CET	45603	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:45.173008919 CET	53	45603	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:45.174504042 CET	44195	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:45.308322906 CET	53	44195	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:46.674540997 CET	36546	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:46.796869993 CET	53	36546	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:46.798307896 CET	46687	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:46.920753002 CET	53	46687	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:48.280103922 CET	54424	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:48.402493954 CET	53	54424	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:48.403763056 CET	52349	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:48.526185989 CET	53	52349	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:49.890902996 CET	33742	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:50.024843931 CET	53	33742	8.8.8.8	192.168.2.23
Dec 28, 2024 22:23:50.026264906 CET	38843	53	192.168.2.23	8.8.8.8
Dec 28, 2024 22:23:50.162080050 CET	53	38843	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 22:22:51.270720005 CET	192.168.2.23	8.8.8.8	0x4837	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:51.627650023 CET	192.168.2.23	8.8.8.8	0xce66	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:53.344717979 CET	192.168.2.23	8.8.8.8	0x927b	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:53.708236933 CET	192.168.2.23	8.8.8.8	0x52c8	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:55.536633968 CET	192.168.2.23	8.8.8.8	0xf1ce	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:55.672451973 CET	192.168.2.23	8.8.8.8	0xd93e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:57.214198112 CET	192.168.2.23	8.8.8.8	0x199b	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:57.349298954 CET	192.168.2.23	8.8.8.8	0xf976	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:58.919109106 CET	192.168.2.23	8.8.8.8	0x2f32	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:59.280019045 CET	192.168.2.23	8.8.8.8	0x8baf	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:01.090496063 CET	192.168.2.23	8.8.8.8	0xba77	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:01.231163025 CET	192.168.2.23	8.8.8.8	0x4578	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:02.766675949 CET	192.168.2.23	8.8.8.8	0xf299	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:02.902545929 CET	192.168.2.23	8.8.8.8	0x523a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:04.414289951 CET	192.168.2.23	8.8.8.8	0x41f3	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:04.769576073 CET	192.168.2.23	8.8.8.8	0x74a4	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:06.355417013 CET	192.168.2.23	8.8.8.8	0xed4b	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:06.490740061 CET	192.168.2.23	8.8.8.8	0xa5a9	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:08.036609888 CET	192.168.2.23	8.8.8.8	0x7b29	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:08.171485901 CET	192.168.2.23	8.8.8.8	0x6649	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:09.758033991 CET	192.168.2.23	8.8.8.8	0xbe8b	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:09.892735958 CET	192.168.2.23	8.8.8.8	0x8564	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:11.430368900 CET	192.168.2.23	8.8.8.8	0x5b24	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:11.565422058 CET	192.168.2.23	8.8.8.8	0xc0d1	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:13.088409901 CET	192.168.2.23	8.8.8.8	0x442	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:13.223315001 CET	192.168.2.23	8.8.8.8	0xc118	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:14.768630028 CET	192.168.2.23	8.8.8.8	0xbf3f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:14.904117107 CET	192.168.2.23	8.8.8.8	0xec0c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:16.449582100 CET	192.168.2.23	8.8.8.8	0xd2ac	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:16.585057020 CET	192.168.2.23	8.8.8.8	0x22cd	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:18.177192926 CET	192.168.2.23	8.8.8.8	0x9ee6	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:18.312520027 CET	192.168.2.23	8.8.8.8	0xc34c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:19.871337891 CET	192.168.2.23	8.8.8.8	0x6f3e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:19.995191097 CET	192.168.2.23	8.8.8.8	0x9a53	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:21.534372091 CET	192.168.2.23	8.8.8.8	0xce32	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:21.670371056 CET	192.168.2.23	8.8.8.8	0xd216	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:23.169384956 CET	192.168.2.23	8.8.8.8	0x86f5	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:23.304495096 CET	192.168.2.23	8.8.8.8	0x9204	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:24.802911043 CET	192.168.2.23	8.8.8.8	0x768	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:24.938215017 CET	192.168.2.23	8.8.8.8	0xa147	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:26.476006985 CET	192.168.2.23	8.8.8.8	0xde9a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:26.611397028 CET	192.168.2.23	8.8.8.8	0xff03	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:28.195694923 CET	192.168.2.23	8.8.8.8	0xaa7d	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:28.319325924 CET	192.168.2.23	8.8.8.8	0x1061	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:29.813806057 CET	192.168.2.23	8.8.8.8	0x798f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:29.949270964 CET	192.168.2.23	8.8.8.8	0x9c8c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:31.496203899 CET	192.168.2.23	8.8.8.8	0xa97e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:31.620496035 CET	192.168.2.23	8.8.8.8	0xc4ee	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:33.119743109 CET	192.168.2.23	8.8.8.8	0xe1c8	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:33.256536007 CET	192.168.2.23	8.8.8.8	0x9c8d	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:34.784670115 CET	192.168.2.23	8.8.8.8	0x72ba	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:34.919733047 CET	192.168.2.23	8.8.8.8	0x9336	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:36.453600883 CET	192.168.2.23	8.8.8.8	0x96bf	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:36.588762999 CET	192.168.2.23	8.8.8.8	0x5534	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:38.127791882 CET	192.168.2.23	8.8.8.8	0xd580	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:38.252151966 CET	192.168.2.23	8.8.8.8	0x1bd9	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:39.744680882 CET	192.168.2.23	8.8.8.8	0xbf29	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:39.880623102 CET	192.168.2.23	8.8.8.8	0xd177	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:41.471978903 CET	192.168.2.23	8.8.8.8	0xbc69	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:41.608287096 CET	192.168.2.23	8.8.8.8	0xc0e9	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:43.092259884 CET	192.168.2.23	8.8.8.8	0xc9eb	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:43.452878952 CET	192.168.2.23	8.8.8.8	0x12c1	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:45.050695896 CET	192.168.2.23	8.8.8.8	0xaf0b	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:45.174504042 CET	192.168.2.23	8.8.8.8	0xdc6	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:46.674540997 CET	192.168.2.23	8.8.8.8	0x8b9c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:46.798307896 CET	192.168.2.23	8.8.8.8	0x5655	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:48.280103922 CET	192.168.2.23	8.8.8.8	0x4e92	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:48.403763056 CET	192.168.2.23	8.8.8.8	0xb0b9	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:49.890902996 CET	192.168.2.23	8.8.8.8	0xe90c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:50.026264906 CET	192.168.2.23	8.8.8.8	0xc6d	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 22:22:51.626197100 CET	8.8.8.8	192.168.2.23	0x4837	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:51.986607075 CET	8.8.8.8	192.168.2.23	0xce66	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:53.706641912 CET	8.8.8.8	192.168.2.23	0x927b	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:54.060076952 CET	8.8.8.8	192.168.2.23	0x52c8	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:55.671143055 CET	8.8.8.8	192.168.2.23	0xf1ce	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:55.807792902 CET	8.8.8.8	192.168.2.23	0xd93e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:57.348131895 CET	8.8.8.8	192.168.2.23	0x199b	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:57.483187914 CET	8.8.8.8	192.168.2.23	0xf976	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:59.277945995 CET	8.8.8.8	192.168.2.23	0x2f32	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:22:59.640480995 CET	8.8.8.8	192.168.2.23	0x8baf	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:01.224222898 CET	8.8.8.8	192.168.2.23	0xba77	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:01.353521109 CET	8.8.8.8	192.168.2.23	0x4578	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:02.901295900 CET	8.8.8.8	192.168.2.23	0xf299	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:03.037391901 CET	8.8.8.8	192.168.2.23	0x523a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:04.767916918 CET	8.8.8.8	192.168.2.23	0x41f3	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:04.904438972 CET	8.8.8.8	192.168.2.23	0x74a4	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:06.489139080 CET	8.8.8.8	192.168.2.23	0xed4b	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:06.624679089 CET	8.8.8.8	192.168.2.23	0xa5a9	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:08.170137882 CET	8.8.8.8	192.168.2.23	0x7b29	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:08.305350065 CET	8.8.8.8	192.168.2.23	0x6649	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:09.891707897 CET	8.8.8.8	192.168.2.23	0xbe8b	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:10.027003050 CET	8.8.8.8	192.168.2.23	0x8564	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:11.564223051 CET	8.8.8.8	192.168.2.23	0x5b24	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:11.699024916 CET	8.8.8.8	192.168.2.23	0xc0d1	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:13.222295046 CET	8.8.8.8	192.168.2.23	0x442	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:13.357702017 CET	8.8.8.8	192.168.2.23	0xc118	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:14.902420998 CET	8.8.8.8	192.168.2.23	0xbf3f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:15.038109064 CET	8.8.8.8	192.168.2.23	0xec0c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:16.583884954 CET	8.8.8.8	192.168.2.23	0xd2ac	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:16.718893051 CET	8.8.8.8	192.168.2.23	0x22cd	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:18.310900927 CET	8.8.8.8	192.168.2.23	0x9ee6	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:18.446708918 CET	8.8.8.8	192.168.2.23	0xc34c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:19.993865967 CET	8.8.8.8	192.168.2.23	0x6f3e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:20.129725933 CET	8.8.8.8	192.168.2.23	0x9a53	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:21.669131041 CET	8.8.8.8	192.168.2.23	0xce32	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:21.804358959 CET	8.8.8.8	192.168.2.23	0xd216	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:23.303570986 CET	8.8.8.8	192.168.2.23	0x86f5	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:23.438369989 CET	8.8.8.8	192.168.2.23	0x9204	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:24.936674118 CET	8.8.8.8	192.168.2.23	0x768	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:25.071924925 CET	8.8.8.8	192.168.2.23	0xa147	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:26.609858990 CET	8.8.8.8	192.168.2.23	0xde9a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:26.745338917 CET	8.8.8.8	192.168.2.23	0xff03	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:28.318135977 CET	8.8.8.8	192.168.2.23	0xaa7d	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:28.452945948 CET	8.8.8.8	192.168.2.23	0x1061	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:29.948069096 CET	8.8.8.8	192.168.2.23	0x798f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:30.084420919 CET	8.8.8.8	192.168.2.23	0x9c8c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:31.619293928 CET	8.8.8.8	192.168.2.23	0xa97e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:31.754441977 CET	8.8.8.8	192.168.2.23	0xc4ee	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:33.254971981 CET	8.8.8.8	192.168.2.23	0xe1c8	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:33.379323006 CET	8.8.8.8	192.168.2.23	0x9c8d	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:34.918385029 CET	8.8.8.8	192.168.2.23	0x72ba	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:35.042198896 CET	8.8.8.8	192.168.2.23	0x9336	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:36.587866068 CET	8.8.8.8	192.168.2.23	0x96bf	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:36.722788095 CET	8.8.8.8	192.168.2.23	0x5534	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:38.250327110 CET	8.8.8.8	192.168.2.23	0xd580	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:38.386176109 CET	8.8.8.8	192.168.2.23	0x1bd9	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:39.878825903 CET	8.8.8.8	192.168.2.23	0xbf29	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:40.014611959 CET	8.8.8.8	192.168.2.23	0xd177	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:41.606002092 CET	8.8.8.8	192.168.2.23	0xbc69	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:41.730611086 CET	8.8.8.8	192.168.2.23	0xc0e9	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:43.451018095 CET	8.8.8.8	192.168.2.23	0xc9eb	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:43.587263107 CET	8.8.8.8	192.168.2.23	0x12c1	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:45.173008919 CET	8.8.8.8	192.168.2.23	0xaf0b	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:45.308322906 CET	8.8.8.8	192.168.2.23	0xdc6	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:46.796869993 CET	8.8.8.8	192.168.2.23	0x8b9c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:46.920753002 CET	8.8.8.8	192.168.2.23	0x5655	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:48.402493954 CET	8.8.8.8	192.168.2.23	0x4e92	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:48.526185989 CET	8.8.8.8	192.168.2.23	0xb0b9	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:50.024843931 CET	8.8.8.8	192.168.2.23	0xe90c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:23:50.162080050 CET	8.8.8.8	192.168.2.23	0xc6d	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Aqua.mips.elf PID: 6251, Parent PID: 6172

General

Start time (UTC):	21:22:50
Start date (UTC):	28/12/2024
Path:	/tmp/Aqua.mips.elf
Arguments:	/tmp/Aqua.mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: Aqua.mips.elf PID: 6253, Parent PID: 6251

General

Start time (UTC):	21:22:50
Start date (UTC):	28/12/2024
Path:	/tmp/Aqua.mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.14gx3T (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Aqua.mips.elf PID: 6251, Parent PID: 6172

General

Chronological Activities

Analysis Process: Aqua.mips.elf PID: 6253, Parent PID: 6251

General

Chronological Activities

Linux Analysis Report
Aqua.mips.elf