Edit tour

Linux Analysis Report
Aqua.x86_64.elf

Overview

General Information

Sample name:	Aqua.x86_64.elf
Analysis ID:	1581763
MD5:	c4e72ea9a7d6723b1d02ad0cb4f978a0
SHA1:	2b31bed25b0919972ded12997f1d49b9417ebe8a
SHA256:	12dc831553d0bd9f6f7b8eafba8bdd8f58fa6cf2b91cfbfcca41913766aa8403
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581763
Start date and time:	2024-12-28 23:07:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.x86_64.elf
Detection:	MAL
Classification:	mal72.evad.linELF@0/0@96/0

Warnings

VT rate limit hit for: Aqua.x86_64.elf

Runtime Messages

Command:	/tmp/Aqua.x86_64.elf
PID:	6238
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.x86_64.elf (PID: 6238, Parent: 6162, MD5: c4e72ea9a7d6723b1d02ad0cb4f978a0) Arguments: /tmp/Aqua.x86_64.elf

Aqua.x86_64.elf New Fork (PID: 6239, Parent: 6238)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7c3c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x842b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x61de:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x9c84:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xa8fe:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x7feb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x82b6:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
Aqua.x86_64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
Aqua.x86_64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
Aqua.x86_64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4592:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7c3c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x842b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x61de:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x9c84:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xa8fe:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x7feb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x82b6:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6238.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4592:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 4 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Aqua.x86_64.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Aqua.x86_64.elf

ReversingLabs: Detection: 40%

Machine Learning detection for sample

Source: Aqua.x86_64.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.23:40832 -> 193.200.78.37:33966

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: raw.intenseapi.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.evad.linELF@0/0@96/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.x86_64.elf (PID: 6239)

File: /tmp/Aqua.x86_64.elf

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Aqua.x86_64.elf	41%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.x86_64.elf	100%	Avira	EXP/ELF.Mirai.W
Aqua.x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.intenseapi.com	193.200.78.37	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.200.78.37	raw.intenseapi.com	Switzerland	29496	LINK-SERVICE-ASUA	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.200.78.37	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	kqibeps.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
91.189.91.42	kqibeps.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.intenseapi.com	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.200.78.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	kqibeps.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ngwa5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
CANONICAL-ASGB	kqibeps.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ngwa5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
INIT7CH	kqibeps.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ngwa5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	109.71.252.43-boatnet.arm6-2024-12-28T20_30_37.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
LINK-SERVICE-ASUA	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	KCmfLMBjHJ.elf	Get hash	malicious	Unknown	Browse	193.200.79.115
	assailant.i586	Get hash	malicious	Mirai	Browse	194.146.110.216
	9CSfviwl3l	Get hash	malicious	Mirai	Browse	193.200.79.137
	h5OUwxH9E5	Get hash	malicious	Mirai	Browse	193.200.79.128

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.002150216956977
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.x86_64.elf
File size:	55'168 bytes
MD5:	c4e72ea9a7d6723b1d02ad0cb4f978a0
SHA1:	2b31bed25b0919972ded12997f1d49b9417ebe8a
SHA256:	12dc831553d0bd9f6f7b8eafba8bdd8f58fa6cf2b91cfbfcca41913766aa8403
SHA512:	7ba90083f435e65d597d77de4764dcdc9208f316a64ba4eb6b6b2230848e9aeb5ac8ee55dc6ef2733fe3c7f2d6cc19c14a574e2498f8e63588e57157fe17326b
SSDEEP:	1536:KxKtFALhI11z7vFQu3l+6wGA6zvLAL6vopRzfcMr+Ri04f:XtI211neY+6rA6zy6MRzl+Ri04f
TLSH:	E643391BF68180FCC29AC274573AA23AE57771BE0239B2F573D4FA176D86E614E2C405
File Content Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@.....p.......p.................................P.......P.............h...............Q.td....................................................H...._....Z...H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	54528
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0xac86	0x0	0x6	AX	16
.fini	PROGBITS	0x40ad86	0xad86	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x40ada0	0xada0	0x16d0	0x0	0x2	A	32
.ctors	PROGBITS	0x50d000	0xd000	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x50d010	0xd010	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x50d040	0xd040	0x480	0x0	0x3	WA	32
.bss	NOBITS	0x50d4c0	0xd4c0	0x29a8	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xd4c0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xc470	0xc470	6.3075	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0xd000	0x50d000	0x50d000	0x4c0	0x2e68	2.6376	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 23:07:55.421998978 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 23:07:55.614685059 CET	40832	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:55.734235048 CET	33966	40832	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:55.734424114 CET	40832	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:55.735032082 CET	40832	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:55.854532003 CET	33966	40832	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:55.854782104 CET	40832	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:55.974370956 CET	33966	40832	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:56.981414080 CET	33966	40832	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:56.981470108 CET	40832	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:56.981489897 CET	40832	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:57.725012064 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:57.844424009 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:57.844626904 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:57.845175982 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:57.964720964 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:57.964869022 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:58.084573984 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:59.127688885 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:59.127881050 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:59.127881050 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:59.622869015 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:59.742685080 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:59.742986917 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:59.743551016 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:59.863204956 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 28, 2024 23:07:59.863470078 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:07:59.983074903 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:00.797173977 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 23:08:01.062206984 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:01.062644958 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:01.062644958 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:01.807863951 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:01.927356958 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:01.927556038 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:01.928188086 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:02.047748089 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:02.048067093 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:02.077076912 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 23:08:02.167567015 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:03.263518095 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:03.263803005 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:03.263803005 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:03.535289049 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:03.655008078 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:03.655189991 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:03.655791998 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:03.775255919 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:03.775439024 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:03.895220995 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:04.937184095 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:04.937501907 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:04.937617064 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:05.208843946 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:05.328596115 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:05.328810930 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:05.331928015 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:05.451369047 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:05.451638937 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:05.571403980 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:06.610234022 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:06.610682964 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:06.610682964 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:06.883182049 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:07.002726078 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:07.002985001 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:07.004247904 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:07.123852968 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:07.124169111 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:07.243721008 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:08.292962074 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:08.293196917 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:08.293430090 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:08.565041065 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:08.684629917 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:08.684885979 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:08.686245918 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:08.805762053 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:08.806024075 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:08.925692081 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:10.019680023 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:10.019963980 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:10.019963980 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:10.291549921 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:10.411230087 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:10.411453962 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:10.412692070 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:10.532401085 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:10.532608986 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:10.652441978 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:11.700587034 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:11.701067924 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:11.701067924 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:12.202429056 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:12.321980953 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:12.322284937 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:12.323523998 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:12.443135023 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:12.443461895 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:12.563275099 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:13.559108973 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:13.559521914 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:13.559627056 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:13.818681002 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:13.938277006 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:13.938472986 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:13.939666033 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:14.059125900 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:14.059490919 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:14.179120064 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:15.227304935 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:15.227585077 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:15.231806993 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:15.502876043 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:15.622466087 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:15.622687101 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:15.623899937 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:15.743426085 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:15.743638992 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:15.863228083 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:16.858139992 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:16.858568907 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:16.858568907 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:16.922853947 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 23:08:17.131108999 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:17.250792980 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:17.251044035 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:17.252073050 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:17.371592999 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:17.371772051 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:17.491410971 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:18.532761097 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:18.532949924 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:18.533113956 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:18.792701006 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:18.912568092 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:18.912714958 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:18.913786888 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:19.033268929 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:19.033370018 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:19.153157949 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:20.203468084 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:20.203655005 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:20.203723907 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:20.474591017 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:20.594136953 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:20.594430923 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:20.595362902 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:20.715085983 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:20.715333939 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:20.835027933 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:21.885806084 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:21.885988951 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:21.886104107 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:22.157701969 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:22.277559996 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:22.277931929 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:22.278822899 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:22.398516893 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:22.398837090 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:22.518517971 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:23.567279100 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:23.567578077 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:23.567578077 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:23.838504076 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:23.958097935 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:23.958250046 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:23.959187031 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:24.078898907 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:24.079190016 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:24.199129105 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:25.241139889 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:25.241483927 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:25.241483927 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:25.511790991 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:25.631293058 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:25.631558895 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:25.632497072 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:25.752185106 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:25.752434969 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:25.871886015 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:26.959439039 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:26.959686041 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:26.959686995 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:27.161355019 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 23:08:27.219650984 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:27.339272976 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:27.339437962 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:27.340166092 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:27.459769964 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:27.460006952 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:27.579561949 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:28.629285097 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:28.629612923 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:28.629612923 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:28.877826929 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:28.997390032 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:28.997684002 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:28.998653889 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:29.118161917 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:29.118455887 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:29.238050938 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:30.280512094 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:30.280795097 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:30.280934095 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:30.551805973 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:30.671554089 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:30.671861887 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:30.672962904 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:30.792537928 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:30.792788029 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:30.912343025 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:31.960223913 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:31.960428953 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:31.960428953 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:32.231771946 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:32.351320028 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:32.351401091 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:32.352574110 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:32.472029924 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:32.472193003 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:32.591747046 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:33.304538012 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 23:08:33.633052111 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:33.633310080 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:33.633310080 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:33.905276060 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:34.024812937 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:34.025000095 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:34.025748968 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:34.145518064 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:34.145591021 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:34.265501022 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:35.318057060 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:35.318242073 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:35.318242073 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:35.590037107 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:35.709557056 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:35.709614992 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:35.710510969 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:35.829999924 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:35.830207109 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:35.950221062 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:36.952569008 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:36.952744007 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:36.952774048 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:37.224652052 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:37.344331026 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:37.344491959 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:37.345886946 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:37.465414047 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:37.465624094 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:37.585227013 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:38.580147028 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:38.580358028 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:38.580358028 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:38.840526104 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:38.960062981 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:38.960131884 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:38.960952044 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:39.080615044 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:39.080925941 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:39.201446056 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:40.250195026 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:40.250442982 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:40.250442982 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:40.498608112 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:40.618117094 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:40.618377924 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:40.619755983 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:40.739284039 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:40.739409924 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:40.858882904 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:41.901207924 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:41.901482105 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:41.901483059 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:42.150341034 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:42.269866943 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:42.270108938 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:42.271332026 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:42.390780926 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:42.390867949 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:42.510381937 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:43.568783998 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:43.569056034 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:43.569056034 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:43.829891920 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:43.949403048 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:43.949594975 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:43.950956106 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:44.070694923 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:44.070995092 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:44.190673113 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:45.333261967 CET	33966	40888	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:45.333482981 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:45.333509922 CET	40888	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:45.592796087 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:45.712332010 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:45.712641001 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:45.713660002 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:45.833142042 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:45.833277941 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:45.952797890 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:47.057104111 CET	33966	40890	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:47.057363033 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:47.057382107 CET	40890	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:47.328005075 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:47.447738886 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:47.447998047 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:47.449254036 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:47.568744898 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:47.569020987 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:47.688739061 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:48.730739117 CET	33966	40892	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:48.731221914 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:48.731221914 CET	40892	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:49.002226114 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:49.122030020 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:49.122279882 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:49.123636961 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:49.243118048 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:49.243227005 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:49.362744093 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:50.372102022 CET	33966	40894	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:50.372313976 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:50.372313976 CET	40894	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:50.632268906 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:50.751843929 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:50.752114058 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:50.753268003 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:50.872701883 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:50.872987032 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:50.992676020 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:52.095911026 CET	33966	40896	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:52.096378088 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:52.096504927 CET	40896	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:52.368160963 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:52.487768888 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:52.488116026 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:52.489135027 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:52.608690977 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:52.608977079 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:52.728744030 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:53.816390991 CET	33966	40898	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:53.816580057 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:53.816720963 CET	40898	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:54.076354980 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:54.196152925 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:54.196311951 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:54.197338104 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:54.316922903 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:54.317095995 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:54.436625004 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:55.532747984 CET	33966	40900	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:55.532872915 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:55.532872915 CET	40900	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:55.804188967 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:55.923724890 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:55.923983097 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:55.925054073 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:56.044631004 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:56.044917107 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:56.164644003 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:57.206413031 CET	33966	40902	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:57.206752062 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:57.206752062 CET	40902	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:57.466083050 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:57.586652040 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:57.586915970 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:57.588177919 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:57.707683086 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:57.707797050 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:57.827418089 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:57.876934052 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 23:08:58.915137053 CET	33966	40904	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:58.915251970 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:58.915251970 CET	40904	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:59.174803972 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:59.294440985 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:59.294646978 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:59.295479059 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:59.414985895 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 23:08:59.415103912 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:08:59.534631968 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:00.585416079 CET	33966	40906	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:00.585565090 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:00.585565090 CET	40906	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:00.845068932 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:00.964620113 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:00.964713097 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:00.965903997 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:01.085444927 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:01.085551977 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:01.205358028 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:02.255036116 CET	33966	40908	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:02.255168915 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:02.255168915 CET	40908	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:02.526299953 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:02.645809889 CET	33966	40910	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:02.645905018 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:02.646852016 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:02.766287088 CET	33966	40910	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:02.766350031 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:02.886004925 CET	33966	40910	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:03.881622076 CET	33966	40910	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:03.881738901 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:03.881738901 CET	40910	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:04.140698910 CET	40912	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:04.260195017 CET	33966	40912	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:04.260318041 CET	40912	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:04.261301994 CET	40912	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:04.380744934 CET	33966	40912	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:04.380980968 CET	40912	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:04.500541925 CET	33966	40912	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:05.595583916 CET	33966	40912	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:05.595732927 CET	40912	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:05.595900059 CET	40912	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:05.868165970 CET	40914	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:05.988136053 CET	33966	40914	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:05.988308907 CET	40914	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:05.989717007 CET	40914	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:06.109365940 CET	33966	40914	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:06.109630108 CET	40914	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:06.229182959 CET	33966	40914	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:07.344979048 CET	33966	40914	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:07.345149994 CET	40914	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:07.345191002 CET	40914	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:07.604823112 CET	40916	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:07.724436998 CET	33966	40916	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:07.724585056 CET	40916	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:07.725920916 CET	40916	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:07.845462084 CET	33966	40916	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:07.845691919 CET	40916	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:07.965292931 CET	33966	40916	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:09.036326885 CET	33966	40916	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:09.036561012 CET	40916	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:09.036561012 CET	40916	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:09.307703972 CET	40918	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:09.427284956 CET	33966	40918	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:09.427546024 CET	40918	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:09.428934097 CET	40918	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:09.548381090 CET	33966	40918	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:09.548558950 CET	40918	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:09.668085098 CET	33966	40918	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:10.766088009 CET	33966	40918	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:10.766372919 CET	40918	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:10.766482115 CET	40918	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:11.026065111 CET	40920	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:11.145792007 CET	33966	40920	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:11.146054029 CET	40920	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:11.147190094 CET	40920	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:11.267551899 CET	33966	40920	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:11.267836094 CET	40920	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:11.387511969 CET	33966	40920	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:12.438905001 CET	33966	40920	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:12.439075947 CET	40920	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:12.439130068 CET	40920	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:12.710396051 CET	40922	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:12.830157042 CET	33966	40922	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:12.830249071 CET	40922	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:12.830862999 CET	40922	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:12.950459003 CET	33966	40922	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:12.950535059 CET	40922	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:13.070090055 CET	33966	40922	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:14.073546886 CET	33966	40922	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:14.073729992 CET	40922	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:14.073729992 CET	40922	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:14.343338966 CET	40924	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:14.462991953 CET	33966	40924	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:14.463078976 CET	40924	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:14.464070082 CET	40924	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:14.583497047 CET	33966	40924	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:14.583579063 CET	40924	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:14.703126907 CET	33966	40924	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:15.791815996 CET	33966	40924	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:15.791950941 CET	40924	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:15.791985035 CET	40924	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:16.062303066 CET	40926	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:16.182101011 CET	33966	40926	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:16.182341099 CET	40926	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:16.183527946 CET	40926	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:16.303559065 CET	33966	40926	193.200.78.37	192.168.2.23
Dec 28, 2024 23:09:16.303725004 CET	40926	33966	192.168.2.23	193.200.78.37
Dec 28, 2024 23:09:16.423290014 CET	33966	40926	193.200.78.37	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 23:07:54.890755892 CET	51854	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:07:55.255306959 CET	53	51854	8.8.8.8	192.168.2.23
Dec 28, 2024 23:07:55.256407976 CET	47585	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:07:55.613950014 CET	53	47585	8.8.8.8	192.168.2.23
Dec 28, 2024 23:07:56.982111931 CET	51287	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:07:57.364352942 CET	53	51287	8.8.8.8	192.168.2.23
Dec 28, 2024 23:07:57.365292072 CET	49252	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:07:57.724554062 CET	53	49252	8.8.8.8	192.168.2.23
Dec 28, 2024 23:07:59.128453016 CET	38603	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:07:59.262128115 CET	53	38603	8.8.8.8	192.168.2.23
Dec 28, 2024 23:07:59.262912035 CET	41293	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:07:59.622422934 CET	53	41293	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:01.063321114 CET	50646	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:01.424092054 CET	53	50646	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:01.425107002 CET	46625	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:01.807111979 CET	53	46625	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:03.264465094 CET	57720	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:03.400150061 CET	53	57720	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:03.400966883 CET	47211	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:03.534756899 CET	53	47211	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:04.938716888 CET	48690	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:05.072313070 CET	53	48690	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:05.073847055 CET	56667	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:05.207973957 CET	53	56667	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:06.611802101 CET	57668	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:06.746784925 CET	53	57668	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:06.748298883 CET	49210	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:06.882164001 CET	53	49210	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:08.294585943 CET	37229	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:08.428430080 CET	53	37229	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:08.430088997 CET	54218	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:08.563853979 CET	53	54218	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:10.020757914 CET	34860	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:10.154488087 CET	53	34860	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:10.155965090 CET	35830	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:10.290364027 CET	53	35830	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:11.702203035 CET	47916	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:12.066346884 CET	53	47916	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:12.067563057 CET	58389	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:12.201652050 CET	53	58389	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:13.560538054 CET	41120	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:13.694622993 CET	53	41120	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:13.695612907 CET	59979	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:13.818039894 CET	53	59979	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:15.233094931 CET	58222	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:15.366787910 CET	53	58222	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:15.368125916 CET	47244	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:15.501729965 CET	53	47244	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:16.859754086 CET	35029	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:16.994256973 CET	53	35029	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:16.995524883 CET	52963	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:17.130170107 CET	53	52963	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:18.534179926 CET	49469	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:18.656619072 CET	53	49469	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:18.657860041 CET	57613	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:18.791863918 CET	53	57613	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:20.204813004 CET	51766	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:20.338715076 CET	53	51766	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:20.339981079 CET	52931	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:20.473885059 CET	53	52931	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:21.887168884 CET	53597	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:22.021678925 CET	53	53597	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:22.022769928 CET	42673	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:22.156781912 CET	53	42673	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:23.568825960 CET	35976	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:23.702377081 CET	53	35976	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:23.703646898 CET	59370	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:23.837471008 CET	53	59370	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:25.242558002 CET	43904	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:25.375933886 CET	53	43904	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:25.377264023 CET	35604	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:25.510970116 CET	53	35604	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:26.960777044 CET	40871	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:27.083431959 CET	53	40871	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:27.084929943 CET	47722	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:27.218934059 CET	53	47722	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:28.630633116 CET	54717	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:28.752923012 CET	53	54717	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:28.754359961 CET	55607	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:28.876899958 CET	53	55607	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:30.282015085 CET	56080	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:30.415810108 CET	53	56080	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:30.417098999 CET	59463	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:30.550923109 CET	53	59463	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:31.961400986 CET	45473	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:32.095057964 CET	53	45473	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:32.096488953 CET	56492	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:32.231010914 CET	53	56492	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:33.634314060 CET	37836	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:33.768107891 CET	53	37836	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:33.769396067 CET	49247	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:33.904675961 CET	53	49247	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:35.319062948 CET	50994	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:35.453082085 CET	53	50994	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:35.454020977 CET	58627	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:35.589512110 CET	53	58627	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:36.954077959 CET	49053	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:37.087913990 CET	53	49053	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:37.089723110 CET	38977	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:37.223901987 CET	53	38977	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:38.581149101 CET	57964	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:38.716690063 CET	53	57964	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:38.717614889 CET	40503	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:38.839979887 CET	53	40503	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:40.251648903 CET	52346	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:40.373924017 CET	53	52346	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:40.375243902 CET	49867	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:40.497601986 CET	53	49867	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:41.902550936 CET	39849	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:42.024950981 CET	53	39849	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:42.026568890 CET	38142	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:42.149336100 CET	53	38142	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:43.570075035 CET	58437	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:43.692408085 CET	53	58437	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:43.693531990 CET	53788	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:43.828883886 CET	53	53788	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:45.334331036 CET	41807	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:45.468024969 CET	53	41807	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:45.469315052 CET	60470	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:45.591994047 CET	53	60470	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:47.058228016 CET	37030	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:47.191937923 CET	53	37030	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:47.192955017 CET	38820	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:47.326733112 CET	53	38820	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:48.732161999 CET	38592	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:48.865835905 CET	53	38592	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:48.867264032 CET	56487	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:49.001511097 CET	53	56487	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:50.373435020 CET	43041	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:50.507602930 CET	53	43041	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:50.509031057 CET	42065	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:50.631484985 CET	53	42065	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:52.097790003 CET	47368	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:52.232048035 CET	53	47368	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:52.233400106 CET	39492	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:52.367055893 CET	53	39492	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:53.817873001 CET	55911	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:53.940458059 CET	53	55911	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:53.941857100 CET	48468	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:54.075531006 CET	53	48468	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:55.533674955 CET	48289	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:55.668095112 CET	53	48289	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:55.669225931 CET	43041	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:55.803384066 CET	53	43041	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:57.207789898 CET	52766	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:57.330017090 CET	53	52766	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:57.331330061 CET	56638	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:57.465250015 CET	53	56638	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:58.916484118 CET	58678	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:59.050214052 CET	53	58678	8.8.8.8	192.168.2.23
Dec 28, 2024 23:08:59.051500082 CET	32800	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:08:59.173969030 CET	53	32800	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:00.586700916 CET	58062	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:00.720514059 CET	53	58062	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:00.721780062 CET	42639	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:00.844132900 CET	53	42639	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:02.256499052 CET	49700	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:02.390201092 CET	53	49700	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:02.391473055 CET	42696	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:02.525563002 CET	53	42696	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:03.882958889 CET	44878	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:04.005218029 CET	53	44878	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:04.006041050 CET	49888	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:04.139923096 CET	53	49888	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:05.597033978 CET	45343	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:05.731512070 CET	53	45343	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:05.732881069 CET	41941	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:05.867202044 CET	53	41941	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:07.346349001 CET	38178	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:07.480318069 CET	53	38178	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:07.481693029 CET	51746	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:07.604249001 CET	53	51746	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:09.037379980 CET	39588	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:09.171605110 CET	53	39588	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:09.172889948 CET	55605	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:09.306593895 CET	53	55605	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:10.767693996 CET	50935	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:10.890037060 CET	53	50935	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:10.891649961 CET	46408	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:11.025368929 CET	53	46408	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:12.440249920 CET	58695	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:12.574661970 CET	53	58695	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:12.575722933 CET	58561	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:12.709580898 CET	53	58561	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:14.074620008 CET	55781	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:14.208304882 CET	53	55781	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:14.209196091 CET	34157	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:14.342782021 CET	53	34157	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:15.792800903 CET	50633	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:15.926604986 CET	53	50633	8.8.8.8	192.168.2.23
Dec 28, 2024 23:09:15.927756071 CET	33677	53	192.168.2.23	8.8.8.8
Dec 28, 2024 23:09:16.061605930 CET	53	33677	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 23:07:54.890755892 CET	192.168.2.23	8.8.8.8	0x6d5f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:55.256407976 CET	192.168.2.23	8.8.8.8	0x8afd	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:56.982111931 CET	192.168.2.23	8.8.8.8	0x58ae	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:57.365292072 CET	192.168.2.23	8.8.8.8	0xd66f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:59.128453016 CET	192.168.2.23	8.8.8.8	0x5f31	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:59.262912035 CET	192.168.2.23	8.8.8.8	0xd293	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:01.063321114 CET	192.168.2.23	8.8.8.8	0x6aca	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:01.425107002 CET	192.168.2.23	8.8.8.8	0x2ff0	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:03.264465094 CET	192.168.2.23	8.8.8.8	0x3b40	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:03.400966883 CET	192.168.2.23	8.8.8.8	0x83fa	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:04.938716888 CET	192.168.2.23	8.8.8.8	0xe2ee	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:05.073847055 CET	192.168.2.23	8.8.8.8	0xbd70	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:06.611802101 CET	192.168.2.23	8.8.8.8	0x6ae6	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:06.748298883 CET	192.168.2.23	8.8.8.8	0xe19f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:08.294585943 CET	192.168.2.23	8.8.8.8	0x5db7	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:08.430088997 CET	192.168.2.23	8.8.8.8	0xe223	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:10.020757914 CET	192.168.2.23	8.8.8.8	0x67c2	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:10.155965090 CET	192.168.2.23	8.8.8.8	0x4598	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:11.702203035 CET	192.168.2.23	8.8.8.8	0xd629	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:12.067563057 CET	192.168.2.23	8.8.8.8	0x1abc	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:13.560538054 CET	192.168.2.23	8.8.8.8	0xa2e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:13.695612907 CET	192.168.2.23	8.8.8.8	0xff08	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:15.233094931 CET	192.168.2.23	8.8.8.8	0xc929	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:15.368125916 CET	192.168.2.23	8.8.8.8	0x1c8c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:16.859754086 CET	192.168.2.23	8.8.8.8	0xb97a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:16.995524883 CET	192.168.2.23	8.8.8.8	0x71ef	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:18.534179926 CET	192.168.2.23	8.8.8.8	0x5547	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:18.657860041 CET	192.168.2.23	8.8.8.8	0xa6d2	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:20.204813004 CET	192.168.2.23	8.8.8.8	0xb2b2	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:20.339981079 CET	192.168.2.23	8.8.8.8	0x244a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:21.887168884 CET	192.168.2.23	8.8.8.8	0xf8b	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:22.022769928 CET	192.168.2.23	8.8.8.8	0x977e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:23.568825960 CET	192.168.2.23	8.8.8.8	0xb911	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:23.703646898 CET	192.168.2.23	8.8.8.8	0x9d1d	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:25.242558002 CET	192.168.2.23	8.8.8.8	0x58d4	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:25.377264023 CET	192.168.2.23	8.8.8.8	0x5cbb	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:26.960777044 CET	192.168.2.23	8.8.8.8	0x1fd3	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:27.084929943 CET	192.168.2.23	8.8.8.8	0x4f77	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:28.630633116 CET	192.168.2.23	8.8.8.8	0x4b9d	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:28.754359961 CET	192.168.2.23	8.8.8.8	0x7014	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:30.282015085 CET	192.168.2.23	8.8.8.8	0xf39e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:30.417098999 CET	192.168.2.23	8.8.8.8	0x98ac	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:31.961400986 CET	192.168.2.23	8.8.8.8	0x1511	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:32.096488953 CET	192.168.2.23	8.8.8.8	0x3919	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:33.634314060 CET	192.168.2.23	8.8.8.8	0xefed	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:33.769396067 CET	192.168.2.23	8.8.8.8	0xc11a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:35.319062948 CET	192.168.2.23	8.8.8.8	0xcdb	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:35.454020977 CET	192.168.2.23	8.8.8.8	0x86d7	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:36.954077959 CET	192.168.2.23	8.8.8.8	0x37db	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:37.089723110 CET	192.168.2.23	8.8.8.8	0x549a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:38.581149101 CET	192.168.2.23	8.8.8.8	0x4b82	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:38.717614889 CET	192.168.2.23	8.8.8.8	0x5385	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:40.251648903 CET	192.168.2.23	8.8.8.8	0x4e46	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:40.375243902 CET	192.168.2.23	8.8.8.8	0x1260	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:41.902550936 CET	192.168.2.23	8.8.8.8	0xc981	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:42.026568890 CET	192.168.2.23	8.8.8.8	0x7d5	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:43.570075035 CET	192.168.2.23	8.8.8.8	0xfbf6	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:43.693531990 CET	192.168.2.23	8.8.8.8	0x3e24	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:45.334331036 CET	192.168.2.23	8.8.8.8	0x3a96	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:45.469315052 CET	192.168.2.23	8.8.8.8	0xca70	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:47.058228016 CET	192.168.2.23	8.8.8.8	0x5a10	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:47.192955017 CET	192.168.2.23	8.8.8.8	0x6baf	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:48.732161999 CET	192.168.2.23	8.8.8.8	0x90c7	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:48.867264032 CET	192.168.2.23	8.8.8.8	0x9b84	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:50.373435020 CET	192.168.2.23	8.8.8.8	0x6138	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:50.509031057 CET	192.168.2.23	8.8.8.8	0x9d81	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:52.097790003 CET	192.168.2.23	8.8.8.8	0x5638	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:52.233400106 CET	192.168.2.23	8.8.8.8	0xa19c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:53.817873001 CET	192.168.2.23	8.8.8.8	0xf0da	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:53.941857100 CET	192.168.2.23	8.8.8.8	0x18e8	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:55.533674955 CET	192.168.2.23	8.8.8.8	0x66b4	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:55.669225931 CET	192.168.2.23	8.8.8.8	0xd920	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:57.207789898 CET	192.168.2.23	8.8.8.8	0xeb89	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:57.331330061 CET	192.168.2.23	8.8.8.8	0x3e79	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:58.916484118 CET	192.168.2.23	8.8.8.8	0xe9be	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:59.051500082 CET	192.168.2.23	8.8.8.8	0x4a73	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:00.586700916 CET	192.168.2.23	8.8.8.8	0xa00e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:00.721780062 CET	192.168.2.23	8.8.8.8	0x114	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:02.256499052 CET	192.168.2.23	8.8.8.8	0xa84a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:02.391473055 CET	192.168.2.23	8.8.8.8	0x9070	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:03.882958889 CET	192.168.2.23	8.8.8.8	0xe210	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:04.006041050 CET	192.168.2.23	8.8.8.8	0x30a5	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:05.597033978 CET	192.168.2.23	8.8.8.8	0x946f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:05.732881069 CET	192.168.2.23	8.8.8.8	0xd54e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:07.346349001 CET	192.168.2.23	8.8.8.8	0x2bec	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:07.481693029 CET	192.168.2.23	8.8.8.8	0xcca5	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:09.037379980 CET	192.168.2.23	8.8.8.8	0xce5a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:09.172889948 CET	192.168.2.23	8.8.8.8	0xbcc8	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:10.767693996 CET	192.168.2.23	8.8.8.8	0x1bcd	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:10.891649961 CET	192.168.2.23	8.8.8.8	0x9c3f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:12.440249920 CET	192.168.2.23	8.8.8.8	0xb2d6	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:12.575722933 CET	192.168.2.23	8.8.8.8	0x1755	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:14.074620008 CET	192.168.2.23	8.8.8.8	0x9464	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:14.209196091 CET	192.168.2.23	8.8.8.8	0x5c74	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:15.792800903 CET	192.168.2.23	8.8.8.8	0x7b75	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:15.927756071 CET	192.168.2.23	8.8.8.8	0x45ec	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 23:07:55.255306959 CET	8.8.8.8	192.168.2.23	0x6d5f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:55.613950014 CET	8.8.8.8	192.168.2.23	0x8afd	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:57.364352942 CET	8.8.8.8	192.168.2.23	0x58ae	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:57.724554062 CET	8.8.8.8	192.168.2.23	0xd66f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:59.262128115 CET	8.8.8.8	192.168.2.23	0x5f31	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:07:59.622422934 CET	8.8.8.8	192.168.2.23	0xd293	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:01.424092054 CET	8.8.8.8	192.168.2.23	0x6aca	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:01.807111979 CET	8.8.8.8	192.168.2.23	0x2ff0	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:03.400150061 CET	8.8.8.8	192.168.2.23	0x3b40	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:03.534756899 CET	8.8.8.8	192.168.2.23	0x83fa	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:05.072313070 CET	8.8.8.8	192.168.2.23	0xe2ee	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:05.207973957 CET	8.8.8.8	192.168.2.23	0xbd70	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:06.746784925 CET	8.8.8.8	192.168.2.23	0x6ae6	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:06.882164001 CET	8.8.8.8	192.168.2.23	0xe19f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:08.428430080 CET	8.8.8.8	192.168.2.23	0x5db7	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:08.563853979 CET	8.8.8.8	192.168.2.23	0xe223	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:10.154488087 CET	8.8.8.8	192.168.2.23	0x67c2	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:10.290364027 CET	8.8.8.8	192.168.2.23	0x4598	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:12.066346884 CET	8.8.8.8	192.168.2.23	0xd629	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:12.201652050 CET	8.8.8.8	192.168.2.23	0x1abc	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:13.694622993 CET	8.8.8.8	192.168.2.23	0xa2e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:13.818039894 CET	8.8.8.8	192.168.2.23	0xff08	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:15.366787910 CET	8.8.8.8	192.168.2.23	0xc929	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:15.501729965 CET	8.8.8.8	192.168.2.23	0x1c8c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:16.994256973 CET	8.8.8.8	192.168.2.23	0xb97a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:17.130170107 CET	8.8.8.8	192.168.2.23	0x71ef	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:18.656619072 CET	8.8.8.8	192.168.2.23	0x5547	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:18.791863918 CET	8.8.8.8	192.168.2.23	0xa6d2	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:20.338715076 CET	8.8.8.8	192.168.2.23	0xb2b2	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:20.473885059 CET	8.8.8.8	192.168.2.23	0x244a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:22.021678925 CET	8.8.8.8	192.168.2.23	0xf8b	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:22.156781912 CET	8.8.8.8	192.168.2.23	0x977e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:23.702377081 CET	8.8.8.8	192.168.2.23	0xb911	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:23.837471008 CET	8.8.8.8	192.168.2.23	0x9d1d	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:25.375933886 CET	8.8.8.8	192.168.2.23	0x58d4	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:25.510970116 CET	8.8.8.8	192.168.2.23	0x5cbb	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:27.083431959 CET	8.8.8.8	192.168.2.23	0x1fd3	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:27.218934059 CET	8.8.8.8	192.168.2.23	0x4f77	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:28.752923012 CET	8.8.8.8	192.168.2.23	0x4b9d	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:28.876899958 CET	8.8.8.8	192.168.2.23	0x7014	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:30.415810108 CET	8.8.8.8	192.168.2.23	0xf39e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:30.550923109 CET	8.8.8.8	192.168.2.23	0x98ac	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:32.095057964 CET	8.8.8.8	192.168.2.23	0x1511	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:32.231010914 CET	8.8.8.8	192.168.2.23	0x3919	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:33.768107891 CET	8.8.8.8	192.168.2.23	0xefed	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:33.904675961 CET	8.8.8.8	192.168.2.23	0xc11a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:35.453082085 CET	8.8.8.8	192.168.2.23	0xcdb	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:35.589512110 CET	8.8.8.8	192.168.2.23	0x86d7	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:37.087913990 CET	8.8.8.8	192.168.2.23	0x37db	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:37.223901987 CET	8.8.8.8	192.168.2.23	0x549a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:38.716690063 CET	8.8.8.8	192.168.2.23	0x4b82	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:38.839979887 CET	8.8.8.8	192.168.2.23	0x5385	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:40.373924017 CET	8.8.8.8	192.168.2.23	0x4e46	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:40.497601986 CET	8.8.8.8	192.168.2.23	0x1260	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:42.024950981 CET	8.8.8.8	192.168.2.23	0xc981	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:42.149336100 CET	8.8.8.8	192.168.2.23	0x7d5	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:43.692408085 CET	8.8.8.8	192.168.2.23	0xfbf6	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:43.828883886 CET	8.8.8.8	192.168.2.23	0x3e24	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:45.468024969 CET	8.8.8.8	192.168.2.23	0x3a96	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:45.591994047 CET	8.8.8.8	192.168.2.23	0xca70	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:47.191937923 CET	8.8.8.8	192.168.2.23	0x5a10	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:47.326733112 CET	8.8.8.8	192.168.2.23	0x6baf	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:48.865835905 CET	8.8.8.8	192.168.2.23	0x90c7	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:49.001511097 CET	8.8.8.8	192.168.2.23	0x9b84	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:50.507602930 CET	8.8.8.8	192.168.2.23	0x6138	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:50.631484985 CET	8.8.8.8	192.168.2.23	0x9d81	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:52.232048035 CET	8.8.8.8	192.168.2.23	0x5638	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:52.367055893 CET	8.8.8.8	192.168.2.23	0xa19c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:53.940458059 CET	8.8.8.8	192.168.2.23	0xf0da	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:54.075531006 CET	8.8.8.8	192.168.2.23	0x18e8	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:55.668095112 CET	8.8.8.8	192.168.2.23	0x66b4	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:55.803384066 CET	8.8.8.8	192.168.2.23	0xd920	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:57.330017090 CET	8.8.8.8	192.168.2.23	0xeb89	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:57.465250015 CET	8.8.8.8	192.168.2.23	0x3e79	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:59.050214052 CET	8.8.8.8	192.168.2.23	0xe9be	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:08:59.173969030 CET	8.8.8.8	192.168.2.23	0x4a73	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:00.720514059 CET	8.8.8.8	192.168.2.23	0xa00e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:00.844132900 CET	8.8.8.8	192.168.2.23	0x114	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:02.390201092 CET	8.8.8.8	192.168.2.23	0xa84a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:02.525563002 CET	8.8.8.8	192.168.2.23	0x9070	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:04.005218029 CET	8.8.8.8	192.168.2.23	0xe210	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:04.139923096 CET	8.8.8.8	192.168.2.23	0x30a5	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:05.731512070 CET	8.8.8.8	192.168.2.23	0x946f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:05.867202044 CET	8.8.8.8	192.168.2.23	0xd54e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:07.480318069 CET	8.8.8.8	192.168.2.23	0x2bec	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:07.604249001 CET	8.8.8.8	192.168.2.23	0xcca5	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:09.171605110 CET	8.8.8.8	192.168.2.23	0xce5a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:09.306593895 CET	8.8.8.8	192.168.2.23	0xbcc8	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:10.890037060 CET	8.8.8.8	192.168.2.23	0x1bcd	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:11.025368929 CET	8.8.8.8	192.168.2.23	0x9c3f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:12.574661970 CET	8.8.8.8	192.168.2.23	0xb2d6	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:12.709580898 CET	8.8.8.8	192.168.2.23	0x1755	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:14.208304882 CET	8.8.8.8	192.168.2.23	0x9464	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:14.342782021 CET	8.8.8.8	192.168.2.23	0x5c74	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:15.926604986 CET	8.8.8.8	192.168.2.23	0x7b75	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 28, 2024 23:09:16.061605930 CET	8.8.8.8	192.168.2.23	0x45ec	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Aqua.x86_64.elf PID: 6238, Parent PID: 6162

General

Start time (UTC):	22:07:53
Start date (UTC):	28/12/2024
Path:	/tmp/Aqua.x86_64.elf
Arguments:	/tmp/Aqua.x86_64.elf
File size:	55168 bytes
MD5 hash:	c4e72ea9a7d6723b1d02ad0cb4f978a0

Chronological Activities

Analysis Process: Aqua.x86_64.elf PID: 6239, Parent PID: 6238

General

Start time (UTC):	22:07:53
Start date (UTC):	28/12/2024
Path:	/tmp/Aqua.x86_64.elf
Arguments:	-
File size:	55168 bytes
MD5 hash:	c4e72ea9a7d6723b1d02ad0cb4f978a0

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Aqua.x86_64.elf PID: 6238, Parent PID: 6162

General

Chronological Activities

Analysis Process: Aqua.x86_64.elf PID: 6239, Parent PID: 6238

General

Chronological Activities

Linux Analysis Report
Aqua.x86_64.elf