Edit tour

Linux Analysis Report
Aqua.mpsl.elf

Overview

General Information

Sample name:	Aqua.mpsl.elf
Analysis ID:	1581818
MD5:	0a74ffe24accddf86b809c7bfc5d9fea
SHA1:	8fedc21eba10400b6b5347ddf88db0f04ea309d4
SHA256:	99c418493439d755b1ce11db77c5427ccf7eb46614383ba002481c35883ccf7f
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581818
Start date and time:	2024-12-29 02:32:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.mpsl.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/1@54/0

Runtime Messages

Command:	/tmp/Aqua.mpsl.elf
PID:	6234
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6220, Parent: 4331)

rm (PID: 6220, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.DK2J04M6mQ /tmp/tmp.lkpNJSDxcK /tmp/tmp.KLifnJArgL

dash New Fork (PID: 6221, Parent: 4331)

rm (PID: 6221, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.DK2J04M6mQ /tmp/tmp.lkpNJSDxcK /tmp/tmp.KLifnJArgL

Aqua.mpsl.elf (PID: 6234, Parent: 6154, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/Aqua.mpsl.elf

Aqua.mpsl.elf New Fork (PID: 6236, Parent: 6234)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Aqua.mpsl.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Aqua.mpsl.elf	ReversingLabs: Detection: 28%
Source: Aqua.mpsl.elf	Virustotal: Detection: 31%			Perma Link

Source: global traffic

TCP traffic: 192.168.2.23:40834 -> 193.200.78.37:33966

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: global traffic

DNS traffic detected: DNS query: raw.intenseapi.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal60.evad.linELF@0/1@54/0

Source: /usr/bin/dash (PID: 6220)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DK2J04M6mQ /tmp/tmp.lkpNJSDxcK /tmp/tmp.KLifnJArgL			Jump to behavior
Source: /usr/bin/dash (PID: 6221)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.DK2J04M6mQ /tmp/tmp.lkpNJSDxcK /tmp/tmp.KLifnJArgL			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.mpsl.elf (PID: 6236)

File: /tmp/Aqua.mpsl.elf

Jump to behavior

Source: /tmp/Aqua.mpsl.elf (PID: 6234)

Queries kernel information via 'uname':

Jump to behavior

Source: Aqua.mpsl.elf, 6234.1.00007fff6a0fa000.00007fff6a11b000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.QPcXHB\
Source: Aqua.mpsl.elf, 6234.1.000055e6a4a7e000.000055e6a4b05000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: Aqua.mpsl.elf, 6234.1.00007fff6a0fa000.00007fff6a11b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/Aqua.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.mpsl.elf
Source: Aqua.mpsl.elf, 6234.1.00007fff6a0fa000.00007fff6a11b000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: Aqua.mpsl.elf, 6234.1.000055e6a4a7e000.000055e6a4b05000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: Aqua.mpsl.elf, 6234.1.00007fff6a0fa000.00007fff6a11b000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.QPcXHB
Source: Aqua.mpsl.elf, 6234.1.00007fff6a0fa000.00007fff6a11b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.mpsl.elf	29%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.mpsl.elf	32%	Virustotal		Browse
Aqua.mpsl.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.intenseapi.com	193.200.78.37	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.200.78.37	raw.intenseapi.com	Switzerland	29496	LINK-SERVICE-ASUA	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.200.78.37	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.intenseapi.com	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.200.78.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
LINK-SERVICE-ASUA	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	193.200.78.37

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.QPcXHB (deleted)

Download File

Process:	/tmp/Aqua.mpsl.elf
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.090234012145145
Encrypted:	false
SSDEEP:	3:Tgx078HJN:Tgx0KJN
MD5:	E63B632F705A126169F5DBA5C5A6CF09
SHA1:	F551694AE7907886246C162CA15BDEC195D9192B
SHA-256:	65D3809A17CBE63881980D945FFB94C085E1F8E2257D15154B88A13C3E13169E
SHA-512:	CC5B7C84F66BBE3F8C53F2A67E192619198DCDE6A2DCDF775DD73863F43BB5D775D7FE7EBD42B81DB9743189C3F400681CAA2D00EF9EB9A023CCB01A4889CD2F
Malicious:	false
Reputation:	low
Preview:	/tmp/Aqua.mpsl.elf.nwlrbbmqbh

Static File Info

General

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.481587658819867
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.mpsl.elf
File size:	69'072 bytes
MD5:	0a74ffe24accddf86b809c7bfc5d9fea
SHA1:	8fedc21eba10400b6b5347ddf88db0f04ea309d4
SHA256:	99c418493439d755b1ce11db77c5427ccf7eb46614383ba002481c35883ccf7f
SHA512:	74241592c59bacb9ace7d1dc0a8330a6664320ec916aaf72a097a184cafd711fdf51c5d76a6b2d5439995f53ad37b63fe99e85c3d90339ba0bfb4d4e86831a7b
SSDEEP:	1536:KEz1QJ0Y5vLOWYZXNvCTtMZZ7BL3BSkD:/xg0Y5vLZTtMzbD
TLSH:	7C63F806BB550FF7DCABCD330AB9171124CD691A22F96B3A7534D82CB44B24B56E38A4
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@.p...p...............t...t.E.t.E......,..........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<x..'!...........P.9

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	68552
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0xeda0	0x0	0x6	AX	16
.fini	PROGBITS	0x40eec0	0xeec0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x40ef20	0xef20	0x1250	0x0	0x2	A	16
.ctors	PROGBITS	0x450174	0x10174	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45017c	0x1017c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x450190	0x10190	0x3e0	0x0	0x3	WA	16
.got	PROGBITS	0x450570	0x10570	0x600	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x450b70	0x10b70	0x14	0x0	0x10000003	WAp	4
.bss	NOBITS	0x450b90	0x10b70	0x2200	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xbe2	0x10b70	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x10b70	0x57	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10170	0x10170	5.5434	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x10174	0x450174	0x450174	0x9fc	0x2c1c	3.2045	0x6	RW	0x10000	.ctors .dtors .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 02:32:56.560868979 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:56.680345058 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:56.680529118 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:56.681421041 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:56.801677942 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:56.801839113 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:56.820287943 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 02:32:56.921314001 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:57.917293072 CET	33966	40834	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:57.917694092 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:57.917714119 CET	40834	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:58.187422037 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:58.306943893 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:58.307213068 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:58.308053970 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:58.427542925 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:58.427772999 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:58.547243118 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:59.596318007 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 02:32:59.596524954 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:59.596524954 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:32:59.993662119 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:00.113307953 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:00.113401890 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:00.114132881 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:00.233525991 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:00.233660936 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:00.353198051 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:01.450910091 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:01.451220989 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:01.451220989 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:01.721896887 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:01.841442108 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:01.841540098 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:01.842772007 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:01.962268114 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:01.962342978 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:02.084486961 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:02.195494890 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 02:33:03.178261995 CET	33966	40840	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:03.178428888 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:03.178462982 CET	40840	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:03.219317913 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 02:33:03.672046900 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:03.792152882 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:03.792210102 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:03.793014050 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:03.912463903 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:03.912532091 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:04.032017946 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:05.076230049 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:05.076442957 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:05.076550961 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:05.575999022 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:05.695537090 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:05.695645094 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:05.696765900 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:05.816827059 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:05.817074060 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:05.937262058 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:06.931811094 CET	33966	40844	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:06.932102919 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:06.932194948 CET	40844	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:07.203668118 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:07.323210955 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:07.323340893 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:07.324465036 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:07.443918943 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:07.443991899 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:07.564405918 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:08.612967014 CET	33966	40846	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:08.613122940 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:08.613122940 CET	40846	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:08.872226000 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:08.991736889 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:08.991822004 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:08.992542028 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:09.111993074 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:09.112298012 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:09.231831074 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:10.273737907 CET	33966	40848	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:10.273904085 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:10.273905039 CET	40848	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:10.544126987 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:10.663618088 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:10.663767099 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:10.664870024 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:10.784293890 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:10.784373045 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:10.903873920 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:11.945919991 CET	33966	40850	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:11.946058989 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:11.946183920 CET	40850	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:12.194536924 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:12.316039085 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:12.316107988 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:12.317338943 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:12.436804056 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:12.436887980 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:12.556376934 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:13.559909105 CET	33966	40852	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:13.560060024 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:13.560173035 CET	40852	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:13.833205938 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:13.952629089 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:13.952687025 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:13.953881025 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:14.075417995 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:14.075638056 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:14.195046902 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:15.190773010 CET	33966	40854	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:15.190979958 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:15.190980911 CET	40854	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:15.462003946 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:15.581571102 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:15.581893921 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:15.583173037 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:15.702678919 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:15.702919960 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:15.822614908 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:16.825339079 CET	33966	40856	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:16.825521946 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:16.825571060 CET	40856	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:17.097733021 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:17.217211008 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:17.217478037 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:17.218724966 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:17.338160992 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:17.338228941 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:17.457663059 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:17.553402901 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 02:33:18.461561918 CET	33966	40858	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:18.461868048 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:18.462071896 CET	40858	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:18.722444057 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:18.842005014 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:18.842091084 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:18.843189955 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:18.962618113 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:18.962992907 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:19.082499981 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:20.130201101 CET	33966	40860	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:20.130444050 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:20.130444050 CET	40860	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:20.401448011 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:20.521001101 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:20.521167994 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:20.522737026 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:20.642247915 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:20.642401934 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:20.761929989 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:21.809861898 CET	33966	40862	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:21.810017109 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:21.810100079 CET	40862	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:22.297805071 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:22.417310953 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:22.417495012 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:22.418695927 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:22.538074970 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:22.538276911 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:22.657710075 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:23.661309958 CET	33966	40864	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:23.661479950 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:23.661523104 CET	40864	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:23.933773994 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:24.053539991 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:24.053915977 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:24.055562973 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:24.174997091 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:24.175247908 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:24.294734001 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:25.297815084 CET	33966	40866	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:25.298060894 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:25.298171997 CET	40866	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:25.569839954 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:25.689393044 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:25.689625025 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:25.691047907 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:25.810587883 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:25.810676098 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:25.930151939 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:27.025703907 CET	33966	40868	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:27.025979996 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:27.025979996 CET	40868	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:27.524279118 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:27.643851995 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:27.644061089 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:27.645540953 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:27.765173912 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:27.765552998 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:27.792047024 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 02:33:27.885324955 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:28.936261892 CET	33966	40870	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:28.936593056 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:28.936681986 CET	40870	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:29.208638906 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:29.328260899 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:29.328386068 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:29.330178976 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:29.449635029 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:29.449898005 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:29.569430113 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:30.618732929 CET	33966	40872	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:30.618974924 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:30.619077921 CET	40872	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:30.890991926 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:31.010646105 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:31.010828972 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:31.012083054 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:31.131640911 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:31.131892920 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:31.251432896 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:32.301192999 CET	33966	40874	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:32.301404953 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:32.301444054 CET	40874	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:32.562032938 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:32.681642056 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:32.681823015 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:32.683444023 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:32.803006887 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:32.803317070 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:32.922878981 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:33.935209036 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 02:33:33.964008093 CET	33966	40876	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:33.964289904 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:33.964359999 CET	40876	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:34.236212969 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:34.355828047 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:34.356020927 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:34.357492924 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:34.476911068 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:34.477197886 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:34.596802950 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:35.592029095 CET	33966	40878	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:35.592268944 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:35.592365980 CET	40878	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:35.852884054 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:35.972378016 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:35.972604990 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:35.974430084 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:36.093807936 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:36.094038963 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:36.213634968 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:37.262656927 CET	33966	40880	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:37.262871981 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:37.263092995 CET	40880	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:37.534163952 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:37.653635025 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:37.653752089 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:37.655375957 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:37.774820089 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:37.775084972 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:37.894524097 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:38.943100929 CET	33966	40882	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:38.943270922 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:38.943300962 CET	40882	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:39.203821898 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:39.323371887 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:39.323602915 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:39.325562000 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:39.445148945 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:39.445245981 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:39.564786911 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:40.560363054 CET	33966	40884	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:40.560472012 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:40.560652018 CET	40884	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:40.832433939 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:40.951966047 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:40.952044010 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:40.953263044 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:41.072840929 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:41.072937012 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:33:41.192600012 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 29, 2024 02:33:58.507843971 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 02:34:18.985165119 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 02:34:51.004933119 CET	40886	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 02:34:51.125006914 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 29, 2024 02:34:51.394484997 CET	33966	40886	193.200.78.37	192.168.2.23
Dec 29, 2024 02:34:51.394697905 CET	40886	33966	192.168.2.23	193.200.78.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 02:32:56.068461895 CET	35310	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:32:56.424940109 CET	53	35310	8.8.8.8	192.168.2.23
Dec 29, 2024 02:32:56.426450968 CET	43894	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:32:56.560096025 CET	53	43894	8.8.8.8	192.168.2.23
Dec 29, 2024 02:32:57.918526888 CET	44739	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:32:58.052236080 CET	53	44739	8.8.8.8	192.168.2.23
Dec 29, 2024 02:32:58.053056002 CET	33122	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:32:58.186728001 CET	53	33122	8.8.8.8	192.168.2.23
Dec 29, 2024 02:32:59.597287893 CET	54659	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:32:59.858505964 CET	53	54659	8.8.8.8	192.168.2.23
Dec 29, 2024 02:32:59.859577894 CET	42517	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:32:59.993196011 CET	53	42517	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:01.452193975 CET	33172	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:01.585860968 CET	53	33172	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:01.586680889 CET	57107	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:01.721220016 CET	53	57107	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:03.179342031 CET	43516	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:03.313067913 CET	53	43516	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:03.313827038 CET	36243	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:03.671561956 CET	53	36243	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:05.077562094 CET	42743	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:05.439543962 CET	53	42743	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:05.440910101 CET	45945	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:05.575125933 CET	53	45945	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:06.933434010 CET	37922	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:07.067293882 CET	53	37922	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:07.068815947 CET	33329	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:07.202841043 CET	53	33329	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:08.614203930 CET	58397	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:08.748328924 CET	53	58397	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:08.749229908 CET	56183	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:08.871474981 CET	53	56183	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:10.275103092 CET	33492	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:10.408557892 CET	53	33492	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:10.409817934 CET	35635	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:10.543359995 CET	53	35635	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:11.947432041 CET	58323	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:12.069694042 CET	53	58323	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:12.071201086 CET	44682	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:12.193608999 CET	53	44682	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:13.561382055 CET	49041	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:13.694909096 CET	53	49041	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:13.696299076 CET	57741	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:13.832315922 CET	53	57741	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:15.192054033 CET	32990	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:15.325664997 CET	53	32990	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:15.327157974 CET	34054	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:15.461107016 CET	53	34054	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:16.826812029 CET	36883	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:16.960948944 CET	53	36883	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:16.961971045 CET	53315	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:17.096177101 CET	53	53315	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:18.463726997 CET	37087	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:18.597444057 CET	53	37087	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:18.599088907 CET	35755	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:18.721323967 CET	53	35755	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:20.131746054 CET	54227	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:20.265444040 CET	53	54227	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:20.266839027 CET	52536	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:20.400501013 CET	53	52536	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:21.811686039 CET	38678	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:21.945292950 CET	53	38678	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:21.946774006 CET	49752	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:22.296919107 CET	53	49752	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:23.663079023 CET	58930	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:23.796875000 CET	53	58930	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:23.799027920 CET	50869	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:23.932642937 CET	53	50869	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:25.299659967 CET	54764	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:25.433283091 CET	53	54764	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:25.434794903 CET	60126	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:25.568948984 CET	53	60126	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:27.027971983 CET	54662	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:27.388263941 CET	53	54662	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:27.389873028 CET	60468	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:27.523449898 CET	53	60468	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:28.938255072 CET	50002	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:29.072547913 CET	53	50002	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:29.073981047 CET	52709	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:29.207619905 CET	53	52709	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:30.620779037 CET	34861	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:30.754951954 CET	53	34861	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:30.756500959 CET	43773	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:30.890033960 CET	53	43773	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:32.303484917 CET	54608	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:32.437020063 CET	53	54608	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:32.438606977 CET	42791	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:32.560956001 CET	53	42791	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:33.965868950 CET	44957	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:34.100061893 CET	53	44957	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:34.101579905 CET	42219	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:34.235358953 CET	53	42219	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:35.594158888 CET	34503	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:35.727704048 CET	53	34503	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:35.729641914 CET	60585	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:35.851841927 CET	53	60585	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:37.264698029 CET	59753	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:37.398039103 CET	53	59753	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:37.399549007 CET	36528	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:37.533265114 CET	53	36528	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:38.944936037 CET	32901	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:39.078501940 CET	53	32901	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:39.080560923 CET	54636	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:39.202788115 CET	53	54636	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:40.562340021 CET	34164	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:40.695878983 CET	53	34164	8.8.8.8	192.168.2.23
Dec 29, 2024 02:33:40.697511911 CET	43344	53	192.168.2.23	8.8.8.8
Dec 29, 2024 02:33:40.831681013 CET	53	43344	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 02:32:56.068461895 CET	192.168.2.23	8.8.8.8	0xce78	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:56.426450968 CET	192.168.2.23	8.8.8.8	0x6d0c	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:57.918526888 CET	192.168.2.23	8.8.8.8	0x782	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:58.053056002 CET	192.168.2.23	8.8.8.8	0xa69d	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:59.597287893 CET	192.168.2.23	8.8.8.8	0x664f	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:59.859577894 CET	192.168.2.23	8.8.8.8	0x37ab	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:01.452193975 CET	192.168.2.23	8.8.8.8	0xe453	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:01.586680889 CET	192.168.2.23	8.8.8.8	0xe682	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:03.179342031 CET	192.168.2.23	8.8.8.8	0xf352	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:03.313827038 CET	192.168.2.23	8.8.8.8	0x4067	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:05.077562094 CET	192.168.2.23	8.8.8.8	0x5aee	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:05.440910101 CET	192.168.2.23	8.8.8.8	0x4286	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:06.933434010 CET	192.168.2.23	8.8.8.8	0x7978	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:07.068815947 CET	192.168.2.23	8.8.8.8	0x7510	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:08.614203930 CET	192.168.2.23	8.8.8.8	0x8ac4	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:08.749229908 CET	192.168.2.23	8.8.8.8	0xed84	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:10.275103092 CET	192.168.2.23	8.8.8.8	0x35f7	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:10.409817934 CET	192.168.2.23	8.8.8.8	0x7c60	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:11.947432041 CET	192.168.2.23	8.8.8.8	0x65ae	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:12.071201086 CET	192.168.2.23	8.8.8.8	0x8182	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:13.561382055 CET	192.168.2.23	8.8.8.8	0x6adb	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:13.696299076 CET	192.168.2.23	8.8.8.8	0xc21a	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:15.192054033 CET	192.168.2.23	8.8.8.8	0x35d6	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:15.327157974 CET	192.168.2.23	8.8.8.8	0xcfc0	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:16.826812029 CET	192.168.2.23	8.8.8.8	0xe6ff	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:16.961971045 CET	192.168.2.23	8.8.8.8	0x1c31	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:18.463726997 CET	192.168.2.23	8.8.8.8	0x90f9	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:18.599088907 CET	192.168.2.23	8.8.8.8	0x5fa8	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:20.131746054 CET	192.168.2.23	8.8.8.8	0x2003	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:20.266839027 CET	192.168.2.23	8.8.8.8	0x1bb4	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:21.811686039 CET	192.168.2.23	8.8.8.8	0x4f87	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:21.946774006 CET	192.168.2.23	8.8.8.8	0xb825	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:23.663079023 CET	192.168.2.23	8.8.8.8	0x8c79	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:23.799027920 CET	192.168.2.23	8.8.8.8	0x94cb	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:25.299659967 CET	192.168.2.23	8.8.8.8	0x4b83	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:25.434794903 CET	192.168.2.23	8.8.8.8	0x64ae	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:27.027971983 CET	192.168.2.23	8.8.8.8	0x54a7	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:27.389873028 CET	192.168.2.23	8.8.8.8	0xed7e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:28.938255072 CET	192.168.2.23	8.8.8.8	0xee97	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:29.073981047 CET	192.168.2.23	8.8.8.8	0x3ed	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:30.620779037 CET	192.168.2.23	8.8.8.8	0xbcca	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:30.756500959 CET	192.168.2.23	8.8.8.8	0x3198	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:32.303484917 CET	192.168.2.23	8.8.8.8	0x8768	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:32.438606977 CET	192.168.2.23	8.8.8.8	0xe240	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:33.965868950 CET	192.168.2.23	8.8.8.8	0xae61	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:34.101579905 CET	192.168.2.23	8.8.8.8	0xa3f3	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:35.594158888 CET	192.168.2.23	8.8.8.8	0xc94e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:35.729641914 CET	192.168.2.23	8.8.8.8	0x1f0d	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:37.264698029 CET	192.168.2.23	8.8.8.8	0xad4b	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:37.399549007 CET	192.168.2.23	8.8.8.8	0xd6d6	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:38.944936037 CET	192.168.2.23	8.8.8.8	0xa391	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:39.080560923 CET	192.168.2.23	8.8.8.8	0xd40e	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:40.562340021 CET	192.168.2.23	8.8.8.8	0xf264	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:40.697511911 CET	192.168.2.23	8.8.8.8	0xab27	Standard query (0)	raw.intenseapi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 02:32:56.424940109 CET	8.8.8.8	192.168.2.23	0xce78	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:56.560096025 CET	8.8.8.8	192.168.2.23	0x6d0c	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:58.052236080 CET	8.8.8.8	192.168.2.23	0x782	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:58.186728001 CET	8.8.8.8	192.168.2.23	0xa69d	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:59.858505964 CET	8.8.8.8	192.168.2.23	0x664f	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:32:59.993196011 CET	8.8.8.8	192.168.2.23	0x37ab	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:01.585860968 CET	8.8.8.8	192.168.2.23	0xe453	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:01.721220016 CET	8.8.8.8	192.168.2.23	0xe682	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:03.313067913 CET	8.8.8.8	192.168.2.23	0xf352	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:03.671561956 CET	8.8.8.8	192.168.2.23	0x4067	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:05.439543962 CET	8.8.8.8	192.168.2.23	0x5aee	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:05.575125933 CET	8.8.8.8	192.168.2.23	0x4286	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:07.067293882 CET	8.8.8.8	192.168.2.23	0x7978	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:07.202841043 CET	8.8.8.8	192.168.2.23	0x7510	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:08.748328924 CET	8.8.8.8	192.168.2.23	0x8ac4	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:08.871474981 CET	8.8.8.8	192.168.2.23	0xed84	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:10.408557892 CET	8.8.8.8	192.168.2.23	0x35f7	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:10.543359995 CET	8.8.8.8	192.168.2.23	0x7c60	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:12.069694042 CET	8.8.8.8	192.168.2.23	0x65ae	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:12.193608999 CET	8.8.8.8	192.168.2.23	0x8182	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:13.694909096 CET	8.8.8.8	192.168.2.23	0x6adb	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:13.832315922 CET	8.8.8.8	192.168.2.23	0xc21a	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:15.325664997 CET	8.8.8.8	192.168.2.23	0x35d6	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:15.461107016 CET	8.8.8.8	192.168.2.23	0xcfc0	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:16.960948944 CET	8.8.8.8	192.168.2.23	0xe6ff	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:17.096177101 CET	8.8.8.8	192.168.2.23	0x1c31	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:18.597444057 CET	8.8.8.8	192.168.2.23	0x90f9	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:18.721323967 CET	8.8.8.8	192.168.2.23	0x5fa8	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:20.265444040 CET	8.8.8.8	192.168.2.23	0x2003	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:20.400501013 CET	8.8.8.8	192.168.2.23	0x1bb4	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:21.945292950 CET	8.8.8.8	192.168.2.23	0x4f87	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:22.296919107 CET	8.8.8.8	192.168.2.23	0xb825	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:23.796875000 CET	8.8.8.8	192.168.2.23	0x8c79	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:23.932642937 CET	8.8.8.8	192.168.2.23	0x94cb	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:25.433283091 CET	8.8.8.8	192.168.2.23	0x4b83	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:25.568948984 CET	8.8.8.8	192.168.2.23	0x64ae	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:27.388263941 CET	8.8.8.8	192.168.2.23	0x54a7	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:27.523449898 CET	8.8.8.8	192.168.2.23	0xed7e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:29.072547913 CET	8.8.8.8	192.168.2.23	0xee97	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:29.207619905 CET	8.8.8.8	192.168.2.23	0x3ed	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:30.754951954 CET	8.8.8.8	192.168.2.23	0xbcca	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:30.890033960 CET	8.8.8.8	192.168.2.23	0x3198	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:32.437020063 CET	8.8.8.8	192.168.2.23	0x8768	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:32.560956001 CET	8.8.8.8	192.168.2.23	0xe240	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:34.100061893 CET	8.8.8.8	192.168.2.23	0xae61	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:34.235358953 CET	8.8.8.8	192.168.2.23	0xa3f3	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:35.727704048 CET	8.8.8.8	192.168.2.23	0xc94e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:35.851841927 CET	8.8.8.8	192.168.2.23	0x1f0d	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:37.398039103 CET	8.8.8.8	192.168.2.23	0xad4b	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:37.533265114 CET	8.8.8.8	192.168.2.23	0xd6d6	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:39.078501940 CET	8.8.8.8	192.168.2.23	0xa391	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:39.202788115 CET	8.8.8.8	192.168.2.23	0xd40e	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:40.695878983 CET	8.8.8.8	192.168.2.23	0xf264	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:33:40.831681013 CET	8.8.8.8	192.168.2.23	0xab27	No error (0)	raw.intenseapi.com	193.200.78.37	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 6220, Parent PID: 4331

General

Start time (UTC):	01:32:46
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6220, Parent PID: 4331

General

Start time (UTC):	01:32:46
Start date (UTC):	29/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.DK2J04M6mQ /tmp/tmp.lkpNJSDxcK /tmp/tmp.KLifnJArgL
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6221, Parent PID: 4331

General

Start time (UTC):	01:32:46
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6221, Parent PID: 4331

General

Start time (UTC):	01:32:46
Start date (UTC):	29/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.DK2J04M6mQ /tmp/tmp.lkpNJSDxcK /tmp/tmp.KLifnJArgL
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: Aqua.mpsl.elf PID: 6234, Parent PID: 6154

General

Start time (UTC):	01:32:54
Start date (UTC):	29/12/2024
Path:	/tmp/Aqua.mpsl.elf
Arguments:	/tmp/Aqua.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Chronological Activities

Analysis Process: Aqua.mpsl.elf PID: 6236, Parent PID: 6234

General

Start time (UTC):	01:32:55
Start date (UTC):	29/12/2024
Path:	/tmp/Aqua.mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.QPcXHB (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 6220, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6220, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6221, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6221, Parent PID: 4331

General

Chronological Activities

Analysis Process: Aqua.mpsl.elf PID: 6234, Parent PID: 6154

General

Chronological Activities

Analysis Process: Aqua.mpsl.elf PID: 6236, Parent PID: 6234

General

Chronological Activities

Linux Analysis Report
Aqua.mpsl.elf