Edit tour

Linux Analysis Report
spc.elf

Overview

General Information

Sample name:	spc.elf
Analysis ID:	1544036
MD5:	0cb246f109532cfec8aa67da6d0f5c54
SHA1:	ad0fc6cccff795498ae761ccda571a13c8d44ff9
SHA256:	10c43645d2242f9f5f489d63249aead93241b59ea31d0a970914e4e934ec99e5
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Deletes system log files

Sample tries to access files in /etc/config/ (typical for OpenWRT routers)

Sends malformed DNS queries

Creates hidden files and/or directories

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544036
Start date and time:	2024-10-28 18:28:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	spc.elf
Detection:	MAL
Classification:	mal60.troj.evad.linELF@0/0@201/0

Warnings

VT rate limit hit for: spc.elf

Runtime Messages

Command:	/tmp/spc.elf
PID:	6218
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	thIs wEek on xLaB lEarNs nOthinG xd
Standard Error:

Process Tree

system is lnxubuntu20

spc.elf (PID: 6218, Parent: 6133, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/spc.elf

spc.elf New Fork (PID: 6220, Parent: 6218)

spc.elf New Fork (PID: 6222, Parent: 6218)

spc.elf New Fork (PID: 6262, Parent: 6218)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: spc.elf

ReversingLabs: Detection: 13%

Source: spc.elf	String: ash\|login\|wget\|curl\|tftp\|ntpdate\|ftp
Source: spc.elf	String: /proc//exe\|ash\|login\|wget\|curl\|tftp\|ntpdate\|ftp/lib//lib64/

Networking

Sends malformed DNS queries

Source: global traffic	DNS traffic detected: malformed DNS query: 2joints.libre. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: www.codingdrunk.in. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: nineteen.libre. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: 21savage.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: f.codingdrunk. . [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: eighteen.pirate. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: ru.coziest.lol. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: 75cents.libre. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: fortyfivehundred.dyn. [malformed]

Source: /tmp/spc.elf (PID: 6218)

Socket: 127.0.0.1:1234

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	UDP traffic detected without corresponding DNS query: 54.36.111.116
Source: unknown	UDP traffic detected without corresponding DNS query: 161.97.219.84
Source: unknown	UDP traffic detected without corresponding DNS query: 63.231.92.27
Source: unknown	UDP traffic detected without corresponding DNS query: 63.231.92.27
Source: unknown	UDP traffic detected without corresponding DNS query: 161.97.219.84
Source: unknown	UDP traffic detected without corresponding DNS query: 192.3.165.37
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown	UDP traffic detected without corresponding DNS query: 54.36.111.116
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.69.123
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown	UDP traffic detected without corresponding DNS query: 63.231.92.27
Source: unknown	UDP traffic detected without corresponding DNS query: 54.36.111.116
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.69.123
Source: unknown	UDP traffic detected without corresponding DNS query: 161.97.219.84
Source: unknown	UDP traffic detected without corresponding DNS query: 116.203.104.203
Source: unknown	UDP traffic detected without corresponding DNS query: 116.203.104.203
Source: unknown	UDP traffic detected without corresponding DNS query: 185.84.81.194
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown	UDP traffic detected without corresponding DNS query: 161.97.219.84
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown	UDP traffic detected without corresponding DNS query: 63.231.92.27
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.69.123
Source: unknown	UDP traffic detected without corresponding DNS query: 63.231.92.27
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown	UDP traffic detected without corresponding DNS query: 192.3.165.37
Source: unknown	UDP traffic detected without corresponding DNS query: 192.3.165.37
Source: unknown	UDP traffic detected without corresponding DNS query: 116.203.104.203
Source: unknown	UDP traffic detected without corresponding DNS query: 54.36.111.116
Source: unknown	UDP traffic detected without corresponding DNS query: 54.36.111.116
Source: unknown	UDP traffic detected without corresponding DNS query: 185.84.81.194
Source: unknown	UDP traffic detected without corresponding DNS query: 116.203.104.203
Source: unknown	UDP traffic detected without corresponding DNS query: 162.243.19.47
Source: unknown	UDP traffic detected without corresponding DNS query: 54.36.111.116
Source: unknown	UDP traffic detected without corresponding DNS query: 116.203.104.203
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122
Source: unknown	UDP traffic detected without corresponding DNS query: 63.231.92.27
Source: unknown	UDP traffic detected without corresponding DNS query: 116.203.104.203
Source: unknown	UDP traffic detected without corresponding DNS query: 192.3.165.37
Source: unknown	UDP traffic detected without corresponding DNS query: 63.231.92.27
Source: unknown	UDP traffic detected without corresponding DNS query: 162.243.19.47
Source: unknown	UDP traffic detected without corresponding DNS query: 130.61.64.122

Source: global traffic	DNS traffic detected: DNS query: nineteen.libre
Source: global traffic	DNS traffic detected: DNS query: fortyfivehundred.dyn
Source: global traffic	DNS traffic detected: DNS query: 2joints.libre. [malformed]
Source: global traffic	DNS traffic detected: DNS query: www.codingdrunk.in. [malformed]
Source: global traffic	DNS traffic detected: DNS query: nineteen.libre. [malformed]
Source: global traffic	DNS traffic detected: DNS query: imaverygoodbadboy.libre. [malformed]
Source: global traffic	DNS traffic detected: DNS query: 21savage.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: f.codingdrunk. . [malformed]
Source: global traffic	DNS traffic detected: DNS query: eighteen.pirate. [malformed]
Source: global traffic	DNS traffic detected: DNS query: ru.coziest.lol. [malformed]
Source: global traffic	DNS traffic detected: DNS query: 75cents.libre. [malformed]
Source: global traffic	DNS traffic detected: DNS query: ru.coziest.lol
Source: global traffic	DNS traffic detected: DNS query: eighteen.pirate
Source: global traffic	DNS traffic detected: DNS query: www.codingdrunk.in
Source: global traffic	DNS traffic detected: DNS query: fortyfivehundred.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: imaverygoodbadboy.libre
Source: global traffic	DNS traffic detected: DNS query: 2joints.libre
Source: global traffic	DNS traffic detected: DNS query: f.codingdrunk.

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/spc.elf (PID: 6220)

SIGKILL sent: pid: 936, result: successful

Jump to behavior

Source: classification engine

Classification label: mal60.troj.evad.linELF@0/0@201/0

Data Obfuscation

Sample tries to access files in /etc/config/ (typical for OpenWRT routers)

Source: /tmp/spc.elf (PID: 6222)

File: /etc/config

Jump to behavior

Source: /tmp/spc.elf (PID: 6222)	Directory: /root/.cache	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /root/.ssh	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /root/.config	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /root/.local	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /tmp/.X11-unix	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /tmp/.Test-unix	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /tmp/.font-unix	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /tmp/.ICE-unix	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /tmp/.XIM-unix	Jump to behavior
Source: /tmp/spc.elf (PID: 6222)	Directory: /etc/.java	Jump to behavior

Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/230/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/110/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/231/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/111/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/232/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/112/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/233/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/113/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/234/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/114/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/235/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/115/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/236/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/116/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/237/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/117/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/118/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/910/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/119/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/10/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/11/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/12/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/13/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/14/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/15/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/16/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/17/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/18/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/120/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/121/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/122/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/243/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/123/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/2/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/124/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/3/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/4/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/125/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/126/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/127/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/6/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/248/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/128/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/249/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/9/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/20/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/21/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/22/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/23/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/24/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/25/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/26/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/27/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/28/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/29/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/250/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/130/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/251/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/252/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/132/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/253/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/254/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/255/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/256/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/257/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/379/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/258/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/259/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/30/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/35/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/260/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/261/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/141/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/262/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/263/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/264/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/144/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/265/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/266/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/267/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/269/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/270/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/272/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/274/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/278/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/157/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/281/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/286/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/77/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/78/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/79/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/80/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/81/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/82/fd	Jump to behavior
Source: /tmp/spc.elf (PID: 6220)	File opened: /proc/83/fd	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes system log files

Source: /tmp/spc.elf (PID: 6222)

Log files deleted: /var/log/kern.log

Jump to behavior

Source: /tmp/spc.elf (PID: 6218)

Queries kernel information via 'uname':

Jump to behavior

Source: spc.elf, 6218.1.000055821d19d000.000055821d223000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: spc.elf, 6218.1.000055821d19d000.000055821d223000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: spc.elf, 6218.1.00007ffe07906000.00007ffe07927000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/spc.elf
Source: spc.elf, 6218.1.00007ffe07906000.00007ffe07927000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
spc.elf	13%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
f.codingdrunk.	unknown	unknown	true	unknown
nineteen.libre. [malformed]	unknown	unknown	true	unknown
imaverygoodbadboy.libre. [malformed]	unknown	unknown	true	unknown
fortyfivehundred.dyn. [malformed]	unknown	unknown	true	unknown
f.codingdrunk. . [malformed]	unknown	unknown	true	unknown
ru.coziest.lol	unknown	unknown	true	unknown
www.codingdrunk.in. [malformed]	unknown	unknown	true	unknown
75cents.libre. [malformed]	unknown	unknown	true	unknown
2joints.libre. [malformed]	unknown	unknown	true	unknown
2joints.libre	unknown	unknown	true	unknown
eighteen.pirate	unknown	unknown	true	unknown
nineteen.libre	unknown	unknown	true	unknown
eighteen.pirate. [malformed]	unknown	unknown	true	unknown
www.codingdrunk.in	unknown	unknown	true	unknown
fortyfivehundred.dyn	unknown	unknown	true	unknown
21savage.dyn. [malformed]	unknown	unknown	true	unknown
ru.coziest.lol. [malformed]	unknown	unknown	true	unknown
imaverygoodbadboy.libre	unknown	unknown	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	sshd.elf	Get hash	malicious	Unknown	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	sshd.elf	Get hash	malicious	Unknown	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	m68k.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	m68k.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	main_arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.91522433850772
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	spc.elf
File size:	68'640 bytes
MD5:	0cb246f109532cfec8aa67da6d0f5c54
SHA1:	ad0fc6cccff795498ae761ccda571a13c8d44ff9
SHA256:	10c43645d2242f9f5f489d63249aead93241b59ea31d0a970914e4e934ec99e5
SHA512:	01b2b85cc39387612c844f8349e3cb8ab04e045c45b6ab1089dad86bfd339afb36e343c8c3b81b155105801b5dd56ea78361f1d40fe9e76f0480bc0eafaca370
SSDEEP:	1536:QByu6wpcGWecECmGKIAPQfzr7Xy+MBqWtsTmI4vnfVxaD:QBycy7Xy+Mht3jndS
TLSH:	A4633A36B9762E2BC8C4A97E62F74365F1F5174A10E8CA0E7D720E4EBF60540261B6F4
File Content Preview:	.ELF...........................4.........4. ...(.......................................................l..E.........dt.Q................................@..(....@.;.................#.....bP..`.....!....."...@.....".........`......$"..."...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	68240
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xeff4	0x0	0x6	AX	4
.fini	PROGBITS	0x1f0a4	0xf0a4	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1f0b8	0xf0b8	0x1628	0x0	0x2	A	8
.ctors	PROGBITS	0x306e4	0x106e4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x306ec	0x106ec	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x306f8	0x106f8	0x358	0x0	0x3	WA	8
.bss	NOBITS	0x30a50	0x10a50	0x4268	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x10a50	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x106e0	0x106e0	5.9370	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x106e4	0x306e4	0x306e4	0x36c	0x45d4	3.7811	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 18:28:47.058923960 CET	43928	443	192.168.2.23	91.189.91.42
Oct 28, 2024 18:28:52.434200048 CET	42836	443	192.168.2.23	91.189.91.43
Oct 28, 2024 18:28:53.202106953 CET	42516	80	192.168.2.23	109.202.202.202
Oct 28, 2024 18:29:08.303968906 CET	43928	443	192.168.2.23	91.189.91.42
Oct 28, 2024 18:29:18.542536020 CET	42836	443	192.168.2.23	91.189.91.43
Oct 28, 2024 18:29:22.638055086 CET	42516	80	192.168.2.23	109.202.202.202
Oct 28, 2024 18:29:49.258292913 CET	43928	443	192.168.2.23	91.189.91.42
Oct 28, 2024 18:30:09.735459089 CET	42836	443	192.168.2.23	91.189.91.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 18:28:46.693013906 CET	52066	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:28:46.750387907 CET	36725	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:28:47.498521090 CET	5353	36725	161.97.219.84	192.168.2.23
Oct 28, 2024 18:28:47.501338959 CET	45859	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:28:49.047875881 CET	5353	45859	63.231.92.27	192.168.2.23
Oct 28, 2024 18:28:49.050968885 CET	50568	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:28:49.672403097 CET	5353	50568	63.231.92.27	192.168.2.23
Oct 28, 2024 18:28:49.675160885 CET	34657	53	192.168.2.23	161.97.219.84
Oct 28, 2024 18:28:49.863967896 CET	53	34657	161.97.219.84	192.168.2.23
Oct 28, 2024 18:28:49.867151976 CET	53413	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:28:50.522515059 CET	5353	53413	192.3.165.37	192.168.2.23
Oct 28, 2024 18:28:50.525913954 CET	44257	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:28:50.533755064 CET	53	44257	130.61.64.122	192.168.2.23
Oct 28, 2024 18:28:50.536765099 CET	50114	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:28:50.544531107 CET	53	50114	8.8.8.8	192.168.2.23
Oct 28, 2024 18:28:50.549122095 CET	42024	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:28:50.556080103 CET	53	42024	8.8.8.8	192.168.2.23
Oct 28, 2024 18:28:50.558636904 CET	51524	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:28:50.565769911 CET	53	51524	8.8.8.8	192.168.2.23
Oct 28, 2024 18:28:50.569086075 CET	46659	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:28:50.576471090 CET	53	46659	8.8.8.8	192.168.2.23
Oct 28, 2024 18:28:50.580231905 CET	52940	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:28:50.587110996 CET	53	52940	8.8.8.8	192.168.2.23
Oct 28, 2024 18:28:50.594264030 CET	56015	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:28:55.600807905 CET	54743	53	192.168.2.23	130.61.69.123
Oct 28, 2024 18:28:55.608634949 CET	53	54743	130.61.69.123	192.168.2.23
Oct 28, 2024 18:28:55.611532927 CET	58986	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:28:55.619443893 CET	53	58986	130.61.64.122	192.168.2.23
Oct 28, 2024 18:28:55.621273994 CET	32918	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:28:56.250823975 CET	5353	32918	63.231.92.27	192.168.2.23
Oct 28, 2024 18:28:56.254621983 CET	34114	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:01.257989883 CET	38292	53	192.168.2.23	130.61.69.123
Oct 28, 2024 18:29:01.265604019 CET	53	38292	130.61.69.123	192.168.2.23
Oct 28, 2024 18:29:01.266724110 CET	36028	53	192.168.2.23	161.97.219.84
Oct 28, 2024 18:29:01.708201885 CET	53	36028	161.97.219.84	192.168.2.23
Oct 28, 2024 18:29:01.709216118 CET	42522	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:01.716427088 CET	53	42522	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:01.717509985 CET	41342	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:01.724787951 CET	53	41342	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:01.725938082 CET	48835	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:01.733150959 CET	53	48835	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:01.734067917 CET	39566	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:01.740978003 CET	53	39566	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:01.742032051 CET	42863	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:01.749046087 CET	53	42863	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:01.750390053 CET	46153	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:01.761418104 CET	53	46153	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:01.762147903 CET	36016	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:01.772537947 CET	53	36016	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:01.773304939 CET	44364	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:29:02.645879984 CET	5353	44364	185.84.81.194	192.168.2.23
Oct 28, 2024 18:29:02.646617889 CET	44857	5353	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:07.651992083 CET	44585	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:29:08.291452885 CET	5353	44585	161.97.219.84	192.168.2.23
Oct 28, 2024 18:29:08.292270899 CET	55858	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:08.299738884 CET	53	55858	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:08.300472021 CET	39430	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:08.307845116 CET	53	39430	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:08.308986902 CET	59469	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:08.316164017 CET	53	59469	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:08.328562021 CET	44570	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:08.335875034 CET	53	44570	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:08.336596012 CET	41745	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:08.344053030 CET	53	41745	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:08.344744921 CET	50027	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:08.352313042 CET	53	50027	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:08.352988005 CET	52940	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:08.360084057 CET	53	52940	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:08.362034082 CET	51012	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:29:08.981997967 CET	5353	51012	63.231.92.27	192.168.2.23
Oct 28, 2024 18:29:08.983232021 CET	48168	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:29:13.988285065 CET	50897	53	192.168.2.23	63.231.92.27
Oct 28, 2024 18:29:14.156332016 CET	53	50897	63.231.92.27	192.168.2.23
Oct 28, 2024 18:29:14.157841921 CET	35234	5353	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:19.159151077 CET	44942	53	192.168.2.23	192.3.165.37
Oct 28, 2024 18:29:19.320230961 CET	53	44942	192.3.165.37	192.168.2.23
Oct 28, 2024 18:29:19.321171999 CET	55915	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:29:19.945825100 CET	5353	55915	192.3.165.37	192.168.2.23
Oct 28, 2024 18:29:19.946680069 CET	45296	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:19.958087921 CET	53	45296	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:19.959043026 CET	38344	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:19.966082096 CET	53	38344	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:19.966815948 CET	51108	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:19.973766088 CET	53	51108	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:19.974468946 CET	42679	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:19.981287956 CET	53	42679	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:19.981982946 CET	43362	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:19.989166021 CET	53	43362	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:19.989876032 CET	34925	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:19.996845961 CET	53	34925	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:19.998349905 CET	51181	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:20.004708052 CET	32906	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:20.012092113 CET	59318	53	192.168.2.23	185.84.81.194
Oct 28, 2024 18:29:20.022847891 CET	53	59318	185.84.81.194	192.168.2.23
Oct 28, 2024 18:29:20.023650885 CET	47236	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:20.744549036 CET	5353	47236	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:20.745982885 CET	58674	53	192.168.2.23	162.243.19.47
Oct 28, 2024 18:29:20.835897923 CET	53	58674	162.243.19.47	192.168.2.23
Oct 28, 2024 18:29:20.837377071 CET	52255	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:20.844300032 CET	48476	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:21.574644089 CET	5353	48476	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:21.576654911 CET	48240	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:21.583750963 CET	53	48240	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:21.585316896 CET	55488	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:21.593497992 CET	53	55488	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:21.594938040 CET	56377	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:21.602225065 CET	53	56377	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:21.603550911 CET	59631	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:21.611634016 CET	53	59631	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:21.612901926 CET	56467	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:21.620055914 CET	53	56467	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:21.622518063 CET	32916	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:21.630043030 CET	53	32916	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:21.631594896 CET	49656	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:29:22.482378006 CET	5353	49656	63.231.92.27	192.168.2.23
Oct 28, 2024 18:29:22.483695984 CET	46819	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:22.493988037 CET	53	46819	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:22.495095968 CET	42673	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:29:23.135082960 CET	5353	42673	192.3.165.37	192.168.2.23
Oct 28, 2024 18:29:23.136532068 CET	57566	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:29:23.769889116 CET	5353	57566	63.231.92.27	192.168.2.23
Oct 28, 2024 18:29:23.770972013 CET	54589	53	192.168.2.23	162.243.19.47
Oct 28, 2024 18:29:23.859818935 CET	53	54589	162.243.19.47	192.168.2.23
Oct 28, 2024 18:29:23.861428976 CET	44223	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:23.869940042 CET	53	44223	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:23.871072054 CET	39697	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:23.880481005 CET	53	39697	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:23.881623030 CET	49114	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:23.888452053 CET	53	49114	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:23.889307976 CET	54660	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:23.896676064 CET	53	54660	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:23.897619963 CET	46397	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:23.904658079 CET	53	46397	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:23.905544043 CET	46561	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:23.912702084 CET	53	46561	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:23.914525032 CET	33360	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:24.635241985 CET	5353	33360	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:24.636584997 CET	35508	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:25.358829021 CET	5353	35508	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:25.360449076 CET	45631	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:25.371337891 CET	53	45631	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:25.372572899 CET	58015	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:25.382766008 CET	53	58015	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:25.384076118 CET	51716	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:25.394337893 CET	53	51716	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:25.395672083 CET	58455	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:25.406012058 CET	53	58455	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:25.407010078 CET	57494	53	192.168.2.23	162.243.19.47
Oct 28, 2024 18:29:25.492413044 CET	53	57494	162.243.19.47	192.168.2.23
Oct 28, 2024 18:29:25.493598938 CET	35047	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:25.500191927 CET	53	35047	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:25.501156092 CET	42257	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:25.508033991 CET	53	42257	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:25.508953094 CET	53580	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:25.515923977 CET	53	53580	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:25.516820908 CET	38798	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:25.524010897 CET	53	38798	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:25.524940968 CET	56745	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:25.532423973 CET	53	56745	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:25.533911943 CET	38643	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:26.256304979 CET	5353	38643	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:26.257745028 CET	34854	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:31.262234926 CET	39859	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:31.273117065 CET	53	39859	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:31.274619102 CET	59126	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:29:31.896560907 CET	5353	59126	161.97.219.84	192.168.2.23
Oct 28, 2024 18:29:31.897984028 CET	37046	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:31.908454895 CET	53	37046	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:31.909467936 CET	40958	53	192.168.2.23	130.61.69.123
Oct 28, 2024 18:29:31.917993069 CET	53	40958	130.61.69.123	192.168.2.23
Oct 28, 2024 18:29:31.918976068 CET	54821	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:31.926585913 CET	53	54821	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:31.927647114 CET	40534	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:31.934732914 CET	53	40534	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:31.935759068 CET	37445	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:31.942725897 CET	53	37445	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:31.943691969 CET	58271	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:31.950835943 CET	53	58271	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:31.951720953 CET	47378	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:31.960961103 CET	53	47378	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:31.961832047 CET	36187	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:31.969266891 CET	53	36187	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:31.970573902 CET	38459	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:32.689905882 CET	5353	38459	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:32.691396952 CET	59844	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:29:33.421550989 CET	5353	59844	116.203.104.203	192.168.2.23
Oct 28, 2024 18:29:33.422543049 CET	56193	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:33.430562973 CET	53	56193	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:33.431504965 CET	40096	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:29:38.436903954 CET	40475	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:29:39.153059006 CET	5353	40475	185.84.81.194	192.168.2.23
Oct 28, 2024 18:29:39.154218912 CET	58802	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:39.161883116 CET	53	58802	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:39.162694931 CET	46113	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:44.167928934 CET	59741	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:44.175318003 CET	53	59741	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:44.176486015 CET	60547	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:44.183594942 CET	53	60547	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:44.184600115 CET	34291	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:44.191440105 CET	53	34291	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:44.192559004 CET	34503	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:44.199692965 CET	53	34503	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:44.200686932 CET	50930	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:44.207932949 CET	53	50930	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:44.210026979 CET	41619	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:44.217339039 CET	53	41619	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:44.218477964 CET	34743	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:29:44.225924015 CET	53	34743	130.61.64.122	192.168.2.23
Oct 28, 2024 18:29:44.226927996 CET	55674	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:44.234072924 CET	45271	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:44.241128922 CET	60962	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:29:49.243027925 CET	40437	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:29:54.246279001 CET	55394	53	192.168.2.23	130.61.69.123
Oct 28, 2024 18:29:54.264981031 CET	53	55394	130.61.69.123	192.168.2.23
Oct 28, 2024 18:29:54.265969038 CET	53390	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:54.273463964 CET	53	53390	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:54.274214983 CET	34913	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:54.282946110 CET	53	34913	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:54.283613920 CET	60823	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:54.291095972 CET	53	60823	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:54.292062998 CET	48603	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:54.299510002 CET	53	48603	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:54.300368071 CET	49894	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:29:54.307807922 CET	53	49894	8.8.8.8	192.168.2.23
Oct 28, 2024 18:29:54.309552908 CET	37961	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:29:55.038163900 CET	5353	37961	185.84.81.194	192.168.2.23
Oct 28, 2024 18:29:55.039307117 CET	38495	5353	192.168.2.23	162.243.19.47
Oct 28, 2024 18:30:00.041788101 CET	55555	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:00.052434921 CET	53	55555	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:00.053736925 CET	57711	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:30:00.884386063 CET	5353	57711	63.231.92.27	192.168.2.23
Oct 28, 2024 18:30:00.885627985 CET	36944	53	192.168.2.23	185.84.81.194
Oct 28, 2024 18:30:00.901648998 CET	53	36944	185.84.81.194	192.168.2.23
Oct 28, 2024 18:30:00.902873039 CET	48776	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:30:05.905240059 CET	46668	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:07.576375961 CET	5353	46668	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:07.577656984 CET	39804	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:07.584466934 CET	53	39804	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:07.585494995 CET	45585	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:07.592479944 CET	53	45585	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:07.594067097 CET	35900	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:07.601146936 CET	53	35900	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:07.602121115 CET	40979	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:07.609610081 CET	53	40979	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:07.610591888 CET	45524	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:07.617763996 CET	53	45524	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:07.620414019 CET	41592	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:30:07.626851082 CET	59569	53	192.168.2.23	185.84.81.194
Oct 28, 2024 18:30:07.637607098 CET	53	59569	185.84.81.194	192.168.2.23
Oct 28, 2024 18:30:07.638499975 CET	55190	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:30:07.644788980 CET	40840	53	192.168.2.23	130.61.69.123
Oct 28, 2024 18:30:07.652307034 CET	53	40840	130.61.69.123	192.168.2.23
Oct 28, 2024 18:30:07.653283119 CET	40052	5353	192.168.2.23	162.243.19.47
Oct 28, 2024 18:30:12.658847094 CET	35245	53	192.168.2.23	63.231.92.27
Oct 28, 2024 18:30:12.803352118 CET	53	35245	63.231.92.27	192.168.2.23
Oct 28, 2024 18:30:12.804924011 CET	35611	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:13.555151939 CET	5353	35611	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:13.556324959 CET	44696	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:13.563621998 CET	53	44696	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:13.564642906 CET	59167	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:13.571647882 CET	53	59167	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:13.572654009 CET	37527	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:13.579873085 CET	53	37527	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:13.580853939 CET	52661	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:13.588206053 CET	53	52661	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:13.588947058 CET	55684	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:13.595928907 CET	53	55684	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:13.597740889 CET	54997	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:30:14.328325033 CET	5353	54997	185.84.81.194	192.168.2.23
Oct 28, 2024 18:30:14.330138922 CET	60307	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:14.341831923 CET	53	60307	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:14.343502045 CET	44809	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:30:14.351927042 CET	53	44809	130.61.64.122	192.168.2.23
Oct 28, 2024 18:30:14.353296995 CET	53959	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:30:19.358345985 CET	60179	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:20.081191063 CET	5353	60179	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:20.082772017 CET	49328	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:20.093662977 CET	53	49328	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:20.094752073 CET	47153	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:20.105010033 CET	53	47153	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:20.106650114 CET	38744	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:20.113440990 CET	53	38744	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:20.114383936 CET	50108	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:20.121620893 CET	53	50108	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:20.122831106 CET	46571	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:20.130721092 CET	53	46571	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:20.131963015 CET	52693	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:20.139791012 CET	53	52693	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:20.141025066 CET	51111	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:20.147737980 CET	53	51111	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:20.150321007 CET	49061	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:30:20.785461903 CET	5353	49061	192.3.165.37	192.168.2.23
Oct 28, 2024 18:30:20.786780119 CET	54049	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:30:21.516561031 CET	5353	54049	185.84.81.194	192.168.2.23
Oct 28, 2024 18:30:21.517882109 CET	43875	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:22.233228922 CET	5353	43875	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:22.234606028 CET	38396	53	192.168.2.23	130.61.69.123
Oct 28, 2024 18:30:22.244936943 CET	53	38396	130.61.69.123	192.168.2.23
Oct 28, 2024 18:30:22.245945930 CET	37283	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:30:22.868410110 CET	5353	37283	63.231.92.27	192.168.2.23
Oct 28, 2024 18:30:22.870341063 CET	39068	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:23.609808922 CET	5353	39068	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:23.611248016 CET	56970	53	192.168.2.23	63.231.92.27
Oct 28, 2024 18:30:23.756599903 CET	53	56970	63.231.92.27	192.168.2.23
Oct 28, 2024 18:30:23.758086920 CET	55863	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:23.765332937 CET	53	55863	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:23.766619921 CET	57824	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:23.774393082 CET	53	57824	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:23.775379896 CET	60018	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:23.782603979 CET	53	60018	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:23.783596992 CET	54462	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:23.790540934 CET	53	54462	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:23.791534901 CET	57809	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:23.798873901 CET	53	57809	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:23.800796032 CET	34056	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:30:25.286931992 CET	5353	34056	161.97.219.84	192.168.2.23
Oct 28, 2024 18:30:25.288028002 CET	42707	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:30:30.291975975 CET	50055	53	192.168.2.23	161.97.219.84
Oct 28, 2024 18:30:30.486771107 CET	53	50055	161.97.219.84	192.168.2.23
Oct 28, 2024 18:30:30.487793922 CET	35642	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:30:31.214190006 CET	5353	35642	185.84.81.194	192.168.2.23
Oct 28, 2024 18:30:31.215523958 CET	53322	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:30:31.850255966 CET	5353	53322	161.97.219.84	192.168.2.23
Oct 28, 2024 18:30:31.851634026 CET	59442	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:30:32.496918917 CET	5353	59442	161.97.219.84	192.168.2.23
Oct 28, 2024 18:30:32.498212099 CET	33608	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:30:33.131678104 CET	5353	33608	192.3.165.37	192.168.2.23
Oct 28, 2024 18:30:33.132958889 CET	58490	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:33.140327930 CET	53	58490	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:33.141371965 CET	54011	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:33.148262978 CET	53	54011	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:33.149275064 CET	40372	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:33.156069994 CET	53	40372	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:33.157293081 CET	45314	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:33.164449930 CET	53	45314	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:33.165457964 CET	38190	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:33.173084021 CET	53	38190	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:33.175173044 CET	40374	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:30:33.182168961 CET	35191	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:30:34.418637991 CET	5353	35191	185.84.81.194	192.168.2.23
Oct 28, 2024 18:30:34.419727087 CET	42509	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:30:34.435549021 CET	53	42509	116.203.104.203	192.168.2.23
Oct 28, 2024 18:30:34.436726093 CET	40284	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:30:39.440963030 CET	39725	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:30:40.174631119 CET	5353	39725	185.84.81.194	192.168.2.23
Oct 28, 2024 18:30:40.176067114 CET	42702	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:30:45.181868076 CET	39827	5353	192.168.2.23	130.61.64.122
Oct 28, 2024 18:30:50.186543941 CET	39927	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:50.194509983 CET	53	39927	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:50.195332050 CET	58195	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:50.203706026 CET	53	58195	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:50.205334902 CET	51100	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:50.213413000 CET	53	51100	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:50.214597940 CET	51865	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:50.221491098 CET	53	51865	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:50.222511053 CET	60921	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:30:50.232100010 CET	53	60921	8.8.8.8	192.168.2.23
Oct 28, 2024 18:30:50.234617949 CET	54082	5353	192.168.2.23	162.243.19.47
Oct 28, 2024 18:30:55.237945080 CET	35376	5353	192.168.2.23	162.243.19.47
Oct 28, 2024 18:31:00.240998030 CET	47934	53	192.168.2.23	63.231.92.27
Oct 28, 2024 18:31:00.387862921 CET	53	47934	63.231.92.27	192.168.2.23
Oct 28, 2024 18:31:00.388957977 CET	38724	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:31:00.396181107 CET	53	38724	130.61.64.122	192.168.2.23
Oct 28, 2024 18:31:00.397475004 CET	56308	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:31:05.400804043 CET	48047	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:31:05.407553911 CET	45345	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:31:05.414134979 CET	60681	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:05.420958996 CET	53	60681	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:05.421905994 CET	41545	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:05.428869009 CET	53	41545	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:05.429792881 CET	49131	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:05.437129974 CET	53	49131	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:05.438107967 CET	41780	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:05.444957018 CET	53	41780	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:05.445882082 CET	48157	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:05.453067064 CET	53	48157	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:05.454921961 CET	48404	5353	192.168.2.23	162.243.19.47
Oct 28, 2024 18:31:10.460808039 CET	36549	53	192.168.2.23	54.36.111.116
Oct 28, 2024 18:31:10.467434883 CET	58752	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:31:11.081063032 CET	5353	58752	161.97.219.84	192.168.2.23
Oct 28, 2024 18:31:11.081840038 CET	46893	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:11.800339937 CET	5353	46893	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:11.801352978 CET	46497	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:31:16.803360939 CET	38925	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:17.523391962 CET	5353	38925	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:17.525265932 CET	45544	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:31:22.530775070 CET	53104	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:22.538235903 CET	53	53104	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:22.539310932 CET	58687	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:22.546550035 CET	53	58687	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:22.547699928 CET	52280	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:22.554486036 CET	53	52280	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:22.555593014 CET	53843	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:22.562997103 CET	53	53843	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:22.564173937 CET	40192	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:22.570875883 CET	53	40192	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:22.572834015 CET	55469	5353	192.168.2.23	63.231.92.27
Oct 28, 2024 18:31:23.207134008 CET	5353	55469	63.231.92.27	192.168.2.23
Oct 28, 2024 18:31:23.208343029 CET	37446	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:31:23.842580080 CET	5353	37446	192.3.165.37	192.168.2.23
Oct 28, 2024 18:31:23.843511105 CET	37909	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:31:24.568654060 CET	5353	37909	185.84.81.194	192.168.2.23
Oct 28, 2024 18:31:24.569842100 CET	57509	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:24.580244064 CET	53	57509	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:24.581242085 CET	55655	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:31:29.587218046 CET	54686	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:29.597424030 CET	53	54686	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:29.598557949 CET	50880	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:29.608709097 CET	53	50880	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:29.609843969 CET	45834	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:29.616800070 CET	53	45834	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:29.617980957 CET	54164	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:29.625760078 CET	53	54164	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:29.626781940 CET	52329	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:29.634496927 CET	53	52329	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:29.635462046 CET	49680	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:29.642616987 CET	53	49680	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:29.643490076 CET	43098	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:29.651092052 CET	53	43098	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:29.653326035 CET	45257	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:29.664422989 CET	53	45257	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:29.665683031 CET	53087	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:30.411055088 CET	5353	53087	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:30.413146019 CET	58387	53	192.168.2.23	162.243.19.47
Oct 28, 2024 18:31:30.499098063 CET	53	58387	162.243.19.47	192.168.2.23
Oct 28, 2024 18:31:30.502008915 CET	50763	5353	192.168.2.23	162.243.19.47
Oct 28, 2024 18:31:35.505485058 CET	36030	53	192.168.2.23	63.231.92.27
Oct 28, 2024 18:31:35.653382063 CET	53	36030	63.231.92.27	192.168.2.23
Oct 28, 2024 18:31:35.654251099 CET	34336	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:31:40.659177065 CET	44551	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:31:41.405373096 CET	5353	44551	185.84.81.194	192.168.2.23
Oct 28, 2024 18:31:41.406308889 CET	59284	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:41.416712046 CET	53	59284	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:41.417828083 CET	51743	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:41.424506903 CET	53	51743	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:41.425388098 CET	33399	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:41.432249069 CET	53	33399	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:41.432920933 CET	50574	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:41.439809084 CET	53	50574	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:41.440510988 CET	35099	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:41.447565079 CET	53	35099	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:41.448831081 CET	57642	5353	192.168.2.23	185.84.81.194
Oct 28, 2024 18:31:42.163047075 CET	5353	57642	185.84.81.194	192.168.2.23
Oct 28, 2024 18:31:42.164341927 CET	56884	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:42.886712074 CET	5353	56884	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:42.888003111 CET	55758	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:43.615093946 CET	5353	55758	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:43.616518021 CET	50732	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:31:44.246831894 CET	5353	50732	192.3.165.37	192.168.2.23
Oct 28, 2024 18:31:44.247912884 CET	32830	53	192.168.2.23	192.3.165.37
Oct 28, 2024 18:31:44.351366043 CET	53	32830	192.3.165.37	192.168.2.23
Oct 28, 2024 18:31:44.352116108 CET	45157	53	192.168.2.23	192.3.165.37
Oct 28, 2024 18:31:44.453290939 CET	53	45157	192.3.165.37	192.168.2.23
Oct 28, 2024 18:31:44.454746962 CET	51824	5353	192.168.2.23	130.61.64.122
Oct 28, 2024 18:31:49.458127975 CET	56142	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:49.525078058 CET	53	56142	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:49.526511908 CET	56759	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:49.533224106 CET	53	56759	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:49.534315109 CET	57570	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:49.541285038 CET	53	57570	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:49.542335987 CET	37852	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:49.548950911 CET	53	37852	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:49.549972057 CET	59344	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:49.556768894 CET	53	59344	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:49.558748007 CET	57123	53	192.168.2.23	192.3.165.37
Oct 28, 2024 18:31:49.657521963 CET	53	57123	192.3.165.37	192.168.2.23
Oct 28, 2024 18:31:49.658705950 CET	40701	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:31:54.662678003 CET	40543	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:54.673326015 CET	53	40543	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:54.675128937 CET	53643	53	192.168.2.23	161.97.219.84
Oct 28, 2024 18:31:54.862916946 CET	53	53643	161.97.219.84	192.168.2.23
Oct 28, 2024 18:31:54.864156961 CET	50396	53	192.168.2.23	161.97.219.84
Oct 28, 2024 18:31:55.256129980 CET	53	50396	161.97.219.84	192.168.2.23
Oct 28, 2024 18:31:55.257517099 CET	43183	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:31:55.264769077 CET	53	43183	130.61.64.122	192.168.2.23
Oct 28, 2024 18:31:55.265749931 CET	51837	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:31:55.993099928 CET	5353	51837	116.203.104.203	192.168.2.23
Oct 28, 2024 18:31:55.994106054 CET	36392	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:56.001226902 CET	53	36392	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:56.002027035 CET	53224	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:56.011360884 CET	53	53224	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:56.012278080 CET	53680	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:56.020139933 CET	53	53680	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:56.020901918 CET	56538	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:56.028187037 CET	53	56538	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:56.029006004 CET	44023	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:31:56.036688089 CET	53	44023	8.8.8.8	192.168.2.23
Oct 28, 2024 18:31:56.038392067 CET	34525	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:32:01.041101933 CET	40283	53	192.168.2.23	192.3.165.37
Oct 28, 2024 18:32:01.135055065 CET	53	40283	192.3.165.37	192.168.2.23
Oct 28, 2024 18:32:01.136631966 CET	36967	5353	192.168.2.23	130.61.69.123
Oct 28, 2024 18:32:06.140721083 CET	54569	53	192.168.2.23	63.231.92.27
Oct 28, 2024 18:32:06.289295912 CET	53	54569	63.231.92.27	192.168.2.23
Oct 28, 2024 18:32:06.291096926 CET	55958	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:32:07.216097116 CET	5353	55958	116.203.104.203	192.168.2.23
Oct 28, 2024 18:32:07.217680931 CET	36622	5353	192.168.2.23	161.97.219.84
Oct 28, 2024 18:32:07.831124067 CET	5353	36622	161.97.219.84	192.168.2.23
Oct 28, 2024 18:32:07.832451105 CET	46224	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:32:08.851583958 CET	5353	46224	116.203.104.203	192.168.2.23
Oct 28, 2024 18:32:08.853043079 CET	53864	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:08.864226103 CET	53	53864	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:08.865683079 CET	52728	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:08.875471115 CET	53	52728	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:08.877042055 CET	57781	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:08.884450912 CET	53	57781	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:08.885852098 CET	52710	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:08.894525051 CET	53	52710	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:08.896096945 CET	53614	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:08.904700994 CET	53	53614	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:08.907635927 CET	43809	53	192.168.2.23	130.61.64.122
Oct 28, 2024 18:32:08.916604996 CET	53	43809	130.61.64.122	192.168.2.23
Oct 28, 2024 18:32:08.918015003 CET	48256	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:32:08.932849884 CET	53	48256	116.203.104.203	192.168.2.23
Oct 28, 2024 18:32:08.934158087 CET	53828	5353	192.168.2.23	192.3.165.37
Oct 28, 2024 18:32:09.566843987 CET	5353	53828	192.3.165.37	192.168.2.23
Oct 28, 2024 18:32:09.568203926 CET	43126	5353	192.168.2.23	116.203.104.203
Oct 28, 2024 18:32:10.294187069 CET	5353	43126	116.203.104.203	192.168.2.23
Oct 28, 2024 18:32:10.295269966 CET	45544	5353	192.168.2.23	54.36.111.116
Oct 28, 2024 18:32:15.299981117 CET	53137	53	192.168.2.23	63.231.92.27
Oct 28, 2024 18:32:15.538939953 CET	53	53137	63.231.92.27	192.168.2.23
Oct 28, 2024 18:32:15.540443897 CET	55216	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:32:15.551047087 CET	53	55216	116.203.104.203	192.168.2.23
Oct 28, 2024 18:32:15.552648067 CET	44243	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:15.560132980 CET	53	44243	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:15.561856985 CET	39307	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:15.568893909 CET	53	39307	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:15.570415974 CET	42694	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:15.577399969 CET	53	42694	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:15.578905106 CET	33659	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:15.585961103 CET	53	33659	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:15.587337017 CET	47908	53	192.168.2.23	8.8.8.8
Oct 28, 2024 18:32:15.594202995 CET	53	47908	8.8.8.8	192.168.2.23
Oct 28, 2024 18:32:15.597219944 CET	39266	53	192.168.2.23	185.84.81.194
Oct 28, 2024 18:32:15.608619928 CET	53	39266	185.84.81.194	192.168.2.23
Oct 28, 2024 18:32:15.610095978 CET	44962	5353	192.168.2.23	162.243.19.47
Oct 28, 2024 18:32:20.617073059 CET	33163	53	192.168.2.23	116.203.104.203
Oct 28, 2024 18:32:20.627749920 CET	53	33163	116.203.104.203	192.168.2.23
Oct 28, 2024 18:32:20.629180908 CET	37337	5353	192.168.2.23	54.36.111.116

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 28, 2024 18:28:46.698930025 CET	54.36.111.116	192.168.2.23	658e	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:29:20.003974915 CET	54.36.111.116	192.168.2.23	658e	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:29:20.011396885 CET	54.36.111.116	192.168.2.23	658d	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:29:20.843066931 CET	54.36.111.116	192.168.2.23	658d	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:29:44.232988119 CET	54.36.111.116	192.168.2.23	658d	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:29:44.240154028 CET	54.36.111.116	192.168.2.23	6590	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:30:07.626166105 CET	54.36.111.116	192.168.2.23	658f	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:30:07.644052029 CET	54.36.111.116	192.168.2.23	6590	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:30:33.181082964 CET	54.36.111.116	192.168.2.23	6598	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:31:05.406620979 CET	54.36.111.116	192.168.2.23	658e	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:31:05.413160086 CET	54.36.111.116	192.168.2.23	658d	(Port unreachable)	Destination Unreachable
Oct 28, 2024 18:31:10.466392040 CET	54.36.111.116	192.168.2.23	658e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 18:28:46.693013906 CET	192.168.2.23	54.36.111.116	0x1b7d	Standard query (0)	nineteen.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:28:49.675160885 CET	192.168.2.23	161.97.219.84	0x52b	Standard query (0)	fortyfivehundred.dyn	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:28:50.525913954 CET	192.168.2.23	130.61.64.122	0x3f5f	Standard query (0)	2joints.libre. [malformed]	256	466	false
Oct 28, 2024 18:28:50.536765099 CET	192.168.2.23	8.8.8.8	0xed0d	Standard query (0)	www.codingdrunk.in. [malformed]	256	466	false
Oct 28, 2024 18:28:50.549122095 CET	192.168.2.23	8.8.8.8	0xed0d	Standard query (0)	www.codingdrunk.in. [malformed]	256	466	false
Oct 28, 2024 18:28:50.558636904 CET	192.168.2.23	8.8.8.8	0xed0d	Standard query (0)	www.codingdrunk.in. [malformed]	256	466	false
Oct 28, 2024 18:28:50.569086075 CET	192.168.2.23	8.8.8.8	0xed0d	Standard query (0)	www.codingdrunk.in. [malformed]	256	466	false
Oct 28, 2024 18:28:50.580231905 CET	192.168.2.23	8.8.8.8	0xed0d	Standard query (0)	www.codingdrunk.in. [malformed]	256	466	false
Oct 28, 2024 18:28:55.600807905 CET	192.168.2.23	130.61.69.123	0x647f	Standard query (0)	nineteen.libre. [malformed]	256	471	false
Oct 28, 2024 18:28:55.611532927 CET	192.168.2.23	130.61.64.122	0xe79c	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	471	false
Oct 28, 2024 18:29:01.257989883 CET	192.168.2.23	130.61.69.123	0x4fa	Standard query (0)	21savage.dyn. [malformed]	256	477	false
Oct 28, 2024 18:29:01.266724110 CET	192.168.2.23	161.97.219.84	0xa35d	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	477	false
Oct 28, 2024 18:29:01.709216118 CET	192.168.2.23	8.8.8.8	0xd31a	Standard query (0)	f.codingdrunk. . [malformed]	256	477	false
Oct 28, 2024 18:29:01.717509985 CET	192.168.2.23	8.8.8.8	0xd31a	Standard query (0)	f.codingdrunk. . [malformed]	256	477	false
Oct 28, 2024 18:29:01.725938082 CET	192.168.2.23	8.8.8.8	0xd31a	Standard query (0)	f.codingdrunk. . [malformed]	256	477	false
Oct 28, 2024 18:29:01.734067917 CET	192.168.2.23	8.8.8.8	0xd31a	Standard query (0)	f.codingdrunk. . [malformed]	256	477	false
Oct 28, 2024 18:29:01.742032051 CET	192.168.2.23	8.8.8.8	0xd31a	Standard query (0)	f.codingdrunk. . [malformed]	256	477	false
Oct 28, 2024 18:29:01.750390053 CET	192.168.2.23	116.203.104.203	0xf616	Standard query (0)	nineteen.libre	0	256	false
Oct 28, 2024 18:29:01.762147903 CET	192.168.2.23	116.203.104.203	0x346b	Standard query (0)	2joints.libre. [malformed]	256	477	false
Oct 28, 2024 18:29:08.292270899 CET	192.168.2.23	130.61.64.122	0xbe77	Standard query (0)	nineteen.libre. [malformed]	256	484	false
Oct 28, 2024 18:29:08.300472021 CET	192.168.2.23	130.61.64.122	0x6db2	Standard query (0)	2joints.libre. [malformed]	256	484	false
Oct 28, 2024 18:29:08.308986902 CET	192.168.2.23	8.8.8.8	0x2a96	Standard query (0)	f.codingdrunk. . [malformed]	256	484	false
Oct 28, 2024 18:29:08.328562021 CET	192.168.2.23	8.8.8.8	0x2a96	Standard query (0)	f.codingdrunk. . [malformed]	256	484	false
Oct 28, 2024 18:29:08.336596012 CET	192.168.2.23	8.8.8.8	0x2a96	Standard query (0)	f.codingdrunk. . [malformed]	256	484	false
Oct 28, 2024 18:29:08.344744921 CET	192.168.2.23	8.8.8.8	0x2a96	Standard query (0)	f.codingdrunk. . [malformed]	256	484	false
Oct 28, 2024 18:29:08.352988005 CET	192.168.2.23	8.8.8.8	0x2a96	Standard query (0)	f.codingdrunk. . [malformed]	256	484	false
Oct 28, 2024 18:29:13.988285065 CET	192.168.2.23	63.231.92.27	0xf852	Standard query (0)	eighteen.pirate. [malformed]	256	490	false
Oct 28, 2024 18:29:19.159151077 CET	192.168.2.23	192.3.165.37	0xbc4	Standard query (0)	21savage.dyn. [malformed]	256	495	false
Oct 28, 2024 18:29:19.946680069 CET	192.168.2.23	116.203.104.203	0x6947	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	495	false
Oct 28, 2024 18:29:19.959043026 CET	192.168.2.23	8.8.8.8	0x960e	Standard query (0)	ru.coziest.lol. [malformed]	256	495	false
Oct 28, 2024 18:29:19.966815948 CET	192.168.2.23	8.8.8.8	0x960e	Standard query (0)	ru.coziest.lol. [malformed]	256	495	false
Oct 28, 2024 18:29:19.974468946 CET	192.168.2.23	8.8.8.8	0x960e	Standard query (0)	ru.coziest.lol. [malformed]	256	495	false
Oct 28, 2024 18:29:19.981982946 CET	192.168.2.23	8.8.8.8	0x960e	Standard query (0)	ru.coziest.lol. [malformed]	256	495	false
Oct 28, 2024 18:29:19.989876032 CET	192.168.2.23	8.8.8.8	0x960e	Standard query (0)	ru.coziest.lol. [malformed]	256	495	false
Oct 28, 2024 18:29:19.998349905 CET	192.168.2.23	54.36.111.116	0xf0e6	Standard query (0)	2joints.libre. [malformed]	256	496	false
Oct 28, 2024 18:29:20.004708052 CET	192.168.2.23	54.36.111.116	0x6d51	Standard query (0)	21savage.dyn. [malformed]	256	496	false
Oct 28, 2024 18:29:20.012092113 CET	192.168.2.23	185.84.81.194	0x486e	Standard query (0)	21savage.dyn. [malformed]	256	496	false
Oct 28, 2024 18:29:20.745982885 CET	192.168.2.23	162.243.19.47	0x5806	Standard query (0)	eighteen.pirate. [malformed]	256	496	false
Oct 28, 2024 18:29:20.837377071 CET	192.168.2.23	54.36.111.116	0x9bd1	Standard query (0)	21savage.dyn. [malformed]	256	496	false
Oct 28, 2024 18:29:21.576654911 CET	192.168.2.23	8.8.8.8	0xdd34	Standard query (0)	www.codingdrunk.in. [malformed]	256	497	false
Oct 28, 2024 18:29:21.585316896 CET	192.168.2.23	8.8.8.8	0xdd34	Standard query (0)	www.codingdrunk.in. [malformed]	256	497	false
Oct 28, 2024 18:29:21.594938040 CET	192.168.2.23	8.8.8.8	0xdd34	Standard query (0)	www.codingdrunk.in. [malformed]	256	497	false
Oct 28, 2024 18:29:21.603550911 CET	192.168.2.23	8.8.8.8	0xdd34	Standard query (0)	www.codingdrunk.in. [malformed]	256	497	false
Oct 28, 2024 18:29:21.612901926 CET	192.168.2.23	8.8.8.8	0xdd34	Standard query (0)	www.codingdrunk.in. [malformed]	256	497	false
Oct 28, 2024 18:29:21.622518063 CET	192.168.2.23	130.61.64.122	0x61e4	Standard query (0)	75cents.libre. [malformed]	256	497	false
Oct 28, 2024 18:29:22.483695984 CET	192.168.2.23	116.203.104.203	0x8088	Standard query (0)	fortyfivehundred.dyn	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:23.770972013 CET	192.168.2.23	162.243.19.47	0x313a	Standard query (0)	2joints.libre. [malformed]	256	499	false
Oct 28, 2024 18:29:23.861428976 CET	192.168.2.23	130.61.64.122	0x3d25	Standard query (0)	75cents.libre. [malformed]	256	499	false
Oct 28, 2024 18:29:23.871072054 CET	192.168.2.23	8.8.8.8	0xe068	Standard query (0)	ru.coziest.lol	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:23.881623030 CET	192.168.2.23	8.8.8.8	0xe068	Standard query (0)	ru.coziest.lol	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:23.889307976 CET	192.168.2.23	8.8.8.8	0xe068	Standard query (0)	ru.coziest.lol	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:23.897619963 CET	192.168.2.23	8.8.8.8	0xe068	Standard query (0)	ru.coziest.lol	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:23.905544043 CET	192.168.2.23	8.8.8.8	0xe068	Standard query (0)	ru.coziest.lol	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:25.360449076 CET	192.168.2.23	116.203.104.203	0x23fd	Standard query (0)	eighteen.pirate	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:25.372572899 CET	192.168.2.23	116.203.104.203	0x4b7a	Standard query (0)	nineteen.libre. [malformed]	256	501	false
Oct 28, 2024 18:29:25.384076118 CET	192.168.2.23	116.203.104.203	0xd6b5	Standard query (0)	nineteen.libre. [malformed]	256	501	false
Oct 28, 2024 18:29:25.395672083 CET	192.168.2.23	116.203.104.203	0x45d7	Standard query (0)	21savage.dyn. [malformed]	256	501	false
Oct 28, 2024 18:29:25.407010078 CET	192.168.2.23	162.243.19.47	0x489f	Standard query (0)	21savage.dyn. [malformed]	256	501	false
Oct 28, 2024 18:29:25.493598938 CET	192.168.2.23	8.8.8.8	0x5eed	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:25.501156092 CET	192.168.2.23	8.8.8.8	0x5eed	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:25.508953094 CET	192.168.2.23	8.8.8.8	0x5eed	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:25.516820908 CET	192.168.2.23	8.8.8.8	0x5eed	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:25.524940968 CET	192.168.2.23	8.8.8.8	0x5eed	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:31.262234926 CET	192.168.2.23	116.203.104.203	0x47eb	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	507	false
Oct 28, 2024 18:29:31.897984028 CET	192.168.2.23	116.203.104.203	0x8474	Standard query (0)	75cents.libre. [malformed]	256	507	false
Oct 28, 2024 18:29:31.909467936 CET	192.168.2.23	130.61.69.123	0xc906	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	507	false
Oct 28, 2024 18:29:31.918976068 CET	192.168.2.23	130.61.64.122	0xd7ec	Standard query (0)	2joints.libre. [malformed]	256	507	false
Oct 28, 2024 18:29:31.927647114 CET	192.168.2.23	8.8.8.8	0xf94b	Standard query (0)	f.codingdrunk. . [malformed]	256	507	false
Oct 28, 2024 18:29:31.935759068 CET	192.168.2.23	8.8.8.8	0xf94b	Standard query (0)	f.codingdrunk. . [malformed]	256	507	false
Oct 28, 2024 18:29:31.943691969 CET	192.168.2.23	8.8.8.8	0xf94b	Standard query (0)	f.codingdrunk. . [malformed]	256	507	false
Oct 28, 2024 18:29:31.951720953 CET	192.168.2.23	8.8.8.8	0xf94b	Standard query (0)	f.codingdrunk. . [malformed]	256	507	false
Oct 28, 2024 18:29:31.961832047 CET	192.168.2.23	8.8.8.8	0xf94b	Standard query (0)	f.codingdrunk. . [malformed]	256	507	false
Oct 28, 2024 18:29:33.422543049 CET	192.168.2.23	130.61.64.122	0x1231	Standard query (0)	imaverygoodbadboy.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:39.154218912 CET	192.168.2.23	130.61.64.122	0xa0e2	Standard query (0)	imaverygoodbadboy.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:44.167928934 CET	192.168.2.23	8.8.8.8	0x59d9	Standard query (0)	ru.coziest.lol. [malformed]	256	264	false
Oct 28, 2024 18:29:44.176486015 CET	192.168.2.23	8.8.8.8	0x59d9	Standard query (0)	ru.coziest.lol. [malformed]	256	264	false
Oct 28, 2024 18:29:44.184600115 CET	192.168.2.23	8.8.8.8	0x59d9	Standard query (0)	ru.coziest.lol. [malformed]	256	264	false
Oct 28, 2024 18:29:44.192559004 CET	192.168.2.23	8.8.8.8	0x59d9	Standard query (0)	ru.coziest.lol. [malformed]	256	264	false
Oct 28, 2024 18:29:44.200686932 CET	192.168.2.23	8.8.8.8	0x59d9	Standard query (0)	ru.coziest.lol. [malformed]	256	264	false
Oct 28, 2024 18:29:44.210026979 CET	192.168.2.23	130.61.64.122	0xd8f3	Standard query (0)	21savage.dyn. [malformed]	256	264	false
Oct 28, 2024 18:29:44.218477964 CET	192.168.2.23	130.61.64.122	0xa155	Standard query (0)	2joints.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:44.226927996 CET	192.168.2.23	54.36.111.116	0x67ee	Standard query (0)	2joints.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:44.234072924 CET	192.168.2.23	54.36.111.116	0xecb6	Standard query (0)	eighteen.pirate. [malformed]	256	264	false
Oct 28, 2024 18:29:54.246279001 CET	192.168.2.23	130.61.69.123	0xa793	Standard query (0)	75cents.libre. [malformed]	256	274	false
Oct 28, 2024 18:29:54.265969038 CET	192.168.2.23	8.8.8.8	0xaadf	Standard query (0)	www.codingdrunk.in. [malformed]	256	274	false
Oct 28, 2024 18:29:54.274214983 CET	192.168.2.23	8.8.8.8	0xaadf	Standard query (0)	www.codingdrunk.in. [malformed]	256	274	false
Oct 28, 2024 18:29:54.283613920 CET	192.168.2.23	8.8.8.8	0xaadf	Standard query (0)	www.codingdrunk.in. [malformed]	256	274	false
Oct 28, 2024 18:29:54.292062998 CET	192.168.2.23	8.8.8.8	0xaadf	Standard query (0)	www.codingdrunk.in. [malformed]	256	274	false
Oct 28, 2024 18:29:54.300368071 CET	192.168.2.23	8.8.8.8	0xaadf	Standard query (0)	www.codingdrunk.in. [malformed]	256	274	false
Oct 28, 2024 18:30:00.041788101 CET	192.168.2.23	116.203.104.203	0x6a5f	Standard query (0)	fortyfivehundred.dyn	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:00.885627985 CET	192.168.2.23	185.84.81.194	0x8da5	Standard query (0)	21savage.dyn. [malformed]	256	280	false
Oct 28, 2024 18:30:07.577656984 CET	192.168.2.23	8.8.8.8	0xbfb0	Standard query (0)	ru.coziest.lol. [malformed]	256	287	false
Oct 28, 2024 18:30:07.585494995 CET	192.168.2.23	8.8.8.8	0xbfb0	Standard query (0)	ru.coziest.lol. [malformed]	256	287	false
Oct 28, 2024 18:30:07.594067097 CET	192.168.2.23	8.8.8.8	0xbfb0	Standard query (0)	ru.coziest.lol. [malformed]	256	287	false
Oct 28, 2024 18:30:07.602121115 CET	192.168.2.23	8.8.8.8	0xbfb0	Standard query (0)	ru.coziest.lol. [malformed]	256	287	false
Oct 28, 2024 18:30:07.610591888 CET	192.168.2.23	8.8.8.8	0xbfb0	Standard query (0)	ru.coziest.lol. [malformed]	256	287	false
Oct 28, 2024 18:30:07.620414019 CET	192.168.2.23	54.36.111.116	0xe6a2	Standard query (0)	nineteen.libre. [malformed]	256	287	false
Oct 28, 2024 18:30:07.626851082 CET	192.168.2.23	185.84.81.194	0x5fd8	Standard query (0)	21savage.dyn. [malformed]	256	287	false
Oct 28, 2024 18:30:07.638499975 CET	192.168.2.23	54.36.111.116	0xe900	Standard query (0)	eighteen.pirate. [malformed]	256	287	false
Oct 28, 2024 18:30:07.644788980 CET	192.168.2.23	130.61.69.123	0x8622	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	287	false
Oct 28, 2024 18:30:12.658847094 CET	192.168.2.23	63.231.92.27	0x6596	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	292	false
Oct 28, 2024 18:30:13.556324959 CET	192.168.2.23	8.8.8.8	0x886	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:13.564642906 CET	192.168.2.23	8.8.8.8	0x886	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:13.572654009 CET	192.168.2.23	8.8.8.8	0x886	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:13.580853939 CET	192.168.2.23	8.8.8.8	0x886	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:13.588947058 CET	192.168.2.23	8.8.8.8	0x886	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:14.330138922 CET	192.168.2.23	116.203.104.203	0xe03f	Standard query (0)	75cents.libre. [malformed]	256	294	false
Oct 28, 2024 18:30:14.343502045 CET	192.168.2.23	130.61.64.122	0x6ad0	Standard query (0)	2joints.libre. [malformed]	256	294	false
Oct 28, 2024 18:30:20.082772017 CET	192.168.2.23	116.203.104.203	0x3db7	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	300	false
Oct 28, 2024 18:30:20.094752073 CET	192.168.2.23	116.203.104.203	0xad61	Standard query (0)	nineteen.libre. [malformed]	256	300	false
Oct 28, 2024 18:30:20.106650114 CET	192.168.2.23	8.8.8.8	0xfbb9	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:20.114383936 CET	192.168.2.23	8.8.8.8	0xfbb9	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:20.122831106 CET	192.168.2.23	8.8.8.8	0xfbb9	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:20.131963015 CET	192.168.2.23	8.8.8.8	0xfbb9	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:20.141025066 CET	192.168.2.23	8.8.8.8	0xfbb9	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:22.234606028 CET	192.168.2.23	130.61.69.123	0x392	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	302	false
Oct 28, 2024 18:30:23.611248016 CET	192.168.2.23	63.231.92.27	0x22ee	Standard query (0)	21savage.dyn. [malformed]	256	303	false
Oct 28, 2024 18:30:23.758086920 CET	192.168.2.23	8.8.8.8	0xe3c5	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:23.766619921 CET	192.168.2.23	8.8.8.8	0xe3c5	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:23.775379896 CET	192.168.2.23	8.8.8.8	0xe3c5	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:23.783596992 CET	192.168.2.23	8.8.8.8	0xe3c5	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:23.791534901 CET	192.168.2.23	8.8.8.8	0xe3c5	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:30.291975975 CET	192.168.2.23	161.97.219.84	0x289d	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	310	false
Oct 28, 2024 18:30:33.132958889 CET	192.168.2.23	8.8.8.8	0x8b91	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:33.141371965 CET	192.168.2.23	8.8.8.8	0x8b91	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:33.149275064 CET	192.168.2.23	8.8.8.8	0x8b91	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:33.157293081 CET	192.168.2.23	8.8.8.8	0x8b91	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:33.165457964 CET	192.168.2.23	8.8.8.8	0x8b91	Standard query (0)	www.codingdrunk.in	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:33.175173044 CET	192.168.2.23	54.36.111.116	0xe909	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	313	false
Oct 28, 2024 18:30:34.419727087 CET	192.168.2.23	116.203.104.203	0x4e98	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	314	false
Oct 28, 2024 18:30:50.186543941 CET	192.168.2.23	8.8.8.8	0x93e7	Standard query (0)	ru.coziest.lol. [malformed]	256	330	false
Oct 28, 2024 18:30:50.195332050 CET	192.168.2.23	8.8.8.8	0x93e7	Standard query (0)	ru.coziest.lol. [malformed]	256	330	false
Oct 28, 2024 18:30:50.205334902 CET	192.168.2.23	8.8.8.8	0x93e7	Standard query (0)	ru.coziest.lol. [malformed]	256	330	false
Oct 28, 2024 18:30:50.214597940 CET	192.168.2.23	8.8.8.8	0x93e7	Standard query (0)	ru.coziest.lol. [malformed]	256	330	false
Oct 28, 2024 18:30:50.222511053 CET	192.168.2.23	8.8.8.8	0x93e7	Standard query (0)	ru.coziest.lol. [malformed]	256	330	false
Oct 28, 2024 18:31:00.240998030 CET	192.168.2.23	63.231.92.27	0xd127	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	340	false
Oct 28, 2024 18:31:00.388957977 CET	192.168.2.23	130.61.64.122	0xf9ff	Standard query (0)	21savage.dyn. [malformed]	256	340	false
Oct 28, 2024 18:31:05.400804043 CET	192.168.2.23	54.36.111.116	0xfb62	Standard query (0)	75cents.libre. [malformed]	256	345	false
Oct 28, 2024 18:31:05.407553911 CET	192.168.2.23	54.36.111.116	0x6abb	Standard query (0)	21savage.dyn. [malformed]	256	345	false
Oct 28, 2024 18:31:05.414134979 CET	192.168.2.23	8.8.8.8	0xa017	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:05.421905994 CET	192.168.2.23	8.8.8.8	0xa017	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:05.429792881 CET	192.168.2.23	8.8.8.8	0xa017	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:05.438107967 CET	192.168.2.23	8.8.8.8	0xa017	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:05.445882082 CET	192.168.2.23	8.8.8.8	0xa017	Standard query (0)	f.codingdrunk.	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:10.460808039 CET	192.168.2.23	54.36.111.116	0xb4ef	Standard query (0)	nineteen.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:22.530775070 CET	192.168.2.23	8.8.8.8	0x5440	Standard query (0)	ru.coziest.lol. [malformed]	256	362	false
Oct 28, 2024 18:31:22.539310932 CET	192.168.2.23	8.8.8.8	0x5440	Standard query (0)	ru.coziest.lol. [malformed]	256	362	false
Oct 28, 2024 18:31:22.547699928 CET	192.168.2.23	8.8.8.8	0x5440	Standard query (0)	ru.coziest.lol. [malformed]	256	362	false
Oct 28, 2024 18:31:22.555593014 CET	192.168.2.23	8.8.8.8	0x5440	Standard query (0)	ru.coziest.lol. [malformed]	256	362	false
Oct 28, 2024 18:31:22.564173937 CET	192.168.2.23	8.8.8.8	0x5440	Standard query (0)	ru.coziest.lol. [malformed]	256	362	false
Oct 28, 2024 18:31:24.569842100 CET	192.168.2.23	116.203.104.203	0x8990	Standard query (0)	2joints.libre. [malformed]	256	364	false
Oct 28, 2024 18:31:29.587218046 CET	192.168.2.23	116.203.104.203	0x74ca	Standard query (0)	2joints.libre. [malformed]	256	369	false
Oct 28, 2024 18:31:29.598557949 CET	192.168.2.23	116.203.104.203	0x4419	Standard query (0)	21savage.dyn. [malformed]	256	369	false
Oct 28, 2024 18:31:29.609843969 CET	192.168.2.23	8.8.8.8	0x309e	Standard query (0)	www.codingdrunk.in. [malformed]	256	369	false
Oct 28, 2024 18:31:29.617980957 CET	192.168.2.23	8.8.8.8	0x309e	Standard query (0)	www.codingdrunk.in. [malformed]	256	369	false
Oct 28, 2024 18:31:29.626781940 CET	192.168.2.23	8.8.8.8	0x309e	Standard query (0)	www.codingdrunk.in. [malformed]	256	369	false
Oct 28, 2024 18:31:29.635462046 CET	192.168.2.23	8.8.8.8	0x309e	Standard query (0)	www.codingdrunk.in. [malformed]	256	369	false
Oct 28, 2024 18:31:29.643490076 CET	192.168.2.23	8.8.8.8	0x309e	Standard query (0)	www.codingdrunk.in. [malformed]	256	369	false
Oct 28, 2024 18:31:29.653326035 CET	192.168.2.23	116.203.104.203	0xc025	Standard query (0)	fortyfivehundred.dyn	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:30.413146019 CET	192.168.2.23	162.243.19.47	0xa3fe	Standard query (0)	2joints.libre. [malformed]	256	370	false
Oct 28, 2024 18:31:35.505485058 CET	192.168.2.23	63.231.92.27	0xce29	Standard query (0)	2joints.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:41.406308889 CET	192.168.2.23	8.8.8.8	0x5fd8	Standard query (0)	www.codingdrunk.in. [malformed]	256	381	false
Oct 28, 2024 18:31:41.417828083 CET	192.168.2.23	8.8.8.8	0x5fd8	Standard query (0)	www.codingdrunk.in. [malformed]	256	381	false
Oct 28, 2024 18:31:41.425388098 CET	192.168.2.23	8.8.8.8	0x5fd8	Standard query (0)	www.codingdrunk.in. [malformed]	256	381	false
Oct 28, 2024 18:31:41.432920933 CET	192.168.2.23	8.8.8.8	0x5fd8	Standard query (0)	www.codingdrunk.in. [malformed]	256	381	false
Oct 28, 2024 18:31:41.440510988 CET	192.168.2.23	8.8.8.8	0x5fd8	Standard query (0)	www.codingdrunk.in. [malformed]	256	381	false
Oct 28, 2024 18:31:44.247912884 CET	192.168.2.23	192.3.165.37	0xd4e	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	384	false
Oct 28, 2024 18:31:44.352116108 CET	192.168.2.23	192.3.165.37	0xd5bc	Standard query (0)	75cents.libre. [malformed]	256	384	false
Oct 28, 2024 18:31:49.458127975 CET	192.168.2.23	8.8.8.8	0x60e9	Standard query (0)	f.codingdrunk. . [malformed]	256	389	false
Oct 28, 2024 18:31:49.526511908 CET	192.168.2.23	8.8.8.8	0x60e9	Standard query (0)	f.codingdrunk. . [malformed]	256	389	false
Oct 28, 2024 18:31:49.534315109 CET	192.168.2.23	8.8.8.8	0x60e9	Standard query (0)	f.codingdrunk. . [malformed]	256	389	false
Oct 28, 2024 18:31:49.542335987 CET	192.168.2.23	8.8.8.8	0x60e9	Standard query (0)	f.codingdrunk. . [malformed]	256	389	false
Oct 28, 2024 18:31:49.549972057 CET	192.168.2.23	8.8.8.8	0x60e9	Standard query (0)	f.codingdrunk. . [malformed]	256	389	false
Oct 28, 2024 18:31:49.558748007 CET	192.168.2.23	192.3.165.37	0x319d	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	389	false
Oct 28, 2024 18:31:54.662678003 CET	192.168.2.23	116.203.104.203	0xe689	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	394	false
Oct 28, 2024 18:31:54.675128937 CET	192.168.2.23	161.97.219.84	0xe1d4	Standard query (0)	75cents.libre. [malformed]	256	394	false
Oct 28, 2024 18:31:54.864156961 CET	192.168.2.23	161.97.219.84	0x191d	Standard query (0)	nineteen.libre	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:55.257517099 CET	192.168.2.23	130.61.64.122	0xdefa	Standard query (0)	21savage.dyn. [malformed]	256	395	false
Oct 28, 2024 18:31:55.994106054 CET	192.168.2.23	8.8.8.8	0xb62c	Standard query (0)	www.codingdrunk.in. [malformed]	256	396	false
Oct 28, 2024 18:31:56.002027035 CET	192.168.2.23	8.8.8.8	0xb62c	Standard query (0)	www.codingdrunk.in. [malformed]	256	396	false
Oct 28, 2024 18:31:56.012278080 CET	192.168.2.23	8.8.8.8	0xb62c	Standard query (0)	www.codingdrunk.in. [malformed]	256	396	false
Oct 28, 2024 18:31:56.020901918 CET	192.168.2.23	8.8.8.8	0xb62c	Standard query (0)	www.codingdrunk.in. [malformed]	256	396	false
Oct 28, 2024 18:31:56.029006004 CET	192.168.2.23	8.8.8.8	0xb62c	Standard query (0)	www.codingdrunk.in. [malformed]	256	396	false
Oct 28, 2024 18:32:01.041101933 CET	192.168.2.23	192.3.165.37	0x5af8	Standard query (0)	2joints.libre. [malformed]	256	401	false
Oct 28, 2024 18:32:06.140721083 CET	192.168.2.23	63.231.92.27	0xb868	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	406	false
Oct 28, 2024 18:32:08.853043079 CET	192.168.2.23	8.8.8.8	0x5720	Standard query (0)	f.codingdrunk. . [malformed]	256	408	false
Oct 28, 2024 18:32:08.865683079 CET	192.168.2.23	8.8.8.8	0x5720	Standard query (0)	f.codingdrunk. . [malformed]	256	408	false
Oct 28, 2024 18:32:08.877042055 CET	192.168.2.23	8.8.8.8	0x5720	Standard query (0)	f.codingdrunk. . [malformed]	256	408	false
Oct 28, 2024 18:32:08.885852098 CET	192.168.2.23	8.8.8.8	0x5720	Standard query (0)	f.codingdrunk. . [malformed]	256	408	false
Oct 28, 2024 18:32:08.896096945 CET	192.168.2.23	8.8.8.8	0x5720	Standard query (0)	f.codingdrunk. . [malformed]	256	408	false
Oct 28, 2024 18:32:08.907635927 CET	192.168.2.23	130.61.64.122	0xc499	Standard query (0)	imaverygoodbadboy.libre. [malformed]	256	408	false
Oct 28, 2024 18:32:08.918015003 CET	192.168.2.23	116.203.104.203	0x1bac	Standard query (0)	2joints.libre. [malformed]	256	408	false
Oct 28, 2024 18:32:15.299981117 CET	192.168.2.23	63.231.92.27	0x3f9a	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	415	false
Oct 28, 2024 18:32:15.540443897 CET	192.168.2.23	116.203.104.203	0xf6ee	Standard query (0)	fortyfivehundred.dyn. [malformed]	256	415	false
Oct 28, 2024 18:32:15.552648067 CET	192.168.2.23	8.8.8.8	0xcc53	Standard query (0)	www.codingdrunk.in. [malformed]	256	415	false
Oct 28, 2024 18:32:15.561856985 CET	192.168.2.23	8.8.8.8	0xcc53	Standard query (0)	www.codingdrunk.in. [malformed]	256	415	false
Oct 28, 2024 18:32:15.570415974 CET	192.168.2.23	8.8.8.8	0xcc53	Standard query (0)	www.codingdrunk.in. [malformed]	256	415	false
Oct 28, 2024 18:32:15.578905106 CET	192.168.2.23	8.8.8.8	0xcc53	Standard query (0)	www.codingdrunk.in. [malformed]	256	415	false
Oct 28, 2024 18:32:15.587337017 CET	192.168.2.23	8.8.8.8	0xcc53	Standard query (0)	www.codingdrunk.in. [malformed]	256	415	false
Oct 28, 2024 18:32:15.597219944 CET	192.168.2.23	185.84.81.194	0xae57	Standard query (0)	21savage.dyn. [malformed]	256	415	false
Oct 28, 2024 18:32:20.617073059 CET	192.168.2.23	116.203.104.203	0xc0f3	Standard query (0)	75cents.libre. [malformed]	256	420	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 18:28:49.863967896 CET	161.97.219.84	192.168.2.23	0x52b	Format error (1)	fortyfivehundred.dyn	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:22.493988037 CET	116.203.104.203	192.168.2.23	0x8088	Format error (1)	fortyfivehundred.dyn	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:25.371337891 CET	116.203.104.203	192.168.2.23	0x23fd	Format error (1)	eighteen.pirate	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:33.430562973 CET	130.61.64.122	192.168.2.23	0x1231	Format error (1)	imaverygoodbadboy.libre	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:39.161883116 CET	130.61.64.122	192.168.2.23	0xa0e2	Format error (1)	imaverygoodbadboy.libre	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:29:44.225924015 CET	130.61.64.122	192.168.2.23	0xa155	Format error (1)	2joints.libre	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:30:00.052434921 CET	116.203.104.203	192.168.2.23	0x6a5f	Format error (1)	fortyfivehundred.dyn	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:29.664422989 CET	116.203.104.203	192.168.2.23	0xc025	Format error (1)	fortyfivehundred.dyn	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:35.653382063 CET	63.231.92.27	192.168.2.23	0xce29	Format error (1)	2joints.libre	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:31:55.256129980 CET	161.97.219.84	192.168.2.23	0x191d	Format error (1)	nineteen.libre	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: spc.elf PID: 6218, Parent PID: 6133

General

Start time (UTC):	17:28:45
Start date (UTC):	28/10/2024
Path:	/tmp/spc.elf
Arguments:	/tmp/spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: spc.elf PID: 6220, Parent PID: 6218

General

Start time (UTC):	17:28:46
Start date (UTC):	28/10/2024
Path:	/tmp/spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: spc.elf PID: 6222, Parent PID: 6218

General

Start time (UTC):	17:28:46
Start date (UTC):	28/10/2024
Path:	/tmp/spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: spc.elf PID: 6262, Parent PID: 6218

General

Start time (UTC):	17:28:46
Start date (UTC):	28/10/2024
Path:	/tmp/spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: spc.elf PID: 6218, Parent PID: 6133

General

Chronological Activities

Analysis Process: spc.elf PID: 6220, Parent PID: 6218

General

Chronological Activities

Analysis Process: spc.elf PID: 6222, Parent PID: 6218

General

Chronological Activities

Analysis Process: spc.elf PID: 6262, Parent PID: 6218

General

Chronological Activities

Linux Analysis Report
spc.elf