Edit tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:	sh4.elf
Analysis ID:	1592575
MD5:	82c16ac2784a34c59514162ae7e26ac9
SHA1:	8990b2ad42017663155ff2f6c2a8b8549ed45e71
SHA256:	aee72df7a7faf034183bb37a3aa5dd622eb58212c9bc502c28655b481ac521d8
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample reads /proc/mounts (often used for finding a writable filesystem)

Uses STUN server to do NAT traversial

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592575
Start date and time:	2025-01-16 10:07:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sh4.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/0@1/0

Runtime Messages

Command:	/tmp/sh4.elf
PID:	6231
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	snow slide
Standard Error:

Process Tree

system is lnxubuntu20

sh4.elf (PID: 6231, Parent: 6152, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf

sh4.elf New Fork (PID: 6233, Parent: 6231)

sh4.elf New Fork (PID: 6238, Parent: 6233)

sh4.elf New Fork (PID: 6239, Parent: 6233)

sh4.elf New Fork (PID: 6242, Parent: 6233)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: sh4.elf

ReversingLabs: Detection: 23%

Networking

Uses STUN server to do NAT traversial

Source: unknown

DNS query: name: stun.l.google.com

Source: global traffic

UDP traffic: 192.168.2.23:43211 -> 74.125.250.129:19302

Source: /tmp/sh4.elf (PID: 6231)

Socket: 127.0.0.1:23455

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 105.11.159.93
Source: unknown	TCP traffic detected without corresponding DNS query: 105.11.159.93
Source: unknown	TCP traffic detected without corresponding DNS query: 117.8.74.246
Source: unknown	TCP traffic detected without corresponding DNS query: 117.8.74.246
Source: unknown	TCP traffic detected without corresponding DNS query: 213.215.207.140
Source: unknown	TCP traffic detected without corresponding DNS query: 213.215.207.140
Source: unknown	TCP traffic detected without corresponding DNS query: 80.238.222.227
Source: unknown	TCP traffic detected without corresponding DNS query: 53.136.240.85
Source: unknown	TCP traffic detected without corresponding DNS query: 80.238.222.227
Source: unknown	TCP traffic detected without corresponding DNS query: 53.136.240.85
Source: unknown	TCP traffic detected without corresponding DNS query: 154.117.126.163
Source: unknown	TCP traffic detected without corresponding DNS query: 154.117.126.163
Source: unknown	TCP traffic detected without corresponding DNS query: 145.108.117.215
Source: unknown	TCP traffic detected without corresponding DNS query: 145.108.117.215
Source: unknown	TCP traffic detected without corresponding DNS query: 33.8.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 33.8.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 218.194.162.79
Source: unknown	TCP traffic detected without corresponding DNS query: 218.194.162.79
Source: unknown	TCP traffic detected without corresponding DNS query: 4.29.47.57
Source: unknown	TCP traffic detected without corresponding DNS query: 4.29.47.57
Source: unknown	TCP traffic detected without corresponding DNS query: 92.139.122.43
Source: unknown	TCP traffic detected without corresponding DNS query: 92.139.122.43
Source: unknown	TCP traffic detected without corresponding DNS query: 95.245.107.140
Source: unknown	TCP traffic detected without corresponding DNS query: 198.230.152.48
Source: unknown	TCP traffic detected without corresponding DNS query: 95.245.107.140
Source: unknown	TCP traffic detected without corresponding DNS query: 53.76.86.4
Source: unknown	TCP traffic detected without corresponding DNS query: 198.230.152.48
Source: unknown	TCP traffic detected without corresponding DNS query: 128.225.196.0
Source: unknown	TCP traffic detected without corresponding DNS query: 53.76.86.4
Source: unknown	TCP traffic detected without corresponding DNS query: 128.225.196.0
Source: unknown	TCP traffic detected without corresponding DNS query: 9.127.231.60
Source: unknown	TCP traffic detected without corresponding DNS query: 9.127.231.60
Source: unknown	TCP traffic detected without corresponding DNS query: 166.62.19.57
Source: unknown	TCP traffic detected without corresponding DNS query: 166.62.19.57
Source: unknown	TCP traffic detected without corresponding DNS query: 131.6.87.96
Source: unknown	TCP traffic detected without corresponding DNS query: 131.6.87.96
Source: unknown	TCP traffic detected without corresponding DNS query: 8.73.198.154
Source: unknown	TCP traffic detected without corresponding DNS query: 8.73.198.154
Source: unknown	TCP traffic detected without corresponding DNS query: 147.164.197.16
Source: unknown	TCP traffic detected without corresponding DNS query: 147.164.197.16
Source: unknown	TCP traffic detected without corresponding DNS query: 21.143.205.29
Source: unknown	TCP traffic detected without corresponding DNS query: 21.143.205.29
Source: unknown	TCP traffic detected without corresponding DNS query: 142.69.147.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.69.147.227
Source: unknown	TCP traffic detected without corresponding DNS query: 151.98.26.75
Source: unknown	TCP traffic detected without corresponding DNS query: 151.98.26.75
Source: unknown	TCP traffic detected without corresponding DNS query: 215.104.57.111
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 215.104.57.111

Source: global traffic

DNS traffic detected: DNS query: stun.l.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: classification engine

Classification label: mal56.troj.linELF@0/0@1/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/sh4.elf (PID: 6233)

File: /proc/6233/mounts

Jump to behavior

Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/88/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/89/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/91/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/92/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/93/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/94/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/77/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/78/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/79/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/80/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/81/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/82/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/83/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/84/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/85/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/sh4.elf (PID: 6239)	File opened: /proc/21/cmdline	Jump to behavior

Source: /tmp/sh4.elf (PID: 6231)

Queries kernel information via 'uname':

Jump to behavior

Source: sh4.elf, 6231.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6233.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6238.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6239.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6242.1.00007ffd46316000.00007ffd46337000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 6242.1.00007f85d8428000.00007f85d842c000.rw-.sdmp	Binary or memory string: vmware-tools;
Source: sh4.elf, 6231.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6233.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6238.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6239.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6242.1.000055a274830000.000055a274893000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 6231.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6233.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6238.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6239.1.000055a274830000.000055a274893000.rw-.sdmp, sh4.elf, 6242.1.000055a274830000.000055a274893000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 6242.1.00007f85d8428000.00007f85d842c000.rw-.sdmp	Binary or memory string: vmware-tools
Source: sh4.elf, 6231.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6233.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6238.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6239.1.00007ffd46316000.00007ffd46337000.rw-.sdmp, sh4.elf, 6242.1.00007ffd46316000.00007ffd46337000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 6233.1.00007ffd46316000.00007ffd46337000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sh4.elf	24%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
stun.l.google.com	74.125.250.129	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
123.139.21.131	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
135.78.147.239	unknown	United States	18676	AVAYAUS	false
198.230.152.48	unknown	United States	292	ESNET-WESTUS	false
192.200.193.98	unknown	United States	46573	LAYER-HOSTUS	false
53.12.235.175	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
172.97.241.230	unknown	Canada	11814	DISTRIBUTEL-AS11814CA	false
16.222.131.116	unknown	United States	unknown	unknown	false
16.41.168.171	unknown	United States	unknown	unknown	false
125.172.163.56	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
105.11.159.93	unknown	South Africa	37168	CELL-CZA	false
180.148.247.202	unknown	China	45677	ICVIsahayaCableMediaCoLtdJP	false
87.182.46.212	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
155.189.96.205	unknown	United States	20437	AS20437US	false
57.37.248.236	unknown	Belgium	2686	ATGS-MMD-ASUS	false
23.167.216.82	unknown	Reserved	397654	46LABS-IAD1US	false
22.186.228.168	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
114.136.46.199	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
136.117.137.188	unknown	United States	15169	GOOGLEUS	false
53.136.240.85	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
185.122.106.177	unknown	Poland	197697	PL-LUB-DERKOM-ASPL	false
77.92.122.150	unknown	Turkey	25145	TEKNOTEL-ASTeknotelTelekomunikasyonASTR	false
169.68.173.201	unknown	United States	37611	AfrihostZA	false
31.224.192.197	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
131.6.87.96	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
1.94.24.162	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
154.117.126.163	unknown	Nigeria	37714	BITFLUXNG	false
94.33.49.177	unknown	Italy	8612	TISCALI-IT	false
64.199.252.145	unknown	United States	393775	IPP-AS-DSM1US	false
109.149.49.165	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
151.213.185.105	unknown	United States	7029	WINDSTREAMUS	false
9.168.144.37	unknown	United States	3356	LEVEL3US	false
215.104.57.111	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
53.76.86.4	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
59.146.16.253	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
96.226.107.239	unknown	United States	5650	FRONTIER-FRTRUS	false
213.215.207.140	unknown	Italy	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
79.63.44.249	unknown	Italy	3269	ASN-IBSNAZIT	false
94.84.108.227	unknown	Italy	3269	ASN-IBSNAZIT	false
160.212.237.60	unknown	United States	13333	CCI-PA-AS-1US	false
171.149.128.47	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
179.167.185.29	unknown	Brazil	26599	TELEFONICABRASILSABR	false
162.119.255.200	unknown	United States	3379	KAISER-NCALUS	false
33.8.211.162	unknown	United States	2686	ATGS-MMD-ASUS	false
69.106.231.217	unknown	United States	7018	ATT-INTERNET4US	false
53.4.27.186	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
8.73.198.154	unknown	United States	3356	LEVEL3US	false
21.143.205.29	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
105.141.87.121	unknown	Morocco	6713	IAM-ASMA	false
117.195.55.22	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
142.69.147.227	unknown	Canada	14817	SCL-SHAWCA	false
113.200.50.238	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
22.46.168.157	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
175.245.108.116	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
62.89.250.125	unknown	Russian Federation	200823	LIBERTYINSUR-ASLibertyInsuranceJSCRU	false
17.66.150.68	unknown	United States	714	APPLE-ENGINEERINGUS	false
167.250.86.177	unknown	Brazil	263549	EntornetBandaLargaBR	false
95.245.107.140	unknown	Italy	3269	ASN-IBSNAZIT	false
145.108.117.215	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
92.139.122.43	unknown	France	3215	FranceTelecom-OrangeFR	false
117.8.74.246	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
95.189.208.216	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
166.62.19.57	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
31.77.229.189	unknown	United Kingdom	12576	EELtdGB	false
78.233.6.168	unknown	France	12322	PROXADFR	false
36.155.83.158	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
130.75.150.117	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
74.125.250.129	stun.l.google.com	United States	15169	GOOGLEUS	false
87.131.240.102	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
195.98.84.132	unknown	Russian Federation	6856	IC-VORONEZH-ASInformsvyaz-ChernozemyeRU	false
73.255.36.149	unknown	United States	7922	COMCAST-7922US	false
92.111.127.68	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
207.96.104.20	unknown	United States	6079	RCN-ASUS	false
78.13.241.204	unknown	Italy	8612	TISCALI-IT	false
223.62.82.18	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
60.245.196.217	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
4.29.47.57	unknown	United States	3356	LEVEL3US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
9.127.231.60	unknown	United States	3356	LEVEL3US	false
107.123.147.139	unknown	United States	7018	ATT-INTERNET4US	false
153.120.211.115	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
128.225.196.0	unknown	United States	36441	UGA-ASNUS	false
223.108.109.113	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
219.85.164.242	unknown	Taiwan; Republic of China (ROC)	18182	SONET-TWSonyNetworkTaiwanLimitedTW	false
218.194.162.79	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
88.36.43.49	unknown	Italy	3269	ASN-IBSNAZIT	false
80.238.222.227	unknown	Switzerland	15517	NETSTREAM-CH	false
204.31.131.171	unknown	United States	11426	TWC-11426-CAROLINASUS	false
151.98.26.75	unknown	Italy	8217	ASN-ENIIT	false
192.1.151.51	unknown	United States	11488	BBN-GWUS	false
82.239.3.0	unknown	France	12322	PROXADFR	false
147.164.197.16	unknown	United States	1484	DNIC-AS-01484US	false
58.59.199.183	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
77.140.75.175	unknown	France	15557	LDCOMNETFR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.189.91.43	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arc.elf	Get hash	malicious	Unknown	Browse
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	sora.arm5.elf	Get hash	malicious	Mirai	Browse
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
91.189.91.42	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arc.elf	Get hash	malicious	Unknown	Browse
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	sora.arm5.elf	Get hash	malicious	Mirai	Browse
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	i686.elf	Get hash	malicious	Unknown	Browse	101.207.148.1
	87.121.112.22-arm-2025-01-16T06_52_38.elf	Get hash	malicious	Unknown	Browse	27.50.167.226
	arm7.elf	Get hash	malicious	Unknown	Browse	122.97.214.114
	i586.elf	Get hash	malicious	Unknown	Browse	153.4.104.63
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	58.21.171.103
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	122.139.71.178
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	221.215.178.77
	sora.arm.elf	Get hash	malicious	Mirai	Browse	119.48.25.151
	boatnet.arm.elf	Get hash	malicious	Mirai, Gafgyt	Browse	112.132.41.178
	res.spc.elf	Get hash	malicious	Unknown	Browse	120.64.225.213
AVAYAUS	res.arm.elf	Get hash	malicious	Unknown	Browse	135.96.123.148
	bot.arm7.elf	Get hash	malicious	Mirai	Browse	135.75.47.84
	mips.elf	Get hash	malicious	Mirai	Browse	135.150.73.92
	S8LDvVdtOk.dll	Get hash	malicious	Wannacry	Browse	135.122.86.233
	6qqWn6eIGG.dll	Get hash	malicious	Wannacry	Browse	135.71.100.2
	i686.elf	Get hash	malicious	Unknown	Browse	135.63.64.55
	meth14.elf	Get hash	malicious	Mirai	Browse	135.123.208.147
	meth15.elf	Get hash	malicious	Mirai	Browse	135.169.255.178
	3.elf	Get hash	malicious	Unknown	Browse	135.82.8.10
	6.elf	Get hash	malicious	Unknown	Browse	135.96.123.147
ESNET-WESTUS	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	198.230.183.240
	GeW4GzT8G8.dll	Get hash	malicious	Virut, Wannacry	Browse	198.232.135.223
	xd.arm.elf	Get hash	malicious	Mirai	Browse	198.130.12.18
	miori.mips.elf	Get hash	malicious	Unknown	Browse	198.230.94.67
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	198.198.139.235
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	198.232.208.252
	splspc.elf	Get hash	malicious	Unknown	Browse	198.137.125.163
	arm7.elf	Get hash	malicious	Unknown	Browse	198.128.208.210
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	198.193.165.226
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	198.230.192.201

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:
Entropy (8bit):	6.724268414195377
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sh4.elf
File size:	87'008 bytes
MD5:	82c16ac2784a34c59514162ae7e26ac9
SHA1:	8990b2ad42017663155ff2f6c2a8b8549ed45e71
SHA256:	aee72df7a7faf034183bb37a3aa5dd622eb58212c9bc502c28655b481ac521d8
SHA512:	d54b91ef1f4b50605dbf5d37322de7f333e167025bfddbec1958adb6c3f22e8697b999a40bc07df7dd0cfc294acea081bbfef948262aaef4f571de55d1f01932
SSDEEP:	1536:wkk2BKBauB67ZZb8LfXS0/KInhhlHGgxlgyrqA+nzr6:wBWbuB67ZZYLfXOY5GyZ+n3
TLSH:	82839E31E5542CD1D81102B4B0B5DDB94B13AEF4419A2D727EFEE9680493B9CBACE3D8
File Content Preview:	.ELF.....................@.4....R......4. ...(...............@...@.8P..8P..............8P..8PB.8PB.x...............Q.td..............................././"O.n......#.@........#.*@.7..&O.n.l..................................././.../.a"O.!...n...a.b("...q.

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 10:07:54.991571903 CET	43928	443	192.168.2.23	91.189.91.42
Jan 16, 2025 10:08:00.223678112 CET	41102	23	192.168.2.23	105.11.159.93
Jan 16, 2025 10:08:00.229561090 CET	23	41102	105.11.159.93	192.168.2.23
Jan 16, 2025 10:08:00.229907990 CET	41102	23	192.168.2.23	105.11.159.93
Jan 16, 2025 10:08:00.231065035 CET	51042	23	192.168.2.23	117.8.74.246
Jan 16, 2025 10:08:00.235939980 CET	23	51042	117.8.74.246	192.168.2.23
Jan 16, 2025 10:08:00.235992908 CET	51042	23	192.168.2.23	117.8.74.246
Jan 16, 2025 10:08:00.238754034 CET	57424	23	192.168.2.23	213.215.207.140
Jan 16, 2025 10:08:00.243571043 CET	23	57424	213.215.207.140	192.168.2.23
Jan 16, 2025 10:08:00.243622065 CET	57424	23	192.168.2.23	213.215.207.140
Jan 16, 2025 10:08:00.244146109 CET	37022	23	192.168.2.23	80.238.222.227
Jan 16, 2025 10:08:00.249238968 CET	47152	23	192.168.2.23	53.136.240.85
Jan 16, 2025 10:08:00.249521017 CET	23	37022	80.238.222.227	192.168.2.23
Jan 16, 2025 10:08:00.249603033 CET	37022	23	192.168.2.23	80.238.222.227
Jan 16, 2025 10:08:00.254102945 CET	23	47152	53.136.240.85	192.168.2.23
Jan 16, 2025 10:08:00.254160881 CET	47152	23	192.168.2.23	53.136.240.85
Jan 16, 2025 10:08:00.254528046 CET	40936	23	192.168.2.23	154.117.126.163
Jan 16, 2025 10:08:00.259572983 CET	23	40936	154.117.126.163	192.168.2.23
Jan 16, 2025 10:08:00.259747028 CET	40936	23	192.168.2.23	154.117.126.163
Jan 16, 2025 10:08:00.261991978 CET	54224	23	192.168.2.23	145.108.117.215
Jan 16, 2025 10:08:00.266843081 CET	23	54224	145.108.117.215	192.168.2.23
Jan 16, 2025 10:08:00.266913891 CET	54224	23	192.168.2.23	145.108.117.215
Jan 16, 2025 10:08:00.268984079 CET	50482	23	192.168.2.23	33.8.211.162
Jan 16, 2025 10:08:00.273768902 CET	23	50482	33.8.211.162	192.168.2.23
Jan 16, 2025 10:08:00.273863077 CET	50482	23	192.168.2.23	33.8.211.162
Jan 16, 2025 10:08:00.274990082 CET	45660	23	192.168.2.23	218.194.162.79
Jan 16, 2025 10:08:00.279786110 CET	23	45660	218.194.162.79	192.168.2.23
Jan 16, 2025 10:08:00.280049086 CET	45660	23	192.168.2.23	218.194.162.79
Jan 16, 2025 10:08:00.281780005 CET	51066	23	192.168.2.23	4.29.47.57
Jan 16, 2025 10:08:00.286592960 CET	23	51066	4.29.47.57	192.168.2.23
Jan 16, 2025 10:08:00.286663055 CET	51066	23	192.168.2.23	4.29.47.57
Jan 16, 2025 10:08:00.287414074 CET	60180	23	192.168.2.23	92.139.122.43
Jan 16, 2025 10:08:00.292284966 CET	23	60180	92.139.122.43	192.168.2.23
Jan 16, 2025 10:08:00.292381048 CET	60180	23	192.168.2.23	92.139.122.43
Jan 16, 2025 10:08:00.292763948 CET	53514	23	192.168.2.23	95.245.107.140
Jan 16, 2025 10:08:00.297308922 CET	49018	23	192.168.2.23	198.230.152.48
Jan 16, 2025 10:08:00.297705889 CET	23	53514	95.245.107.140	192.168.2.23
Jan 16, 2025 10:08:00.297836065 CET	53514	23	192.168.2.23	95.245.107.140
Jan 16, 2025 10:08:00.302223921 CET	36624	23	192.168.2.23	53.76.86.4
Jan 16, 2025 10:08:00.302690983 CET	23	49018	198.230.152.48	192.168.2.23
Jan 16, 2025 10:08:00.302819967 CET	49018	23	192.168.2.23	198.230.152.48
Jan 16, 2025 10:08:00.306504965 CET	36976	23	192.168.2.23	128.225.196.0
Jan 16, 2025 10:08:00.306974888 CET	23	36624	53.76.86.4	192.168.2.23
Jan 16, 2025 10:08:00.307107925 CET	36624	23	192.168.2.23	53.76.86.4
Jan 16, 2025 10:08:00.311383963 CET	23	36976	128.225.196.0	192.168.2.23
Jan 16, 2025 10:08:00.311470032 CET	36976	23	192.168.2.23	128.225.196.0
Jan 16, 2025 10:08:00.311738014 CET	42006	23	192.168.2.23	9.127.231.60
Jan 16, 2025 10:08:00.316540956 CET	23	42006	9.127.231.60	192.168.2.23
Jan 16, 2025 10:08:00.316582918 CET	42006	23	192.168.2.23	9.127.231.60
Jan 16, 2025 10:08:00.317981958 CET	40778	23	192.168.2.23	166.62.19.57
Jan 16, 2025 10:08:00.322766066 CET	23	40778	166.62.19.57	192.168.2.23
Jan 16, 2025 10:08:00.322928905 CET	40778	23	192.168.2.23	166.62.19.57
Jan 16, 2025 10:08:00.324269056 CET	52422	23	192.168.2.23	131.6.87.96
Jan 16, 2025 10:08:00.329185009 CET	23	52422	131.6.87.96	192.168.2.23
Jan 16, 2025 10:08:00.329586983 CET	52422	23	192.168.2.23	131.6.87.96
Jan 16, 2025 10:08:00.331461906 CET	43220	23	192.168.2.23	8.73.198.154
Jan 16, 2025 10:08:00.336318970 CET	23	43220	8.73.198.154	192.168.2.23
Jan 16, 2025 10:08:00.336368084 CET	43220	23	192.168.2.23	8.73.198.154
Jan 16, 2025 10:08:00.336824894 CET	52108	23	192.168.2.23	147.164.197.16
Jan 16, 2025 10:08:00.341677904 CET	23	52108	147.164.197.16	192.168.2.23
Jan 16, 2025 10:08:00.341974020 CET	52108	23	192.168.2.23	147.164.197.16
Jan 16, 2025 10:08:00.343360901 CET	46658	23	192.168.2.23	21.143.205.29
Jan 16, 2025 10:08:00.348592043 CET	23	46658	21.143.205.29	192.168.2.23
Jan 16, 2025 10:08:00.348644972 CET	46658	23	192.168.2.23	21.143.205.29
Jan 16, 2025 10:08:00.348844051 CET	46076	23	192.168.2.23	142.69.147.227
Jan 16, 2025 10:08:00.353698969 CET	23	46076	142.69.147.227	192.168.2.23
Jan 16, 2025 10:08:00.354017973 CET	46076	23	192.168.2.23	142.69.147.227
Jan 16, 2025 10:08:00.355439901 CET	57746	23	192.168.2.23	151.98.26.75
Jan 16, 2025 10:08:00.360362053 CET	23	57746	151.98.26.75	192.168.2.23
Jan 16, 2025 10:08:00.360553026 CET	57746	23	192.168.2.23	151.98.26.75
Jan 16, 2025 10:08:00.361975908 CET	52436	23	192.168.2.23	215.104.57.111
Jan 16, 2025 10:08:00.366556883 CET	42836	443	192.168.2.23	91.189.91.43
Jan 16, 2025 10:08:00.367086887 CET	23	52436	215.104.57.111	192.168.2.23
Jan 16, 2025 10:08:00.367247105 CET	52436	23	192.168.2.23	215.104.57.111
Jan 16, 2025 10:08:00.367531061 CET	57490	23	192.168.2.23	114.136.46.199
Jan 16, 2025 10:08:00.372278929 CET	49914	23	192.168.2.23	77.92.122.150
Jan 16, 2025 10:08:00.373226881 CET	23	57490	114.136.46.199	192.168.2.23
Jan 16, 2025 10:08:00.373326063 CET	57490	23	192.168.2.23	114.136.46.199
Jan 16, 2025 10:08:00.376791000 CET	48474	23	192.168.2.23	31.77.229.189
Jan 16, 2025 10:08:00.377095938 CET	23	49914	77.92.122.150	192.168.2.23
Jan 16, 2025 10:08:00.377327919 CET	49914	23	192.168.2.23	77.92.122.150
Jan 16, 2025 10:08:00.381586075 CET	23	48474	31.77.229.189	192.168.2.23
Jan 16, 2025 10:08:00.381885052 CET	48474	23	192.168.2.23	31.77.229.189
Jan 16, 2025 10:08:00.383342028 CET	52006	23	192.168.2.23	1.94.24.162
Jan 16, 2025 10:08:00.389065027 CET	46060	23	192.168.2.23	23.167.216.82
Jan 16, 2025 10:08:00.389137030 CET	23	52006	1.94.24.162	192.168.2.23
Jan 16, 2025 10:08:00.389208078 CET	52006	23	192.168.2.23	1.94.24.162
Jan 16, 2025 10:08:00.393677950 CET	45576	23	192.168.2.23	57.37.248.236
Jan 16, 2025 10:08:00.394138098 CET	23	46060	23.167.216.82	192.168.2.23
Jan 16, 2025 10:08:00.394396067 CET	46060	23	192.168.2.23	23.167.216.82
Jan 16, 2025 10:08:00.398540020 CET	23	45576	57.37.248.236	192.168.2.23
Jan 16, 2025 10:08:00.398623943 CET	45576	23	192.168.2.23	57.37.248.236
Jan 16, 2025 10:08:00.398772001 CET	54266	23	192.168.2.23	94.33.49.177
Jan 16, 2025 10:08:00.401865005 CET	47290	23	192.168.2.23	16.41.168.171
Jan 16, 2025 10:08:00.403697968 CET	23	54266	94.33.49.177	192.168.2.23
Jan 16, 2025 10:08:00.403855085 CET	54266	23	192.168.2.23	94.33.49.177
Jan 16, 2025 10:08:00.405216932 CET	36202	23	192.168.2.23	53.4.27.186
Jan 16, 2025 10:08:00.407424927 CET	23	47290	16.41.168.171	192.168.2.23
Jan 16, 2025 10:08:00.407567978 CET	47290	23	192.168.2.23	16.41.168.171
Jan 16, 2025 10:08:00.408955097 CET	37598	23	192.168.2.23	151.213.185.105
Jan 16, 2025 10:08:00.410047054 CET	23	36202	53.4.27.186	192.168.2.23
Jan 16, 2025 10:08:00.410131931 CET	36202	23	192.168.2.23	53.4.27.186
Jan 16, 2025 10:08:00.411453009 CET	60794	23	192.168.2.23	31.224.192.197
Jan 16, 2025 10:08:00.413901091 CET	23	37598	151.213.185.105	192.168.2.23
Jan 16, 2025 10:08:00.414128065 CET	37598	23	192.168.2.23	151.213.185.105
Jan 16, 2025 10:08:00.414731979 CET	39136	23	192.168.2.23	53.12.235.175
Jan 16, 2025 10:08:00.416435957 CET	23	60794	31.224.192.197	192.168.2.23
Jan 16, 2025 10:08:00.416513920 CET	60794	23	192.168.2.23	31.224.192.197
Jan 16, 2025 10:08:00.417510033 CET	40124	23	192.168.2.23	192.200.193.98
Jan 16, 2025 10:08:00.419641018 CET	23	39136	53.12.235.175	192.168.2.23
Jan 16, 2025 10:08:00.420067072 CET	39136	23	192.168.2.23	53.12.235.175
Jan 16, 2025 10:08:00.421005011 CET	45970	23	192.168.2.23	59.146.16.253
Jan 16, 2025 10:08:00.422360897 CET	23	40124	192.200.193.98	192.168.2.23
Jan 16, 2025 10:08:00.422434092 CET	40124	23	192.168.2.23	192.200.193.98
Jan 16, 2025 10:08:00.425193071 CET	60048	23	192.168.2.23	16.222.131.116
Jan 16, 2025 10:08:00.425856113 CET	23	45970	59.146.16.253	192.168.2.23
Jan 16, 2025 10:08:00.425959110 CET	45970	23	192.168.2.23	59.146.16.253
Jan 16, 2025 10:08:00.428706884 CET	48064	23	192.168.2.23	87.182.46.212
Jan 16, 2025 10:08:00.430902958 CET	23	60048	16.222.131.116	192.168.2.23
Jan 16, 2025 10:08:00.430974007 CET	60048	23	192.168.2.23	16.222.131.116
Jan 16, 2025 10:08:00.432202101 CET	57514	23	192.168.2.23	123.139.21.131
Jan 16, 2025 10:08:00.433620930 CET	23	48064	87.182.46.212	192.168.2.23
Jan 16, 2025 10:08:00.433796883 CET	48064	23	192.168.2.23	87.182.46.212
Jan 16, 2025 10:08:00.435591936 CET	55844	23	192.168.2.23	78.233.6.168
Jan 16, 2025 10:08:00.438363075 CET	23	57514	123.139.21.131	192.168.2.23
Jan 16, 2025 10:08:00.438412905 CET	57514	23	192.168.2.23	123.139.21.131
Jan 16, 2025 10:08:00.438572884 CET	45030	23	192.168.2.23	223.62.82.18
Jan 16, 2025 10:08:00.441339016 CET	23	55844	78.233.6.168	192.168.2.23
Jan 16, 2025 10:08:00.441540003 CET	55844	23	192.168.2.23	78.233.6.168
Jan 16, 2025 10:08:00.442339897 CET	44110	23	192.168.2.23	135.78.147.239
Jan 16, 2025 10:08:00.443408966 CET	23	45030	223.62.82.18	192.168.2.23
Jan 16, 2025 10:08:00.443490982 CET	45030	23	192.168.2.23	223.62.82.18
Jan 16, 2025 10:08:00.445476055 CET	56368	23	192.168.2.23	125.172.163.56
Jan 16, 2025 10:08:00.448421955 CET	23	44110	135.78.147.239	192.168.2.23
Jan 16, 2025 10:08:00.448637009 CET	44110	23	192.168.2.23	135.78.147.239
Jan 16, 2025 10:08:00.448988914 CET	54634	23	192.168.2.23	58.59.199.183
Jan 16, 2025 10:08:00.450283051 CET	23	56368	125.172.163.56	192.168.2.23
Jan 16, 2025 10:08:00.450344086 CET	56368	23	192.168.2.23	125.172.163.56
Jan 16, 2025 10:08:00.453715086 CET	47650	23	192.168.2.23	192.1.151.51
Jan 16, 2025 10:08:00.454641104 CET	23	54634	58.59.199.183	192.168.2.23
Jan 16, 2025 10:08:00.454704046 CET	54634	23	192.168.2.23	58.59.199.183
Jan 16, 2025 10:08:00.458523989 CET	23	47650	192.1.151.51	192.168.2.23
Jan 16, 2025 10:08:00.458607912 CET	47650	23	192.168.2.23	192.1.151.51
Jan 16, 2025 10:08:00.459182024 CET	43258	23	192.168.2.23	155.189.96.205
Jan 16, 2025 10:08:00.464063883 CET	49496	23	192.168.2.23	175.245.108.116
Jan 16, 2025 10:08:00.464092016 CET	23	43258	155.189.96.205	192.168.2.23
Jan 16, 2025 10:08:00.464186907 CET	43258	23	192.168.2.23	155.189.96.205
Jan 16, 2025 10:08:00.468769073 CET	49940	23	192.168.2.23	169.68.173.201
Jan 16, 2025 10:08:00.468894005 CET	23	49496	175.245.108.116	192.168.2.23
Jan 16, 2025 10:08:00.468960047 CET	49496	23	192.168.2.23	175.245.108.116
Jan 16, 2025 10:08:00.473666906 CET	23	49940	169.68.173.201	192.168.2.23
Jan 16, 2025 10:08:00.473751068 CET	49940	23	192.168.2.23	169.68.173.201
Jan 16, 2025 10:08:00.473829031 CET	55600	23	192.168.2.23	180.148.247.202
Jan 16, 2025 10:08:00.478622913 CET	54238	23	192.168.2.23	69.106.231.217
Jan 16, 2025 10:08:00.478635073 CET	23	55600	180.148.247.202	192.168.2.23
Jan 16, 2025 10:08:00.478724957 CET	55600	23	192.168.2.23	180.148.247.202
Jan 16, 2025 10:08:00.483453989 CET	53012	23	192.168.2.23	64.199.252.145
Jan 16, 2025 10:08:00.483480930 CET	23	54238	69.106.231.217	192.168.2.23
Jan 16, 2025 10:08:00.483675957 CET	54238	23	192.168.2.23	69.106.231.217
Jan 16, 2025 10:08:00.488256931 CET	23	53012	64.199.252.145	192.168.2.23
Jan 16, 2025 10:08:00.488529921 CET	53012	23	192.168.2.23	64.199.252.145
Jan 16, 2025 10:08:00.488733053 CET	46806	23	192.168.2.23	113.200.50.238
Jan 16, 2025 10:08:00.492645025 CET	34964	23	192.168.2.23	92.111.127.68
Jan 16, 2025 10:08:00.493509054 CET	23	46806	113.200.50.238	192.168.2.23
Jan 16, 2025 10:08:00.493581057 CET	46806	23	192.168.2.23	113.200.50.238
Jan 16, 2025 10:08:00.497298956 CET	42332	23	192.168.2.23	60.245.196.217
Jan 16, 2025 10:08:00.497457981 CET	23	34964	92.111.127.68	192.168.2.23
Jan 16, 2025 10:08:00.497534037 CET	34964	23	192.168.2.23	92.111.127.68
Jan 16, 2025 10:08:00.501121998 CET	54726	23	192.168.2.23	153.120.211.115
Jan 16, 2025 10:08:00.502187014 CET	23	42332	60.245.196.217	192.168.2.23
Jan 16, 2025 10:08:00.502383947 CET	42332	23	192.168.2.23	60.245.196.217
Jan 16, 2025 10:08:00.505676985 CET	55122	23	192.168.2.23	82.239.3.0
Jan 16, 2025 10:08:00.505916119 CET	23	54726	153.120.211.115	192.168.2.23
Jan 16, 2025 10:08:00.506053925 CET	54726	23	192.168.2.23	153.120.211.115
Jan 16, 2025 10:08:00.510416031 CET	40542	23	192.168.2.23	62.89.250.125
Jan 16, 2025 10:08:00.510714054 CET	23	55122	82.239.3.0	192.168.2.23
Jan 16, 2025 10:08:00.510780096 CET	55122	23	192.168.2.23	82.239.3.0
Jan 16, 2025 10:08:00.515374899 CET	23	40542	62.89.250.125	192.168.2.23
Jan 16, 2025 10:08:00.515503883 CET	40542	23	192.168.2.23	62.89.250.125
Jan 16, 2025 10:08:00.516484022 CET	39064	23	192.168.2.23	105.141.87.121
Jan 16, 2025 10:08:00.521385908 CET	23	39064	105.141.87.121	192.168.2.23
Jan 16, 2025 10:08:00.521490097 CET	39064	23	192.168.2.23	105.141.87.121
Jan 16, 2025 10:08:00.521672964 CET	39368	23	192.168.2.23	79.63.44.249
Jan 16, 2025 10:08:00.526585102 CET	23	39368	79.63.44.249	192.168.2.23
Jan 16, 2025 10:08:00.526637077 CET	39368	23	192.168.2.23	79.63.44.249
Jan 16, 2025 10:08:00.544339895 CET	58954	23	192.168.2.23	107.123.147.139
Jan 16, 2025 10:08:00.548732996 CET	59614	23	192.168.2.23	77.140.75.175
Jan 16, 2025 10:08:00.549230099 CET	23	58954	107.123.147.139	192.168.2.23
Jan 16, 2025 10:08:00.549294949 CET	58954	23	192.168.2.23	107.123.147.139
Jan 16, 2025 10:08:00.552099943 CET	45808	23	192.168.2.23	219.85.164.242
Jan 16, 2025 10:08:00.553704977 CET	23	59614	77.140.75.175	192.168.2.23
Jan 16, 2025 10:08:00.553822994 CET	59614	23	192.168.2.23	77.140.75.175
Jan 16, 2025 10:08:00.554543018 CET	56302	23	192.168.2.23	22.46.168.157
Jan 16, 2025 10:08:00.557004929 CET	23	45808	219.85.164.242	192.168.2.23
Jan 16, 2025 10:08:00.557178974 CET	45808	23	192.168.2.23	219.85.164.242
Jan 16, 2025 10:08:00.558002949 CET	51322	23	192.168.2.23	95.189.208.216
Jan 16, 2025 10:08:00.559349060 CET	23	56302	22.46.168.157	192.168.2.23
Jan 16, 2025 10:08:00.559411049 CET	56302	23	192.168.2.23	22.46.168.157
Jan 16, 2025 10:08:00.561816931 CET	50182	23	192.168.2.23	36.155.83.158
Jan 16, 2025 10:08:00.562989950 CET	23	51322	95.189.208.216	192.168.2.23
Jan 16, 2025 10:08:00.563060999 CET	51322	23	192.168.2.23	95.189.208.216
Jan 16, 2025 10:08:00.564529896 CET	37972	23	192.168.2.23	87.131.240.102
Jan 16, 2025 10:08:00.567159891 CET	37710	23	192.168.2.23	179.167.185.29
Jan 16, 2025 10:08:00.567328930 CET	23	50182	36.155.83.158	192.168.2.23
Jan 16, 2025 10:08:00.567500114 CET	50182	23	192.168.2.23	36.155.83.158
Jan 16, 2025 10:08:00.569448948 CET	23	37972	87.131.240.102	192.168.2.23
Jan 16, 2025 10:08:00.569631100 CET	37972	23	192.168.2.23	87.131.240.102
Jan 16, 2025 10:08:00.569750071 CET	42548	23	192.168.2.23	17.66.150.68
Jan 16, 2025 10:08:00.572609901 CET	23	37710	179.167.185.29	192.168.2.23
Jan 16, 2025 10:08:00.572808027 CET	37710	23	192.168.2.23	179.167.185.29
Jan 16, 2025 10:08:00.574563980 CET	23	42548	17.66.150.68	192.168.2.23
Jan 16, 2025 10:08:00.574712038 CET	42548	23	192.168.2.23	17.66.150.68
Jan 16, 2025 10:08:00.574810982 CET	41192	23	192.168.2.23	167.250.86.177
Jan 16, 2025 10:08:00.579622984 CET	23	41192	167.250.86.177	192.168.2.23
Jan 16, 2025 10:08:00.581397057 CET	41192	23	192.168.2.23	167.250.86.177
Jan 16, 2025 10:08:00.681754112 CET	59354	23	192.168.2.23	109.149.49.165
Jan 16, 2025 10:08:00.686759949 CET	23	59354	109.149.49.165	192.168.2.23
Jan 16, 2025 10:08:00.691421032 CET	59354	23	192.168.2.23	109.149.49.165
Jan 16, 2025 10:08:00.710832119 CET	38776	23	192.168.2.23	96.226.107.239
Jan 16, 2025 10:08:00.714570045 CET	49372	23	192.168.2.23	136.117.137.188
Jan 16, 2025 10:08:00.715739012 CET	23	38776	96.226.107.239	192.168.2.23
Jan 16, 2025 10:08:00.715931892 CET	38776	23	192.168.2.23	96.226.107.239
Jan 16, 2025 10:08:00.719398975 CET	23	49372	136.117.137.188	192.168.2.23
Jan 16, 2025 10:08:00.719460964 CET	49372	23	192.168.2.23	136.117.137.188
Jan 16, 2025 10:08:00.719820023 CET	33232	23	192.168.2.23	94.84.108.227
Jan 16, 2025 10:08:00.724705935 CET	40070	23	192.168.2.23	204.31.131.171
Jan 16, 2025 10:08:00.726135969 CET	23	33232	94.84.108.227	192.168.2.23
Jan 16, 2025 10:08:00.726366997 CET	33232	23	192.168.2.23	94.84.108.227
Jan 16, 2025 10:08:00.729643106 CET	23	40070	204.31.131.171	192.168.2.23
Jan 16, 2025 10:08:00.729692936 CET	40070	23	192.168.2.23	204.31.131.171
Jan 16, 2025 10:08:00.730310917 CET	44128	23	192.168.2.23	9.168.144.37
Jan 16, 2025 10:08:00.736989975 CET	23	44128	9.168.144.37	192.168.2.23
Jan 16, 2025 10:08:00.737056017 CET	44128	23	192.168.2.23	9.168.144.37
Jan 16, 2025 10:08:00.746232033 CET	43818	23	192.168.2.23	172.97.241.230
Jan 16, 2025 10:08:00.751017094 CET	23	43818	172.97.241.230	192.168.2.23
Jan 16, 2025 10:08:00.751096010 CET	43818	23	192.168.2.23	172.97.241.230
Jan 16, 2025 10:08:00.819674969 CET	34046	23	192.168.2.23	207.96.104.20
Jan 16, 2025 10:08:00.824971914 CET	23	34046	207.96.104.20	192.168.2.23
Jan 16, 2025 10:08:00.825174093 CET	34046	23	192.168.2.23	207.96.104.20
Jan 16, 2025 10:08:00.826453924 CET	53366	23	192.168.2.23	22.186.228.168
Jan 16, 2025 10:08:00.831748962 CET	23	53366	22.186.228.168	192.168.2.23
Jan 16, 2025 10:08:00.831952095 CET	53366	23	192.168.2.23	22.186.228.168
Jan 16, 2025 10:08:00.866993904 CET	37898	23	192.168.2.23	171.149.128.47
Jan 16, 2025 10:08:00.872411966 CET	23	37898	171.149.128.47	192.168.2.23
Jan 16, 2025 10:08:00.872505903 CET	37898	23	192.168.2.23	171.149.128.47
Jan 16, 2025 10:08:00.872555971 CET	34410	23	192.168.2.23	88.36.43.49
Jan 16, 2025 10:08:00.877841949 CET	23	34410	88.36.43.49	192.168.2.23
Jan 16, 2025 10:08:00.877962112 CET	34410	23	192.168.2.23	88.36.43.49
Jan 16, 2025 10:08:00.879420042 CET	57136	23	192.168.2.23	185.122.106.177
Jan 16, 2025 10:08:00.885092020 CET	23	57136	185.122.106.177	192.168.2.23
Jan 16, 2025 10:08:00.885215044 CET	57136	23	192.168.2.23	185.122.106.177
Jan 16, 2025 10:08:00.887274981 CET	44154	23	192.168.2.23	195.98.84.132
Jan 16, 2025 10:08:00.892460108 CET	23	44154	195.98.84.132	192.168.2.23
Jan 16, 2025 10:08:00.892538071 CET	44154	23	192.168.2.23	195.98.84.132
Jan 16, 2025 10:08:00.898096085 CET	37824	23	192.168.2.23	130.75.150.117
Jan 16, 2025 10:08:00.903000116 CET	23	37824	130.75.150.117	192.168.2.23
Jan 16, 2025 10:08:00.903104067 CET	37824	23	192.168.2.23	130.75.150.117
Jan 16, 2025 10:08:00.905786991 CET	44890	23	192.168.2.23	117.195.55.22
Jan 16, 2025 10:08:00.910665989 CET	23	44890	117.195.55.22	192.168.2.23
Jan 16, 2025 10:08:00.910815954 CET	44890	23	192.168.2.23	117.195.55.22
Jan 16, 2025 10:08:00.915448904 CET	38042	23	192.168.2.23	73.255.36.149
Jan 16, 2025 10:08:00.920278072 CET	23	38042	73.255.36.149	192.168.2.23
Jan 16, 2025 10:08:00.920509100 CET	38042	23	192.168.2.23	73.255.36.149
Jan 16, 2025 10:08:00.925406933 CET	51670	23	192.168.2.23	78.13.241.204
Jan 16, 2025 10:08:00.930247068 CET	23	51670	78.13.241.204	192.168.2.23
Jan 16, 2025 10:08:00.930313110 CET	51670	23	192.168.2.23	78.13.241.204
Jan 16, 2025 10:08:01.005470991 CET	55946	23	192.168.2.23	223.108.109.113
Jan 16, 2025 10:08:01.010375023 CET	23	55946	223.108.109.113	192.168.2.23
Jan 16, 2025 10:08:01.011286020 CET	55946	23	192.168.2.23	223.108.109.113
Jan 16, 2025 10:08:01.076133013 CET	32890	23	192.168.2.23	162.119.255.200
Jan 16, 2025 10:08:01.081116915 CET	23	32890	162.119.255.200	192.168.2.23
Jan 16, 2025 10:08:01.081379890 CET	32890	23	192.168.2.23	162.119.255.200
Jan 16, 2025 10:08:01.121386051 CET	39830	23	192.168.2.23	160.212.237.60
Jan 16, 2025 10:08:01.126274109 CET	23	39830	160.212.237.60	192.168.2.23
Jan 16, 2025 10:08:01.126406908 CET	39830	23	192.168.2.23	160.212.237.60
Jan 16, 2025 10:08:01.390458107 CET	42516	80	192.168.2.23	109.202.202.202
Jan 16, 2025 10:08:01.643987894 CET	38042	23	192.168.2.23	73.255.36.149
Jan 16, 2025 10:08:01.643990993 CET	51670	23	192.168.2.23	78.13.241.204
Jan 16, 2025 10:08:01.643990993 CET	55946	23	192.168.2.23	223.108.109.113
Jan 16, 2025 10:08:01.644012928 CET	32890	23	192.168.2.23	162.119.255.200
Jan 16, 2025 10:08:01.644012928 CET	37824	23	192.168.2.23	130.75.150.117
Jan 16, 2025 10:08:01.644021988 CET	44154	23	192.168.2.23	195.98.84.132
Jan 16, 2025 10:08:01.644093990 CET	39830	23	192.168.2.23	160.212.237.60
Jan 16, 2025 10:08:01.644093990 CET	44890	23	192.168.2.23	117.195.55.22
Jan 16, 2025 10:08:01.644175053 CET	57136	23	192.168.2.23	185.122.106.177
Jan 16, 2025 10:08:01.644186020 CET	34410	23	192.168.2.23	88.36.43.49
Jan 16, 2025 10:08:01.644221067 CET	40070	23	192.168.2.23	204.31.131.171
Jan 16, 2025 10:08:01.644237041 CET	43818	23	192.168.2.23	172.97.241.230
Jan 16, 2025 10:08:01.644237995 CET	44128	23	192.168.2.23	9.168.144.37
Jan 16, 2025 10:08:01.644237995 CET	49372	23	192.168.2.23	136.117.137.188
Jan 16, 2025 10:08:01.644256115 CET	53366	23	192.168.2.23	22.186.228.168
Jan 16, 2025 10:08:01.644256115 CET	34046	23	192.168.2.23	207.96.104.20
Jan 16, 2025 10:08:01.644268990 CET	37710	23	192.168.2.23	179.167.185.29
Jan 16, 2025 10:08:01.644273996 CET	59354	23	192.168.2.23	109.149.49.165
Jan 16, 2025 10:08:01.644273996 CET	42548	23	192.168.2.23	17.66.150.68
Jan 16, 2025 10:08:01.644277096 CET	41192	23	192.168.2.23	167.250.86.177
Jan 16, 2025 10:08:01.644277096 CET	37972	23	192.168.2.23	87.131.240.102
Jan 16, 2025 10:08:01.644277096 CET	50182	23	192.168.2.23	36.155.83.158
Jan 16, 2025 10:08:01.644301891 CET	51322	23	192.168.2.23	95.189.208.216
Jan 16, 2025 10:08:01.644308090 CET	56302	23	192.168.2.23	22.46.168.157
Jan 16, 2025 10:08:01.644308090 CET	58954	23	192.168.2.23	107.123.147.139
Jan 16, 2025 10:08:01.644316912 CET	45808	23	192.168.2.23	219.85.164.242
Jan 16, 2025 10:08:01.644318104 CET	39064	23	192.168.2.23	105.141.87.121
Jan 16, 2025 10:08:01.644329071 CET	39368	23	192.168.2.23	79.63.44.249
Jan 16, 2025 10:08:01.644329071 CET	40542	23	192.168.2.23	62.89.250.125
Jan 16, 2025 10:08:01.644351006 CET	59614	23	192.168.2.23	77.140.75.175
Jan 16, 2025 10:08:01.644352913 CET	54726	23	192.168.2.23	153.120.211.115
Jan 16, 2025 10:08:01.644351006 CET	37898	23	192.168.2.23	171.149.128.47
Jan 16, 2025 10:08:01.644351006 CET	33232	23	192.168.2.23	94.84.108.227
Jan 16, 2025 10:08:01.644360065 CET	55122	23	192.168.2.23	82.239.3.0
Jan 16, 2025 10:08:01.644351006 CET	38776	23	192.168.2.23	96.226.107.239
Jan 16, 2025 10:08:01.644360065 CET	46806	23	192.168.2.23	113.200.50.238
Jan 16, 2025 10:08:01.644351006 CET	42332	23	192.168.2.23	60.245.196.217
Jan 16, 2025 10:08:01.644360065 CET	34964	23	192.168.2.23	92.111.127.68
Jan 16, 2025 10:08:01.644372940 CET	53012	23	192.168.2.23	64.199.252.145
Jan 16, 2025 10:08:01.644376993 CET	55600	23	192.168.2.23	180.148.247.202
Jan 16, 2025 10:08:01.644395113 CET	47650	23	192.168.2.23	192.1.151.51
Jan 16, 2025 10:08:01.644393921 CET	54634	23	192.168.2.23	58.59.199.183
Jan 16, 2025 10:08:01.644393921 CET	56368	23	192.168.2.23	125.172.163.56
Jan 16, 2025 10:08:01.644403934 CET	43258	23	192.168.2.23	155.189.96.205
Jan 16, 2025 10:08:01.644414902 CET	45030	23	192.168.2.23	223.62.82.18
Jan 16, 2025 10:08:01.644423008 CET	57514	23	192.168.2.23	123.139.21.131
Jan 16, 2025 10:08:01.644427061 CET	49496	23	192.168.2.23	175.245.108.116
Jan 16, 2025 10:08:01.644440889 CET	54238	23	192.168.2.23	69.106.231.217
Jan 16, 2025 10:08:01.644440889 CET	44110	23	192.168.2.23	135.78.147.239
Jan 16, 2025 10:08:01.644447088 CET	60048	23	192.168.2.23	16.222.131.116
Jan 16, 2025 10:08:01.644447088 CET	40124	23	192.168.2.23	192.200.193.98
Jan 16, 2025 10:08:01.644447088 CET	45970	23	192.168.2.23	59.146.16.253
Jan 16, 2025 10:08:01.644469976 CET	60794	23	192.168.2.23	31.224.192.197
Jan 16, 2025 10:08:01.644474030 CET	39136	23	192.168.2.23	53.12.235.175
Jan 16, 2025 10:08:01.644504070 CET	47290	23	192.168.2.23	16.41.168.171
Jan 16, 2025 10:08:01.644504070 CET	46060	23	192.168.2.23	23.167.216.82
Jan 16, 2025 10:08:01.644515038 CET	45576	23	192.168.2.23	57.37.248.236
Jan 16, 2025 10:08:01.644515038 CET	52006	23	192.168.2.23	1.94.24.162
Jan 16, 2025 10:08:01.644510984 CET	49940	23	192.168.2.23	169.68.173.201
Jan 16, 2025 10:08:01.644510984 CET	55844	23	192.168.2.23	78.233.6.168
Jan 16, 2025 10:08:01.644510984 CET	37598	23	192.168.2.23	151.213.185.105
Jan 16, 2025 10:08:01.644541025 CET	57490	23	192.168.2.23	114.136.46.199
Jan 16, 2025 10:08:01.644562006 CET	48474	23	192.168.2.23	31.77.229.189
Jan 16, 2025 10:08:01.644572020 CET	43220	23	192.168.2.23	8.73.198.154
Jan 16, 2025 10:08:01.644572973 CET	46076	23	192.168.2.23	142.69.147.227
Jan 16, 2025 10:08:01.644576073 CET	46658	23	192.168.2.23	21.143.205.29
Jan 16, 2025 10:08:01.644576073 CET	52422	23	192.168.2.23	131.6.87.96
Jan 16, 2025 10:08:01.644589901 CET	36976	23	192.168.2.23	128.225.196.0
Jan 16, 2025 10:08:01.644589901 CET	42006	23	192.168.2.23	9.127.231.60
Jan 16, 2025 10:08:01.644592047 CET	49914	23	192.168.2.23	77.92.122.150
Jan 16, 2025 10:08:01.644592047 CET	57746	23	192.168.2.23	151.98.26.75
Jan 16, 2025 10:08:01.644608021 CET	48064	23	192.168.2.23	87.182.46.212
Jan 16, 2025 10:08:01.644608021 CET	36202	23	192.168.2.23	53.4.27.186
Jan 16, 2025 10:08:01.644608974 CET	54266	23	192.168.2.23	94.33.49.177
Jan 16, 2025 10:08:01.644608974 CET	52436	23	192.168.2.23	215.104.57.111
Jan 16, 2025 10:08:01.644608974 CET	40778	23	192.168.2.23	166.62.19.57
Jan 16, 2025 10:08:01.644620895 CET	49018	23	192.168.2.23	198.230.152.48
Jan 16, 2025 10:08:01.644620895 CET	60180	23	192.168.2.23	92.139.122.43
Jan 16, 2025 10:08:01.644622087 CET	53514	23	192.168.2.23	95.245.107.140
Jan 16, 2025 10:08:01.644630909 CET	51066	23	192.168.2.23	4.29.47.57
Jan 16, 2025 10:08:01.644635916 CET	45660	23	192.168.2.23	218.194.162.79
Jan 16, 2025 10:08:01.644654989 CET	40936	23	192.168.2.23	154.117.126.163
Jan 16, 2025 10:08:01.644670963 CET	51042	23	192.168.2.23	117.8.74.246
Jan 16, 2025 10:08:01.644670963 CET	57424	23	192.168.2.23	213.215.207.140
Jan 16, 2025 10:08:01.644673109 CET	41102	23	192.168.2.23	105.11.159.93
Jan 16, 2025 10:08:01.644676924 CET	47152	23	192.168.2.23	53.136.240.85
Jan 16, 2025 10:08:01.644704103 CET	36624	23	192.168.2.23	53.76.86.4
Jan 16, 2025 10:08:01.644704103 CET	50482	23	192.168.2.23	33.8.211.162
Jan 16, 2025 10:08:01.644704103 CET	37022	23	192.168.2.23	80.238.222.227
Jan 16, 2025 10:08:01.644751072 CET	52108	23	192.168.2.23	147.164.197.16
Jan 16, 2025 10:08:01.644751072 CET	54224	23	192.168.2.23	145.108.117.215
Jan 16, 2025 10:08:01.648828030 CET	23	38042	73.255.36.149	192.168.2.23
Jan 16, 2025 10:08:01.648937941 CET	38042	23	192.168.2.23	73.255.36.149
Jan 16, 2025 10:08:01.649161100 CET	23	51670	78.13.241.204	192.168.2.23
Jan 16, 2025 10:08:01.649168015 CET	23	55946	223.108.109.113	192.168.2.23
Jan 16, 2025 10:08:01.649182081 CET	23	32890	162.119.255.200	192.168.2.23
Jan 16, 2025 10:08:01.649188042 CET	23	37824	130.75.150.117	192.168.2.23
Jan 16, 2025 10:08:01.649204016 CET	23	44154	195.98.84.132	192.168.2.23
Jan 16, 2025 10:08:01.649210930 CET	23	39830	160.212.237.60	192.168.2.23
Jan 16, 2025 10:08:01.649216890 CET	23	44890	117.195.55.22	192.168.2.23
Jan 16, 2025 10:08:01.649218082 CET	51670	23	192.168.2.23	78.13.241.204
Jan 16, 2025 10:08:01.649219036 CET	55946	23	192.168.2.23	223.108.109.113
Jan 16, 2025 10:08:01.649241924 CET	23	57136	185.122.106.177	192.168.2.23
Jan 16, 2025 10:08:01.649249077 CET	23	34410	88.36.43.49	192.168.2.23
Jan 16, 2025 10:08:01.649255991 CET	44154	23	192.168.2.23	195.98.84.132
Jan 16, 2025 10:08:01.649272919 CET	32890	23	192.168.2.23	162.119.255.200
Jan 16, 2025 10:08:01.649272919 CET	37824	23	192.168.2.23	130.75.150.117
Jan 16, 2025 10:08:01.649317026 CET	57136	23	192.168.2.23	185.122.106.177
Jan 16, 2025 10:08:01.649317026 CET	34410	23	192.168.2.23	88.36.43.49
Jan 16, 2025 10:08:01.649379969 CET	39830	23	192.168.2.23	160.212.237.60
Jan 16, 2025 10:08:01.649380922 CET	44890	23	192.168.2.23	117.195.55.22
Jan 16, 2025 10:08:01.649970055 CET	23	40070	204.31.131.171	192.168.2.23
Jan 16, 2025 10:08:01.649981976 CET	23	43818	172.97.241.230	192.168.2.23
Jan 16, 2025 10:08:01.649983883 CET	23	44128	9.168.144.37	192.168.2.23
Jan 16, 2025 10:08:01.649986029 CET	23	49372	136.117.137.188	192.168.2.23
Jan 16, 2025 10:08:01.649995089 CET	23	53366	22.186.228.168	192.168.2.23
Jan 16, 2025 10:08:01.649996996 CET	23	34046	207.96.104.20	192.168.2.23
Jan 16, 2025 10:08:01.650003910 CET	23	37710	179.167.185.29	192.168.2.23
Jan 16, 2025 10:08:01.650007010 CET	23	59354	109.149.49.165	192.168.2.23
Jan 16, 2025 10:08:01.650013924 CET	23	42548	17.66.150.68	192.168.2.23
Jan 16, 2025 10:08:01.650017977 CET	23	41192	167.250.86.177	192.168.2.23
Jan 16, 2025 10:08:01.650022030 CET	23	37972	87.131.240.102	192.168.2.23
Jan 16, 2025 10:08:01.650028944 CET	23	51322	95.189.208.216	192.168.2.23
Jan 16, 2025 10:08:01.650029898 CET	44128	23	192.168.2.23	9.168.144.37
Jan 16, 2025 10:08:01.650031090 CET	43818	23	192.168.2.23	172.97.241.230
Jan 16, 2025 10:08:01.650031090 CET	49372	23	192.168.2.23	136.117.137.188
Jan 16, 2025 10:08:01.650042057 CET	23	50182	36.155.83.158	192.168.2.23
Jan 16, 2025 10:08:01.650049925 CET	37710	23	192.168.2.23	179.167.185.29
Jan 16, 2025 10:08:01.650052071 CET	40070	23	192.168.2.23	204.31.131.171
Jan 16, 2025 10:08:01.650074005 CET	23	56302	22.46.168.157	192.168.2.23
Jan 16, 2025 10:08:01.650077105 CET	42548	23	192.168.2.23	17.66.150.68
Jan 16, 2025 10:08:01.650077105 CET	59354	23	192.168.2.23	109.149.49.165
Jan 16, 2025 10:08:01.650077105 CET	51322	23	192.168.2.23	95.189.208.216
Jan 16, 2025 10:08:01.650080919 CET	23	58954	107.123.147.139	192.168.2.23
Jan 16, 2025 10:08:01.650094986 CET	23	45808	219.85.164.242	192.168.2.23
Jan 16, 2025 10:08:01.650100946 CET	23	39064	105.141.87.121	192.168.2.23
Jan 16, 2025 10:08:01.650114059 CET	23	39368	79.63.44.249	192.168.2.23
Jan 16, 2025 10:08:01.650120020 CET	23	40542	62.89.250.125	192.168.2.23
Jan 16, 2025 10:08:01.650125027 CET	23	54726	153.120.211.115	192.168.2.23
Jan 16, 2025 10:08:01.650130987 CET	23	59614	77.140.75.175	192.168.2.23
Jan 16, 2025 10:08:01.650132895 CET	56302	23	192.168.2.23	22.46.168.157
Jan 16, 2025 10:08:01.650132895 CET	58954	23	192.168.2.23	107.123.147.139
Jan 16, 2025 10:08:01.650135994 CET	23	55122	82.239.3.0	192.168.2.23
Jan 16, 2025 10:08:01.650141954 CET	53366	23	192.168.2.23	22.186.228.168
Jan 16, 2025 10:08:01.650150061 CET	23	46806	113.200.50.238	192.168.2.23
Jan 16, 2025 10:08:01.650141954 CET	34046	23	192.168.2.23	207.96.104.20
Jan 16, 2025 10:08:01.650158882 CET	39064	23	192.168.2.23	105.141.87.121
Jan 16, 2025 10:08:01.650158882 CET	41192	23	192.168.2.23	167.250.86.177
Jan 16, 2025 10:08:01.650160074 CET	37972	23	192.168.2.23	87.131.240.102
Jan 16, 2025 10:08:01.650160074 CET	50182	23	192.168.2.23	36.155.83.158
Jan 16, 2025 10:08:01.650160074 CET	45808	23	192.168.2.23	219.85.164.242
Jan 16, 2025 10:08:01.650166988 CET	23	34964	92.111.127.68	192.168.2.23
Jan 16, 2025 10:08:01.650167942 CET	54726	23	192.168.2.23	153.120.211.115
Jan 16, 2025 10:08:01.650176048 CET	23	53012	64.199.252.145	192.168.2.23
Jan 16, 2025 10:08:01.650185108 CET	39368	23	192.168.2.23	79.63.44.249
Jan 16, 2025 10:08:01.650185108 CET	40542	23	192.168.2.23	62.89.250.125
Jan 16, 2025 10:08:01.650185108 CET	55122	23	192.168.2.23	82.239.3.0
Jan 16, 2025 10:08:01.650187969 CET	23	55600	180.148.247.202	192.168.2.23
Jan 16, 2025 10:08:01.650185108 CET	46806	23	192.168.2.23	113.200.50.238
Jan 16, 2025 10:08:01.650201082 CET	23	47650	192.1.151.51	192.168.2.23
Jan 16, 2025 10:08:01.650207043 CET	23	54634	58.59.199.183	192.168.2.23
Jan 16, 2025 10:08:01.650213957 CET	59614	23	192.168.2.23	77.140.75.175
Jan 16, 2025 10:08:01.650221109 CET	23	56368	125.172.163.56	192.168.2.23
Jan 16, 2025 10:08:01.650223017 CET	23	37898	171.149.128.47	192.168.2.23
Jan 16, 2025 10:08:01.650228024 CET	34964	23	192.168.2.23	92.111.127.68
Jan 16, 2025 10:08:01.650230885 CET	53012	23	192.168.2.23	64.199.252.145
Jan 16, 2025 10:08:01.650233030 CET	47650	23	192.168.2.23	192.1.151.51
Jan 16, 2025 10:08:01.650235891 CET	55600	23	192.168.2.23	180.148.247.202
Jan 16, 2025 10:08:01.650255919 CET	23	43258	155.189.96.205	192.168.2.23
Jan 16, 2025 10:08:01.650259018 CET	54634	23	192.168.2.23	58.59.199.183
Jan 16, 2025 10:08:01.650259018 CET	56368	23	192.168.2.23	125.172.163.56
Jan 16, 2025 10:08:01.650265932 CET	23	33232	94.84.108.227	192.168.2.23
Jan 16, 2025 10:08:01.650315046 CET	43258	23	192.168.2.23	155.189.96.205
Jan 16, 2025 10:08:01.650405884 CET	37898	23	192.168.2.23	171.149.128.47
Jan 16, 2025 10:08:01.650405884 CET	33232	23	192.168.2.23	94.84.108.227
Jan 16, 2025 10:08:01.651472092 CET	23	54224	145.108.117.215	192.168.2.23
Jan 16, 2025 10:08:01.651478052 CET	23	52108	147.164.197.16	192.168.2.23
Jan 16, 2025 10:08:01.651490927 CET	23	37022	80.238.222.227	192.168.2.23
Jan 16, 2025 10:08:01.651496887 CET	23	50482	33.8.211.162	192.168.2.23
Jan 16, 2025 10:08:01.651501894 CET	23	36624	53.76.86.4	192.168.2.23
Jan 16, 2025 10:08:01.651514053 CET	23	47152	53.136.240.85	192.168.2.23
Jan 16, 2025 10:08:01.651532888 CET	23	57424	213.215.207.140	192.168.2.23
Jan 16, 2025 10:08:01.651536942 CET	23	41102	105.11.159.93	192.168.2.23
Jan 16, 2025 10:08:01.651539087 CET	23	51042	117.8.74.246	192.168.2.23
Jan 16, 2025 10:08:01.651546955 CET	23	40936	154.117.126.163	192.168.2.23
Jan 16, 2025 10:08:01.651550055 CET	23	40778	166.62.19.57	192.168.2.23
Jan 16, 2025 10:08:01.651551962 CET	23	52436	215.104.57.111	192.168.2.23
Jan 16, 2025 10:08:01.651555061 CET	23	54266	94.33.49.177	192.168.2.23
Jan 16, 2025 10:08:01.651568890 CET	23	36202	53.4.27.186	192.168.2.23
Jan 16, 2025 10:08:01.651576042 CET	23	45660	218.194.162.79	192.168.2.23
Jan 16, 2025 10:08:01.651588917 CET	23	51066	4.29.47.57	192.168.2.23
Jan 16, 2025 10:08:01.651595116 CET	23	48064	87.182.46.212	192.168.2.23
Jan 16, 2025 10:08:01.651601076 CET	23	53514	95.245.107.140	192.168.2.23
Jan 16, 2025 10:08:01.651607037 CET	23	60180	92.139.122.43	192.168.2.23
Jan 16, 2025 10:08:01.651618958 CET	23	49018	198.230.152.48	192.168.2.23
Jan 16, 2025 10:08:01.651623964 CET	23	57746	151.98.26.75	192.168.2.23
Jan 16, 2025 10:08:01.651635885 CET	23	49914	77.92.122.150	192.168.2.23
Jan 16, 2025 10:08:01.651642084 CET	23	42006	9.127.231.60	192.168.2.23
Jan 16, 2025 10:08:01.651653051 CET	23	36976	128.225.196.0	192.168.2.23
Jan 16, 2025 10:08:01.651659012 CET	23	52422	131.6.87.96	192.168.2.23
Jan 16, 2025 10:08:01.651669979 CET	23	46658	21.143.205.29	192.168.2.23
Jan 16, 2025 10:08:01.651684046 CET	23	46076	142.69.147.227	192.168.2.23
Jan 16, 2025 10:08:01.651688099 CET	23	43220	8.73.198.154	192.168.2.23
Jan 16, 2025 10:08:01.651690006 CET	23	48474	31.77.229.189	192.168.2.23
Jan 16, 2025 10:08:01.651693106 CET	23	37598	151.213.185.105	192.168.2.23
Jan 16, 2025 10:08:01.651705980 CET	23	55844	78.233.6.168	192.168.2.23
Jan 16, 2025 10:08:01.651711941 CET	23	49940	169.68.173.201	192.168.2.23
Jan 16, 2025 10:08:01.651716948 CET	23	57490	114.136.46.199	192.168.2.23
Jan 16, 2025 10:08:01.651725054 CET	23	52006	1.94.24.162	192.168.2.23
Jan 16, 2025 10:08:01.651741028 CET	23	45576	57.37.248.236	192.168.2.23
Jan 16, 2025 10:08:01.651746988 CET	23	46060	23.167.216.82	192.168.2.23
Jan 16, 2025 10:08:01.651751995 CET	23	47290	16.41.168.171	192.168.2.23
Jan 16, 2025 10:08:01.651757956 CET	23	39136	53.12.235.175	192.168.2.23
Jan 16, 2025 10:08:01.651770115 CET	23	60794	31.224.192.197	192.168.2.23
Jan 16, 2025 10:08:01.651774883 CET	23	45970	59.146.16.253	192.168.2.23
Jan 16, 2025 10:08:01.651787996 CET	23	40124	192.200.193.98	192.168.2.23
Jan 16, 2025 10:08:01.651793003 CET	23	60048	16.222.131.116	192.168.2.23
Jan 16, 2025 10:08:01.651807070 CET	23	44110	135.78.147.239	192.168.2.23
Jan 16, 2025 10:08:01.651813030 CET	23	54238	69.106.231.217	192.168.2.23
Jan 16, 2025 10:08:01.651818991 CET	23	49496	175.245.108.116	192.168.2.23
Jan 16, 2025 10:08:01.651832104 CET	23	57514	123.139.21.131	192.168.2.23
Jan 16, 2025 10:08:01.651838064 CET	23	42332	60.245.196.217	192.168.2.23
Jan 16, 2025 10:08:01.651849985 CET	23	45030	223.62.82.18	192.168.2.23
Jan 16, 2025 10:08:01.651854992 CET	23	38776	96.226.107.239	192.168.2.23
Jan 16, 2025 10:08:01.651869059 CET	23	38776	96.226.107.239	192.168.2.23
Jan 16, 2025 10:08:01.651873112 CET	23	45030	223.62.82.18	192.168.2.23
Jan 16, 2025 10:08:01.651885033 CET	23	42332	60.245.196.217	192.168.2.23
Jan 16, 2025 10:08:01.651890039 CET	23	57514	123.139.21.131	192.168.2.23
Jan 16, 2025 10:08:01.651901007 CET	23	49496	175.245.108.116	192.168.2.23
Jan 16, 2025 10:08:01.651916981 CET	23	54238	69.106.231.217	192.168.2.23
Jan 16, 2025 10:08:01.651938915 CET	23	44110	135.78.147.239	192.168.2.23
Jan 16, 2025 10:08:01.651942015 CET	57514	23	192.168.2.23	123.139.21.131
Jan 16, 2025 10:08:01.651942968 CET	45030	23	192.168.2.23	223.62.82.18
Jan 16, 2025 10:08:01.651952982 CET	23	60048	16.222.131.116	192.168.2.23
Jan 16, 2025 10:08:01.651957989 CET	23	40124	192.200.193.98	192.168.2.23
Jan 16, 2025 10:08:01.651963949 CET	23	45970	59.146.16.253	192.168.2.23
Jan 16, 2025 10:08:01.651968002 CET	23	60794	31.224.192.197	192.168.2.23
Jan 16, 2025 10:08:01.651973009 CET	23	39136	53.12.235.175	192.168.2.23
Jan 16, 2025 10:08:01.651978016 CET	23	47290	16.41.168.171	192.168.2.23
Jan 16, 2025 10:08:01.651985884 CET	60048	23	192.168.2.23	16.222.131.116
Jan 16, 2025 10:08:01.651988029 CET	40124	23	192.168.2.23	192.200.193.98
Jan 16, 2025 10:08:01.651999950 CET	45970	23	192.168.2.23	59.146.16.253
Jan 16, 2025 10:08:01.651999950 CET	49496	23	192.168.2.23	175.245.108.116
Jan 16, 2025 10:08:01.651999950 CET	60794	23	192.168.2.23	31.224.192.197
Jan 16, 2025 10:08:01.652014971 CET	23	46060	23.167.216.82	192.168.2.23
Jan 16, 2025 10:08:01.652020931 CET	23	45576	57.37.248.236	192.168.2.23
Jan 16, 2025 10:08:01.652033091 CET	23	52006	1.94.24.162	192.168.2.23
Jan 16, 2025 10:08:01.652038097 CET	23	57490	114.136.46.199	192.168.2.23
Jan 16, 2025 10:08:01.652039051 CET	47290	23	192.168.2.23	16.41.168.171
Jan 16, 2025 10:08:01.652051926 CET	23	49940	169.68.173.201	192.168.2.23
Jan 16, 2025 10:08:01.652056932 CET	23	55844	78.233.6.168	192.168.2.23
Jan 16, 2025 10:08:01.652056932 CET	38776	23	192.168.2.23	96.226.107.239
Jan 16, 2025 10:08:01.652056932 CET	42332	23	192.168.2.23	60.245.196.217
Jan 16, 2025 10:08:01.652056932 CET	54238	23	192.168.2.23	69.106.231.217
Jan 16, 2025 10:08:01.652056932 CET	44110	23	192.168.2.23	135.78.147.239
Jan 16, 2025 10:08:01.652067900 CET	23	37598	151.213.185.105	192.168.2.23
Jan 16, 2025 10:08:01.652057886 CET	39136	23	192.168.2.23	53.12.235.175
Jan 16, 2025 10:08:01.652069092 CET	46060	23	192.168.2.23	23.167.216.82
Jan 16, 2025 10:08:01.652077913 CET	45576	23	192.168.2.23	57.37.248.236
Jan 16, 2025 10:08:01.652081966 CET	23	48474	31.77.229.189	192.168.2.23
Jan 16, 2025 10:08:01.652085066 CET	23	43220	8.73.198.154	192.168.2.23
Jan 16, 2025 10:08:01.652092934 CET	23	46076	142.69.147.227	192.168.2.23
Jan 16, 2025 10:08:01.652096987 CET	23	46658	21.143.205.29	192.168.2.23
Jan 16, 2025 10:08:01.652100086 CET	57490	23	192.168.2.23	114.136.46.199
Jan 16, 2025 10:08:01.652112007 CET	52006	23	192.168.2.23	1.94.24.162
Jan 16, 2025 10:08:01.652116060 CET	23	52422	131.6.87.96	192.168.2.23
Jan 16, 2025 10:08:01.652117968 CET	23	36976	128.225.196.0	192.168.2.23
Jan 16, 2025 10:08:01.652120113 CET	23	42006	9.127.231.60	192.168.2.23
Jan 16, 2025 10:08:01.652120113 CET	49940	23	192.168.2.23	169.68.173.201
Jan 16, 2025 10:08:01.652120113 CET	55844	23	192.168.2.23	78.233.6.168
Jan 16, 2025 10:08:01.652122974 CET	23	49914	77.92.122.150	192.168.2.23
Jan 16, 2025 10:08:01.652124882 CET	23	57746	151.98.26.75	192.168.2.23
Jan 16, 2025 10:08:01.652127028 CET	23	49018	198.230.152.48	192.168.2.23
Jan 16, 2025 10:08:01.652134895 CET	43220	23	192.168.2.23	8.73.198.154
Jan 16, 2025 10:08:01.652148008 CET	23	60180	92.139.122.43	192.168.2.23
Jan 16, 2025 10:08:01.652148008 CET	46658	23	192.168.2.23	21.143.205.29
Jan 16, 2025 10:08:01.652148008 CET	52422	23	192.168.2.23	131.6.87.96
Jan 16, 2025 10:08:01.652148008 CET	36976	23	192.168.2.23	128.225.196.0
Jan 16, 2025 10:08:01.652153015 CET	48474	23	192.168.2.23	31.77.229.189
Jan 16, 2025 10:08:01.652153969 CET	23	53514	95.245.107.140	192.168.2.23
Jan 16, 2025 10:08:01.652153969 CET	46076	23	192.168.2.23	142.69.147.227
Jan 16, 2025 10:08:01.652154922 CET	37598	23	192.168.2.23	151.213.185.105
Jan 16, 2025 10:08:01.652154922 CET	49914	23	192.168.2.23	77.92.122.150
Jan 16, 2025 10:08:01.652159929 CET	23	48064	87.182.46.212	192.168.2.23
Jan 16, 2025 10:08:01.652160883 CET	42006	23	192.168.2.23	9.127.231.60
Jan 16, 2025 10:08:01.652160883 CET	49018	23	192.168.2.23	198.230.152.48
Jan 16, 2025 10:08:01.652172089 CET	23	51066	4.29.47.57	192.168.2.23
Jan 16, 2025 10:08:01.652175903 CET	57746	23	192.168.2.23	151.98.26.75
Jan 16, 2025 10:08:01.652177095 CET	23	45660	218.194.162.79	192.168.2.23
Jan 16, 2025 10:08:01.652190924 CET	23	36202	53.4.27.186	192.168.2.23
Jan 16, 2025 10:08:01.652195930 CET	23	54266	94.33.49.177	192.168.2.23
Jan 16, 2025 10:08:01.652209044 CET	23	52436	215.104.57.111	192.168.2.23
Jan 16, 2025 10:08:01.652214050 CET	23	40778	166.62.19.57	192.168.2.23
Jan 16, 2025 10:08:01.652219057 CET	23	40936	154.117.126.163	192.168.2.23
Jan 16, 2025 10:08:01.652224064 CET	23	51042	117.8.74.246	192.168.2.23
Jan 16, 2025 10:08:01.652224064 CET	51066	23	192.168.2.23	4.29.47.57
Jan 16, 2025 10:08:01.652223110 CET	48064	23	192.168.2.23	87.182.46.212
Jan 16, 2025 10:08:01.652235985 CET	23	41102	105.11.159.93	192.168.2.23
Jan 16, 2025 10:08:01.652241945 CET	23	57424	213.215.207.140	192.168.2.23
Jan 16, 2025 10:08:01.652254105 CET	23	47152	53.136.240.85	192.168.2.23
Jan 16, 2025 10:08:01.652259111 CET	36202	23	192.168.2.23	53.4.27.186
Jan 16, 2025 10:08:01.652259111 CET	23	36624	53.76.86.4	192.168.2.23
Jan 16, 2025 10:08:01.652259111 CET	52436	23	192.168.2.23	215.104.57.111
Jan 16, 2025 10:08:01.652266979 CET	51042	23	192.168.2.23	117.8.74.246
Jan 16, 2025 10:08:01.652268887 CET	60180	23	192.168.2.23	92.139.122.43
Jan 16, 2025 10:08:01.652278900 CET	23	50482	33.8.211.162	192.168.2.23
Jan 16, 2025 10:08:01.652283907 CET	23	37022	80.238.222.227	192.168.2.23
Jan 16, 2025 10:08:01.652290106 CET	23	52108	147.164.197.16	192.168.2.23
Jan 16, 2025 10:08:01.652293921 CET	53514	23	192.168.2.23	95.245.107.140
Jan 16, 2025 10:08:01.652295113 CET	54266	23	192.168.2.23	94.33.49.177
Jan 16, 2025 10:08:01.652293921 CET	45660	23	192.168.2.23	218.194.162.79
Jan 16, 2025 10:08:01.652295113 CET	40778	23	192.168.2.23	166.62.19.57
Jan 16, 2025 10:08:01.652295113 CET	40936	23	192.168.2.23	154.117.126.163
Jan 16, 2025 10:08:01.652295113 CET	41102	23	192.168.2.23	105.11.159.93
Jan 16, 2025 10:08:01.652307034 CET	57424	23	192.168.2.23	213.215.207.140
Jan 16, 2025 10:08:01.652312040 CET	47152	23	192.168.2.23	53.136.240.85
Jan 16, 2025 10:08:01.652322054 CET	23	54224	145.108.117.215	192.168.2.23
Jan 16, 2025 10:08:01.652348995 CET	36624	23	192.168.2.23	53.76.86.4
Jan 16, 2025 10:08:01.652348995 CET	50482	23	192.168.2.23	33.8.211.162
Jan 16, 2025 10:08:01.652348995 CET	37022	23	192.168.2.23	80.238.222.227
Jan 16, 2025 10:08:01.652451038 CET	52108	23	192.168.2.23	147.164.197.16
Jan 16, 2025 10:08:01.652715921 CET	54224	23	192.168.2.23	145.108.117.215
Jan 16, 2025 10:08:16.492423058 CET	43928	443	192.168.2.23	91.189.91.42
Jan 16, 2025 10:08:26.731086016 CET	42836	443	192.168.2.23	91.189.91.43
Jan 16, 2025 10:08:30.826580048 CET	42516	80	192.168.2.23	109.202.202.202
Jan 16, 2025 10:08:57.446793079 CET	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 10:08:00.225383043 CET	55787	53	192.168.2.23	1.1.1.1
Jan 16, 2025 10:08:00.232450962 CET	53	55787	1.1.1.1	192.168.2.23
Jan 16, 2025 10:08:00.233011007 CET	43211	19302	192.168.2.23	74.125.250.129
Jan 16, 2025 10:08:00.684525013 CET	19302	43211	74.125.250.129	192.168.2.23
Jan 16, 2025 10:08:00.709697008 CET	47441	53	192.168.2.23	1.1.1.1
Jan 16, 2025 10:08:00.718610048 CET	53	47441	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 10:08:00.225383043 CET	192.168.2.23	1.1.1.1	0xd616	Standard query (0)	stun.l.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 10:08:00.232450962 CET	1.1.1.1	192.168.2.23	0xd616	No error (0)	stun.l.google.com	74.125.250.129	A (IP address)	IN (0x0001)	false
Jan 16, 2025 10:08:00.718610048 CET	1.1.1.1	192.168.2.23	0xa643	No error (0)	6672696467652d657870657274730a.cve-2021-36260.ru		TXT (Text strings)	IN (0x0001)	false
Jan 16, 2025 10:08:00.718610048 CET	1.1.1.1	192.168.2.23	0xa643	No error (0)	6672696467652d657870657274730a.cve-2021-36260.ru		TXT (Text strings)	IN (0x0001)	false
Jan 16, 2025 10:08:00.718610048 CET	1.1.1.1	192.168.2.23	0xa643	No error (0)	6672696467652d657870657274730a.cve-2021-36260.ru		TXT (Text strings)	IN (0x0001)	false
Jan 16, 2025 10:08:00.718610048 CET	1.1.1.1	192.168.2.23	0xa643	No error (0)	6672696467652d657870657274730a.cve-2021-36260.ru		TXT (Text strings)	IN (0x0001)	false
Jan 16, 2025 10:08:00.718610048 CET	1.1.1.1	192.168.2.23	0xa643	No error (0)	6672696467652d657870657274730a.cve-2021-36260.ru		TXT (Text strings)	IN (0x0001)	false

System Behavior

Analysis Process: sh4.elf PID: 6231, Parent PID: 6152

General

Start time (UTC):	09:07:54
Start date (UTC):	16/01/2025
Path:	/tmp/sh4.elf
Arguments:	/tmp/sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: sh4.elf PID: 6233, Parent PID: 6231

General

Start time (UTC):	09:07:55
Start date (UTC):	16/01/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: sh4.elf PID: 6238, Parent PID: 6233

General

Start time (UTC):	09:07:58
Start date (UTC):	16/01/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: sh4.elf PID: 6239, Parent PID: 6233

General

Start time (UTC):	09:07:58
Start date (UTC):	16/01/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: sh4.elf PID: 6242, Parent PID: 6233

General

Start time (UTC):	09:07:58
Start date (UTC):	16/01/2025
Path:	/tmp/sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: sh4.elf PID: 6231, Parent PID: 6152

General

Chronological Activities

Analysis Process: sh4.elf PID: 6233, Parent PID: 6231

General

Chronological Activities

Analysis Process: sh4.elf PID: 6238, Parent PID: 6233

General

Chronological Activities

Analysis Process: sh4.elf PID: 6239, Parent PID: 6233

General

Chronological Activities

Analysis Process: sh4.elf PID: 6242, Parent PID: 6233

General

Chronological Activities

Linux Analysis Report
sh4.elf