Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
sh4.xxx.elf

Overview

General Information

Sample name:	sh4.xxx.elf
Analysis ID:	1573493
MD5:	d8ebffbc2b22bc944a5b07e91b2f9a5f
SHA1:	0b1952603ce81dad84529961ed9369a82a70f1bb
SHA256:	754fde1c7618e2cab1c3a31f45fbbb2170b7187b44b913d0992f8725ac87d038
Tags:	elfMiraiuser-lontze7
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

×

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573493
Start date and time:	2024-12-12 06:49:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sh4.xxx.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/sh4.xxx.elf
PID:	5478
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

sh4.xxx.elf (PID: 5478, Parent: 5396, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.xxx.elf

sh4.xxx.elf New Fork (PID: 5480, Parent: 5478)

sh4.xxx.elf New Fork (PID: 5482, Parent: 5480)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sh4.xxx.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
sh4.xxx.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
sh4.xxx.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1155c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1169c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5480.1.00007f9730400000.00007f9730414000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5480.1.00007f9730400000.00007f9730414000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1155c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1169c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5478.1.00007f9730400000.00007f9730414000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5478.1.00007f9730400000.00007f9730414000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1155c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1164c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1169c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: sh4.xxx.elf PID: 5478	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: sh4.xxx.elf PID: 5478	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4a38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4aec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: sh4.xxx.elf PID: 5480	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: sh4.xxx.elf PID: 5480	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1ff3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2007:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x201b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x202f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2043:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2057:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x206b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x207f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2093:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2133:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2147:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x215b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x216f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2183:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T06:50:54.328579+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46460	185.177.25.107	606	TCP
2024-12-12T06:50:56.451096+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46462	185.177.25.107	606	TCP
2024-12-12T06:50:58.574837+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46464	185.177.25.107	606	TCP
2024-12-12T06:51:00.684913+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46466	185.177.25.107	606	TCP
2024-12-12T06:51:02.809259+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46468	185.177.25.107	606	TCP
2024-12-12T06:51:04.965264+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46470	185.177.25.107	606	TCP
2024-12-12T06:51:07.121858+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46472	185.177.25.107	606	TCP
2024-12-12T06:51:09.247354+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46474	185.177.25.107	606	TCP
2024-12-12T06:51:11.371389+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46476	185.177.25.107	606	TCP
2024-12-12T06:51:13.498523+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46478	185.177.25.107	606	TCP
2024-12-12T06:51:15.623907+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46480	185.177.25.107	606	TCP
2024-12-12T06:51:17.762233+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46482	185.177.25.107	606	TCP
2024-12-12T06:51:19.887921+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46484	185.177.25.107	606	TCP
2024-12-12T06:51:21.998537+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46486	185.177.25.107	606	TCP
2024-12-12T06:51:24.123027+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46488	185.177.25.107	606	TCP
2024-12-12T06:51:26.247764+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46490	185.177.25.107	606	TCP
2024-12-12T06:51:28.372213+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46492	185.177.25.107	606	TCP
2024-12-12T06:51:30.498505+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46494	185.177.25.107	606	TCP
2024-12-12T06:51:32.623260+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46496	185.177.25.107	606	TCP
2024-12-12T06:51:34.750992+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46498	185.177.25.107	606	TCP
2024-12-12T06:51:36.873084+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46500	185.177.25.107	606	TCP
2024-12-12T06:51:38.998118+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46502	185.177.25.107	606	TCP
2024-12-12T06:51:41.121613+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46504	185.177.25.107	606	TCP
2024-12-12T06:51:43.246436+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46506	185.177.25.107	606	TCP
2024-12-12T06:51:45.372658+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46508	185.177.25.107	606	TCP
2024-12-12T06:51:47.480881+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46510	185.177.25.107	606	TCP
2024-12-12T06:51:49.591962+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46512	185.177.25.107	606	TCP
2024-12-12T06:51:51.716368+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46514	185.177.25.107	606	TCP
2024-12-12T06:51:53.841838+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46516	185.177.25.107	606	TCP
2024-12-12T06:51:55.968150+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46518	185.177.25.107	606	TCP
2024-12-12T06:51:58.108707+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46520	185.177.25.107	606	TCP
2024-12-12T06:52:00.248719+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46522	185.177.25.107	606	TCP
2024-12-12T06:52:02.373590+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46524	185.177.25.107	606	TCP
2024-12-12T06:52:04.482147+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46526	185.177.25.107	606	TCP
2024-12-12T06:52:06.610623+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46528	185.177.25.107	606	TCP
2024-12-12T06:52:08.748868+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46530	185.177.25.107	606	TCP
2024-12-12T06:52:10.872760+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46532	185.177.25.107	606	TCP
2024-12-12T06:52:12.998448+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46534	185.177.25.107	606	TCP
2024-12-12T06:52:15.122776+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46536	185.177.25.107	606	TCP
2024-12-12T06:52:17.247861+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46538	185.177.25.107	606	TCP
2024-12-12T06:52:19.356745+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46540	185.177.25.107	606	TCP
2024-12-12T06:52:21.484909+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46542	185.177.25.107	606	TCP
2024-12-12T06:52:23.607796+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46544	185.177.25.107	606	TCP
2024-12-12T06:52:25.733609+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46546	185.177.25.107	606	TCP
2024-12-12T06:52:27.857939+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46548	185.177.25.107	606	TCP
2024-12-12T06:52:29.983476+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46550	185.177.25.107	606	TCP
2024-12-12T06:52:32.108041+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46552	185.177.25.107	606	TCP
2024-12-12T06:52:34.216799+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46554	185.177.25.107	606	TCP
2024-12-12T06:52:36.343108+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46556	185.177.25.107	606	TCP
2024-12-12T06:52:38.465854+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46558	185.177.25.107	606	TCP
2024-12-12T06:52:40.575978+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46560	185.177.25.107	606	TCP
2024-12-12T06:52:42.702229+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46562	185.177.25.107	606	TCP
2024-12-12T06:52:44.827693+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46564	185.177.25.107	606	TCP
2024-12-12T06:52:46.953304+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46566	185.177.25.107	606	TCP
2024-12-12T06:52:49.059959+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46568	185.177.25.107	606	TCP
2024-12-12T06:52:51.186828+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46570	185.177.25.107	606	TCP
2024-12-12T06:52:53.310909+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46572	185.177.25.107	606	TCP
2024-12-12T06:52:55.437032+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46574	185.177.25.107	606	TCP
2024-12-12T06:52:57.564108+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46576	185.177.25.107	606	TCP
2024-12-12T06:52:59.703446+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46578	185.177.25.107	606	TCP
2024-12-12T06:53:01.827003+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46580	185.177.25.107	606	TCP
2024-12-12T06:53:03.952843+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46582	185.177.25.107	606	TCP
2024-12-12T06:53:06.061132+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46584	185.177.25.107	606	TCP
2024-12-12T06:53:08.170496+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46586	185.177.25.107	606	TCP
2024-12-12T06:53:10.296078+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46588	185.177.25.107	606	TCP
2024-12-12T06:53:12.421727+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46590	185.177.25.107	606	TCP
2024-12-12T06:53:14.546252+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46592	185.177.25.107	606	TCP
2024-12-12T06:53:16.671624+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46594	185.177.25.107	606	TCP
2024-12-12T06:53:18.797328+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46596	185.177.25.107	606	TCP
2024-12-12T06:53:20.921450+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46598	185.177.25.107	606	TCP
2024-12-12T06:53:23.045865+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46600	185.177.25.107	606	TCP
2024-12-12T06:53:25.154437+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46602	185.177.25.107	606	TCP
2024-12-12T06:53:27.281245+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46604	185.177.25.107	606	TCP
2024-12-12T06:53:29.407917+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46606	185.177.25.107	606	TCP
2024-12-12T06:53:31.515381+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46608	185.177.25.107	606	TCP
2024-12-12T06:53:33.644937+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46610	185.177.25.107	606	TCP
2024-12-12T06:53:35.781374+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46612	185.177.25.107	606	TCP
2024-12-12T06:53:37.906549+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46614	185.177.25.107	606	TCP
2024-12-12T06:53:40.014663+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46616	185.177.25.107	606	TCP
2024-12-12T06:53:42.141043+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46618	185.177.25.107	606	TCP
2024-12-12T06:53:44.249231+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46620	185.177.25.107	606	TCP
2024-12-12T06:53:46.373749+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46622	185.177.25.107	606	TCP
2024-12-12T06:53:48.499641+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46624	185.177.25.107	606	TCP
2024-12-12T06:53:50.624822+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46626	185.177.25.107	606	TCP
2024-12-12T06:53:52.755364+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46628	185.177.25.107	606	TCP
2024-12-12T06:53:54.937822+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46630	185.177.25.107	606	TCP
2024-12-12T06:53:57.047102+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46632	185.177.25.107	606	TCP
2024-12-12T06:53:59.205420+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46634	185.177.25.107	606	TCP
2024-12-12T06:54:01.345774+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46636	185.177.25.107	606	TCP
2024-12-12T06:54:03.469197+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46638	185.177.25.107	606	TCP
2024-12-12T06:54:05.949281+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46640	185.177.25.107	606	TCP
2024-12-12T06:54:08.079265+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46642	185.177.25.107	606	TCP
2024-12-12T06:54:10.204417+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46644	185.177.25.107	606	TCP
2024-12-12T06:54:12.345155+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46646	185.177.25.107	606	TCP
2024-12-12T06:54:14.470415+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46648	185.177.25.107	606	TCP
2024-12-12T06:54:16.595089+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46650	185.177.25.107	606	TCP
2024-12-12T06:54:18.721100+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46652	185.177.25.107	606	TCP
2024-12-12T06:54:20.861036+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46654	185.177.25.107	606	TCP
2024-12-12T06:54:22.968895+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46656	185.177.25.107	606	TCP
2024-12-12T06:54:25.094173+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46658	185.177.25.107	606	TCP
2024-12-12T06:54:27.219801+0100	2846526	1	A Network Trojan was detected	192.168.2.13	46660	185.177.25.107	606	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sh4.xxx.elf

Avira: detected

Found malware configuration

Source: sh4.xxx.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "185.177.25.107:606"}

Multi AV Scanner detection for submitted file

Source: sh4.xxx.elf

Virustotal: Detection: 51%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/sh4.xxx.elf (PID: 5478)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46494 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46532 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46514 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46566 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46500 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46602 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46600 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46548 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46658 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46512 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46474 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46464 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46626 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46638 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46488 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46634 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46490 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46516 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46530 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46560 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46572 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46534 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46504 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46618 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46612 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46482 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46558 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46476 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46654 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46528 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46484 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46540 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46496 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46546 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46592 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46570 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46608 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46508 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46486 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46622 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46568 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46478 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46518 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46502 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46520 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46554 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46578 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46460 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46594 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46586 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46562 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46656 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46630 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46536 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46644 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46580 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46596 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46610 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46646 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46652 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46574 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46538 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46466 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46462 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46590 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46606 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46526 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46542 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46492 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46584 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46624 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46620 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46480 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46524 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46470 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46632 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46506 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46614 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46564 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46468 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46472 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46550 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46498 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46642 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46552 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46640 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46660 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46510 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46522 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46588 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46598 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46544 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46576 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46582 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46616 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46556 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46650 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46648 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46604 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46628 -> 185.177.25.107:606
Source: Network traffic	Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:46636 -> 185.177.25.107:606

Source: global traffic

TCP traffic: 192.168.2.13:46460 -> 185.177.25.107:606

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107
Source: unknown	TCP traffic detected without corresponding DNS query: 185.177.25.107

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: sh4.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5480.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5478.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sh4.xxx.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sh4.xxx.elf PID: 5480, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: sh4.xxx.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5480.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5478.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sh4.xxx.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sh4.xxx.elf PID: 5480, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: /tmp/sh4.xxx.elf (PID: 5478)

Queries kernel information via 'uname':

Jump to behavior

Source: sh4.xxx.elf, 5478.1.00007ffd4fa74000.00007ffd4fa95000.rw-.sdmp, sh4.xxx.elf, 5480.1.00007ffd4fa74000.00007ffd4fa95000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.xxx.elf, 5478.1.0000558b8050c000.0000558b8056f000.rw-.sdmp, sh4.xxx.elf, 5480.1.0000558b8050c000.0000558b8056f000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.xxx.elf, 5478.1.0000558b8050c000.0000558b8056f000.rw-.sdmp, sh4.xxx.elf, 5480.1.0000558b8050c000.0000558b8056f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.xxx.elf, 5478.1.00007ffd4fa74000.00007ffd4fa95000.rw-.sdmp, sh4.xxx.elf, 5480.1.00007ffd4fa74000.00007ffd4fa95000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/sh4.xxx.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.xxx.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: sh4.xxx.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: sh4.xxx.elf, type: SAMPLE
Source: Yara match	File source: 5480.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5478.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sh4.xxx.elf PID: 5478, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sh4.xxx.elf PID: 5480, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: sh4.xxx.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: sh4.xxx.elf, type: SAMPLE
Source: Yara match	File source: 5480.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5478.1.00007f9730400000.00007f9730414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sh4.xxx.elf PID: 5478, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sh4.xxx.elf PID: 5480, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "185.177.25.107:606"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sh4.xxx.elf	52%	Virustotal		Browse
sh4.xxx.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.177.25.107:606	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
185.177.25.107	unknown	Turkey		18013	ASLINE-AS-APASLINELIMITEDHK	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.125.190.26	arm4.elf	Get hash	malicious	Mirai	Browse
	main_x86_64.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse
	kjsusa6.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	.5r3fqt67ew531has4231.sh4.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
185.177.25.107	x86.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm5.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm7.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ppc.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm6.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mpsl.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm5.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm7.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	m68k.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	arm6.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	mpsl.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	fruit.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	fruit.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	ppc.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	fruit.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
ASLINE-AS-APASLINELIMITEDHK	x86.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm5.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm7.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	m68k.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	ppc.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm6.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	mpsl.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	fruit.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.706981674901766
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sh4.xxx.elf
File size:	106'869 bytes
MD5:	d8ebffbc2b22bc944a5b07e91b2f9a5f
SHA1:	0b1952603ce81dad84529961ed9369a82a70f1bb
SHA256:	754fde1c7618e2cab1c3a31f45fbbb2170b7187b44b913d0992f8725ac87d038
SHA512:	458f1f1242ee6629b90ea756a0a623f7833bd629936cc86090b5f601fad2bf760364e2afa3c2764d9fe205ceae1eba2ccc3295ed15b914fc62b55f8deeb85df4
SSDEEP:	1536:VXOJ++oePTQxqBonwv37o6NqdF6qG63jrdOAuXtfmoaswGt0YNHH:xYiePTTBSZ5FG63jrdamdswGiYNHH
TLSH:	A0A34947D1719EB3C083AA7924EB99300723A9A15B4F1F65213997F4074F9CEB88EF64
File Content Preview:	.ELF.....................@.4....C......4. ...(...............@...@..5...5...............5...5B..5B......t...............5...5B..5B.................Q.td............................././"O.n........#.@........#.*@.....o&O.n...l.............................

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001c0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	82880
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	14

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000b4	0xb4	0x30	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x400100	0x100	0x10d00	0x0	0x6	AX	0	0	32
.fini	PROGBITS	0x410e00	0x10e00	0x24	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x410e24	0x10e24	0x26f0	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x423514	0x13514	0x7c	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x423590	0x13590	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x423590	0x13590	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x423598	0x13598	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x4235a0	0x135a0	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x4235a4	0x135a4	0x244	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x4237e8	0x137e8	0x14	0x4	0x3	WA	0	0	4
.bss	NOBITS	0x4237fc	0x137fc	0x7120	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x137fc	0xb52	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1434e	0x71	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x14668	0x33c0	0x10	0x0		16	305	4
.strtab	STRTAB	0x0	0x17a28	0x274d	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x400000	0x400000	0x13514	0x13514	6.9550	0x5	R E	0x10000		.init .text .fini .rodata
LOAD	0x13514	0x423514	0x423514	0x2e8	0x7408	4.0161	0x6	RW	0x10000		.eh_frame .tbss .ctors .dtors .jcr .data .got .bss
TLS	0x13590	0x423590	0x423590	0x0	0x8	0.0000	0x4	R	0x4		.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
			.symtab	0x4000b4	0	SECTION	<unknown>	DEFAULT	1
			.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
			.symtab	0x410e00	0	SECTION	<unknown>	DEFAULT	3
			.symtab	0x410e24	0	SECTION	<unknown>	DEFAULT	4
			.symtab	0x423514	0	SECTION	<unknown>	DEFAULT	5
			.symtab	0x423590	0	SECTION	<unknown>	DEFAULT	6
			.symtab	0x423590	0	SECTION	<unknown>	DEFAULT	7
			.symtab	0x423598	0	SECTION	<unknown>	DEFAULT	8
			.symtab	0x4235a0	0	SECTION	<unknown>	DEFAULT	9
			.symtab	0x4235a4	0	SECTION	<unknown>	DEFAULT	10
			.symtab	0x4237e8	0	SECTION	<unknown>	DEFAULT	11
			.symtab	0x4237fc	0	SECTION	<unknown>	DEFAULT	12
			.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
.jmp_loc			.symtab	0x4074ca	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40756a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40798a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x407a6a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40a00a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40a10a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40a20a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40a30a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40a40a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40cc2a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x40d4ca	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc			.symtab	0x41090a	0	NOTYPE	<unknown>	DEFAULT	2
C.3.5229			.symtab	0x4124b4	12	OBJECT	<unknown>	DEFAULT	4
C.3.5917			.symtab	0x412588	12	OBJECT	<unknown>	DEFAULT	4
C.3.5941			.symtab	0x4124e4	12	OBJECT	<unknown>	DEFAULT	4
C.3.5941			.symtab	0x412508	12	OBJECT	<unknown>	DEFAULT	4
C.4.5303			.symtab	0x4124cc	24	OBJECT	<unknown>	DEFAULT	4
C.4.5942			.symtab	0x4124fc	12	OBJECT	<unknown>	DEFAULT	4
C.5.5949			.symtab	0x4124f0	12	OBJECT	<unknown>	DEFAULT	4
C.8.5347			.symtab	0x4124a8	12	OBJECT	<unknown>	DEFAULT	4
L_abort			.symtab	0x4001f0	0	NOTYPE	<unknown>	DEFAULT	2
L_fini			.symtab	0x4001e8	0	NOTYPE	<unknown>	DEFAULT	2
L_init			.symtab	0x4001e4	0	NOTYPE	<unknown>	DEFAULT	2
L_main			.symtab	0x4001e0	0	NOTYPE	<unknown>	DEFAULT	2
L_movmem_2mod4_end			.symtab	0x410d60	0	NOTYPE	<unknown>	DEFAULT	2
L_movmem_loop			.symtab	0x410d7a	0	NOTYPE	<unknown>	DEFAULT	2
L_movmem_start_even			.symtab	0x410d86	0	NOTYPE	<unknown>	DEFAULT	2
L_uClibc_main			.symtab	0x4001ec	0	NOTYPE	<unknown>	DEFAULT	2
Q			.symtab	0x423830	16384	OBJECT	<unknown>	DEFAULT	12
Sakura_Bot.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
SendSTD			.symtab	0x40303c	340	FUNC	<unknown>	DEFAULT	2
SendSTDHEX			.symtab	0x4026cc	368	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX			.symtab	0x4032f4	416	FUNC	<unknown>	DEFAULT	2
SendUDP			.symtab	0x401d04	1048	FUNC	<unknown>	DEFAULT	2
_Exit			.symtab	0x407100	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_			.symtab	0x4237e8	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__			.symtab	0x423594	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__			.symtab	0x423590	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b			.symtab	0x4235dc	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data			.symtab	0x411e38	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower			.symtab	0x4237e0	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data			.symtab	0x413214	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper			.symtab	0x4235e4	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data			.symtab	0x412138	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__			.symtab	0x42359c	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__			.symtab	0x423598	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__			.symtab	0x423514	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__			.symtab	0x42358c	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b			.symtab	0x4235dc	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower			.symtab	0x4237e0	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper			.symtab	0x4235e4	4	OBJECT	<unknown>	HIDDEN	10
__GI___close			.symtab	0x40a040	164	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel			.symtab	0x40a050	40	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b			.symtab	0x4235e0	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower			.symtab	0x4237e4	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper			.symtab	0x4235e8	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location			.symtab	0x407484	44	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel			.symtab	0x406f34	180	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked			.symtab	0x40bfec	216	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r			.symtab	0x40fc0c	32	FUNC	<unknown>	HIDDEN	2
__GI___libc_close			.symtab	0x40a040	164	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl			.symtab	0x406fe8	280	FUNC	<unknown>	HIDDEN	2
__GI___libc_open			.symtab	0x40a140	172	FUNC	<unknown>	HIDDEN	2
__GI___libc_read			.symtab	0x40a340	172	FUNC	<unknown>	HIDDEN	2
__GI___libc_waitpid			.symtab	0x40a440	172	FUNC	<unknown>	HIDDEN	2
__GI___libc_write			.symtab	0x40a240	172	FUNC	<unknown>	HIDDEN	2
__GI___open			.symtab	0x40a140	172	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel			.symtab	0x40a150	40	FUNC	<unknown>	HIDDEN	2
__GI___read			.symtab	0x40a340	172	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel			.symtab	0x40a350	40	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork			.symtab	0x409d7c	248	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset			.symtab	0x408340	40	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset			.symtab	0x408368	42	FUNC	<unknown>	HIDDEN	2
__GI___sigismember			.symtab	0x408314	44	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini			.symtab	0x40a658	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init			.symtab	0x40a70c	68	FUNC	<unknown>	HIDDEN	2
__GI___waitpid			.symtab	0x40a440	172	FUNC	<unknown>	HIDDEN	2
__GI___write			.symtab	0x40a240	172	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel			.symtab	0x40a250	40	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r			.symtab	0x40fc2c	224	FUNC	<unknown>	HIDDEN	2
__GI__exit			.symtab	0x407100	104	FUNC	<unknown>	HIDDEN	2
__GI_abort			.symtab	0x408e60	184	FUNC	<unknown>	HIDDEN	2
__GI_atoi			.symtab	0x4093bc	24	FUNC	<unknown>	HIDDEN	2
__GI_chdir			.symtab	0x4071a4	60	FUNC	<unknown>	HIDDEN	2
__GI_close			.symtab	0x40a040	164	FUNC	<unknown>	HIDDEN	2
__GI_closedir			.symtab	0x40ad28	200	FUNC	<unknown>	HIDDEN	2
__GI_config_close			.symtab	0x40b304	72	FUNC	<unknown>	HIDDEN	2
__GI_config_open			.symtab	0x40b34c	60	FUNC	<unknown>	HIDDEN	2
__GI_config_read			.symtab	0x40b068	668	FUNC	<unknown>	HIDDEN	2
__GI_connect			.symtab	0x407ea4	116	FUNC	<unknown>	HIDDEN	2
__GI_exit			.symtab	0x409540	116	FUNC	<unknown>	HIDDEN	2
__GI_fclose			.symtab	0x40b388	444	FUNC	<unknown>	HIDDEN	2
__GI_fcntl			.symtab	0x406fe8	280	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked			.symtab	0x40bde8	516	FUNC	<unknown>	HIDDEN	2
__GI_fgetc			.symtab	0x40badc	212	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked			.symtab	0x40bfec	216	FUNC	<unknown>	HIDDEN	2
__GI_fgets			.symtab	0x40bbb0	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked			.symtab	0x40c0c4	132	FUNC	<unknown>	HIDDEN	2
__GI_fopen			.symtab	0x40b544	24	FUNC	<unknown>	HIDDEN	2
__GI_fork			.symtab	0x409b10	572	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked			.symtab	0x40fa98	68	FUNC	<unknown>	HIDDEN	2
__GI_fseek			.symtab	0x410b10	28	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64			.symtab	0x410b2c	316	FUNC	<unknown>	HIDDEN	2
__GI_fstat			.symtab	0x40d024	96	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked			.symtab	0x40fadc	168	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked			.symtab	0x40bfec	216	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize			.symtab	0x40aaf0	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid			.symtab	0x40ab24	18	FUNC	<unknown>	HIDDEN	2
__GI_geteuid			.symtab	0x40ab36	18	FUNC	<unknown>	HIDDEN	2
__GI_getgid			.symtab	0x40ab48	18	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname			.symtab	0x407df4	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2			.symtab	0x407e08	92	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r			.symtab	0x40c590	658	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r			.symtab	0x40e754	680	FUNC	<unknown>	HIDDEN	2
__GI_gethostname			.symtab	0x40e9fc	128	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize			.symtab	0x40ab5c	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid			.symtab	0x409e74	52	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit			.symtab	0x40ab78	64	FUNC	<unknown>	HIDDEN	2
__GI_getsockname			.symtab	0x407f18	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid			.symtab	0x40abb8	18	FUNC	<unknown>	HIDDEN	2
__GI_htonl			.symtab	0x407cbc	48	FUNC	<unknown>	HIDDEN	2
__GI_htons			.symtab	0x407ca4	24	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr			.symtab	0x407dc8	44	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton			.symtab	0x40c4c8	200	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa			.symtab	0x407db0	24	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r			.symtab	0x407d34	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop			.symtab	0x40d970	528	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton			.symtab	0x40d6a0	416	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r			.symtab	0x40920c	204	FUNC	<unknown>	HIDDEN	2
__GI_ioctl			.symtab	0x4071e0	268	FUNC	<unknown>	HIDDEN	2
__GI_isatty			.symtab	0x40c430	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace			.symtab	0x407440	28	FUNC	<unknown>	HIDDEN	2
__GI_kill			.symtab	0x4072ec	60	FUNC	<unknown>	HIDDEN	2
__GI_lseek64			.symtab	0x40ebcc	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr			.symtab	0x410940	24	FUNC	<unknown>	HIDDEN	2
__GI_memcpy			.symtab	0x407620	860	FUNC	<unknown>	HIDDEN	2
__GI_memmove			.symtab	0x40c148	188	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy			.symtab	0x40d540	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr			.symtab	0x410960	200	FUNC	<unknown>	HIDDEN	2
__GI_memset			.symtab	0x4079c0	150	FUNC	<unknown>	HIDDEN	2
__GI_mmap			.symtab	0x40a9e4	64	FUNC	<unknown>	HIDDEN	2
__GI_mremap			.symtab	0x40d084	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap			.symtab	0x40abcc	60	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep			.symtab	0x40ac48	108	FUNC	<unknown>	HIDDEN	2
__GI_ntohl			.symtab	0x407d04	48	FUNC	<unknown>	HIDDEN	2
__GI_ntohs			.symtab	0x407cec	24	FUNC	<unknown>	HIDDEN	2
__GI_open			.symtab	0x40a140	172	FUNC	<unknown>	HIDDEN	2
__GI_opendir			.symtab	0x40ae80	176	FUNC	<unknown>	HIDDEN	2
__GI_poll			.symtab	0x40eabc	116	FUNC	<unknown>	HIDDEN	2
__GI_raise			.symtab	0x409ea8	116	FUNC	<unknown>	HIDDEN	2
__GI_random			.symtab	0x408f2c	100	FUNC	<unknown>	HIDDEN	2
__GI_random_r			.symtab	0x4090d4	108	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr			.symtab	0x40d564	164	FUNC	<unknown>	HIDDEN	2
__GI_read			.symtab	0x40a340	172	FUNC	<unknown>	HIDDEN	2
__GI_readdir64			.symtab	0x40afd0	152	FUNC	<unknown>	HIDDEN	2
__GI_recv			.symtab	0x407fdc	128	FUNC	<unknown>	HIDDEN	2
__GI_sbrk			.symtab	0x40aa24	104	FUNC	<unknown>	HIDDEN	2
__GI_select			.symtab	0x40736c	136	FUNC	<unknown>	HIDDEN	2
__GI_send			.symtab	0x40809c	128	FUNC	<unknown>	HIDDEN	2
__GI_sendto			.symtab	0x408160	144	FUNC	<unknown>	HIDDEN	2
__GI_setsid			.symtab	0x4073f4	60	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt			.symtab	0x4081f0	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r			.symtab	0x4092d8	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction			.symtab	0x40c824	20	FUNC	<unknown>	HIDDEN	2
__GI_signal			.symtab	0x408274	160	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask			.symtab	0x40acb4	116	FUNC	<unknown>	HIDDEN	2
__GI_sleep			.symtab	0x409f1c	224	FUNC	<unknown>	HIDDEN	2
__GI_socket			.symtab	0x408234	64	FUNC	<unknown>	HIDDEN	2
__GI_sprintf			.symtab	0x40ec38	132	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r			.symtab	0x409140	204	FUNC	<unknown>	HIDDEN	2
__GI_stat			.symtab	0x40eb30	96	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp			.symtab	0x410a28	64	FUNC	<unknown>	HIDDEN	2
__GI_strchr			.symtab	0x407ac0	196	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul			.symtab	0x40c204	192	FUNC	<unknown>	HIDDEN	2
__GI_strcmp			.symtab	0x407b84	34	FUNC	<unknown>	HIDDEN	2
__GI_strcoll			.symtab	0x407b84	34	FUNC	<unknown>	HIDDEN	2
__GI_strcpy			.symtab	0x407aa0	16	FUNC	<unknown>	HIDDEN	2
__GI_strcspn			.symtab	0x40c2c4	72	FUNC	<unknown>	HIDDEN	2
__GI_strdup			.symtab	0x40fd0c	76	FUNC	<unknown>	HIDDEN	2
__GI_strlen			.symtab	0x407500	88	FUNC	<unknown>	HIDDEN	2
__GI_strncpy			.symtab	0x40d500	40	FUNC	<unknown>	HIDDEN	2
__GI_strnlen			.symtab	0x40fb84	136	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk			.symtab	0x40c404	44	FUNC	<unknown>	HIDDEN	2
__GI_strrchr			.symtab	0x40c30c	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn			.symtab	0x40c35c	48	FUNC	<unknown>	HIDDEN	2
__GI_strstr			.symtab	0x407ba6	182	FUNC	<unknown>	HIDDEN	2
__GI_strtok			.symtab	0x407c8c	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r			.symtab	0x40c38c	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol			.symtab	0x4093d4	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf			.symtab	0x4096bc	1032	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr			.symtab	0x40c454	116	FUNC	<unknown>	HIDDEN	2
__GI_time			.symtab	0x407430	16	FUNC	<unknown>	HIDDEN	2
__GI_toupper			.symtab	0x40745c	40	FUNC	<unknown>	HIDDEN	2
__GI_uname			.symtab	0x40eb90	60	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf			.symtab	0x40ecbc	180	FUNC	<unknown>	HIDDEN	2
__GI_waitpid			.symtab	0x40a440	172	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb			.symtab	0x4100c8	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs			.symtab	0x41012c	124	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs			.symtab	0x41010c	32	FUNC	<unknown>	HIDDEN	2
__GI_write			.symtab	0x40a240	172	FUNC	<unknown>	HIDDEN	2
__JCR_END__			.symtab	0x4235a0	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__			.symtab	0x4235a0	0	OBJECT	<unknown>	DEFAULT	9
__app_fini			.symtab	0x427f6c	4	OBJECT	<unknown>	HIDDEN	12
__atexit_lock			.symtab	0x4236c8	24	OBJECT	<unknown>	DEFAULT	10
__bss_start			.symtab	0x4237fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd			.symtab	0x40a6c4	72	FUNC	<unknown>	DEFAULT	2
__close			.symtab	0x40a040	164	FUNC	<unknown>	DEFAULT	2
__close_nameservers			.symtab	0x40e6a4	124	FUNC	<unknown>	HIDDEN	2
__close_nocancel			.symtab	0x40a050	40	FUNC	<unknown>	DEFAULT	2
__ctype_b			.symtab	0x4235e0	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower			.symtab	0x4237e4	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper			.symtab	0x4235e8	4	OBJECT	<unknown>	DEFAULT	10
__curbrk			.symtab	0x42a4d0	4	OBJECT	<unknown>	HIDDEN	12
__data_start			.symtab	0x4235a4	0	NOTYPE	<unknown>	DEFAULT	10
__decode_dotted			.symtab	0x40db80	220	FUNC	<unknown>	HIDDEN	2
__decode_header			.symtab	0x40fe20	148	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup			.symtab	0x40dc5c	1608	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux			.symtab	0x410dc0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux			.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle			.symtab	0x4235a4	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted			.symtab	0x410a68	168	FUNC	<unknown>	HIDDEN	2
__encode_header			.symtab	0x40fd58	200	FUNC	<unknown>	HIDDEN	2
__encode_question			.symtab	0x40feb4	104	FUNC	<unknown>	HIDDEN	2
__environ			.symtab	0x427f64	4	OBJECT	<unknown>	DEFAULT	12
__errno_location			.symtab	0x407484	44	FUNC	<unknown>	DEFAULT	2
__errno_location.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup			.symtab	0x427a14	4	OBJECT	<unknown>	HIDDEN	12
__fcntl_nocancel			.symtab	0x406f34	180	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked			.symtab	0x40bfec	216	FUNC	<unknown>	DEFAULT	2
__fini_array_end			.symtab	0x423590	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start			.symtab	0x423590	0	NOTYPE	<unknown>	HIDDEN	6
__fork			.symtab	0x409b10	572	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer			.symtab	0x42a888	4	OBJECT	<unknown>	HIDDEN	12
__fork_handlers			.symtab	0x42a88c	4	OBJECT	<unknown>	HIDDEN	12
__fork_lock			.symtab	0x427a18	4	OBJECT	<unknown>	HIDDEN	12
__get_hosts_byname_r			.symtab	0x40e720	52	FUNC	<unknown>	HIDDEN	2
__getdents64			.symtab	0x40d1d4	276	FUNC	<unknown>	HIDDEN	2
__getpagesize			.symtab	0x40ab5c	28	FUNC	<unknown>	DEFAULT	2
__getpid			.symtab	0x409e74	52	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r			.symtab	0x40fc0c	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end			.symtab	0x423590	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start			.symtab	0x423590	0	NOTYPE	<unknown>	HIDDEN	6
__init_brk			.symtab	0x40cf90	84	FUNC	<unknown>	HIDDEN	2
__init_brk.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__libc_close			.symtab	0x40a040	164	FUNC	<unknown>	DEFAULT	2
__libc_connect			.symtab	0x407ea4	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel			.symtab	0x40a500	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel			.symtab	0x40a588	136	FUNC	<unknown>	HIDDEN	2
__libc_errno			.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl			.symtab	0x406fe8	280	FUNC	<unknown>	DEFAULT	2
__libc_fork			.symtab	0x409b10	572	FUNC	<unknown>	DEFAULT	2
__libc_h_errno			.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep			.symtab	0x40ac48	108	FUNC	<unknown>	DEFAULT	2
__libc_open			.symtab	0x40a140	172	FUNC	<unknown>	DEFAULT	2
__libc_read			.symtab	0x40a340	172	FUNC	<unknown>	DEFAULT	2
__libc_recv			.symtab	0x407fdc	128	FUNC	<unknown>	DEFAULT	2
__libc_select			.symtab	0x40736c	136	FUNC	<unknown>	DEFAULT	2
__libc_send			.symtab	0x40809c	128	FUNC	<unknown>	DEFAULT	2
__libc_sendto			.symtab	0x408160	144	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls			.symtab	0x40cd52	366	FUNC	<unknown>	DEFAULT	2
__libc_sigaction			.symtab	0x40c824	20	FUNC	<unknown>	DEFAULT	2
__libc_stack_end			.symtab	0x427f60	4	OBJECT	<unknown>	DEFAULT	12
__libc_waitpid			.symtab	0x40a440	172	FUNC	<unknown>	DEFAULT	2
__libc_write			.symtab	0x40a240	172	FUNC	<unknown>	DEFAULT	2
__linkin_atfork			.symtab	0x409d4c	48	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private			.symtab	0x40cc60	64	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private			.symtab	0x40cca0	30	FUNC	<unknown>	HIDDEN	2
__local_nameserver			.symtab	0x412578	16	OBJECT	<unknown>	HIDDEN	4
__malloc_consolidate			.symtab	0x408b64	328	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index			.symtab	0x408394	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock			.symtab	0x4235ec	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state			.symtab	0x42a510	888	OBJECT	<unknown>	DEFAULT	12
__malloc_trim			.symtab	0x408ac8	156	FUNC	<unknown>	DEFAULT	2
__movmemSI12_i4			.symtab	0x410da0	14	FUNC	<unknown>	HIDDEN	2
__movmem_i4_even			.symtab	0x410d68	48	FUNC	<unknown>	HIDDEN	2
__movmem_i4_odd			.symtab	0x410d6e	42	FUNC	<unknown>	HIDDEN	2
__movstrSI12_i4			.symtab	0x410da0	14	FUNC	<unknown>	HIDDEN	2
__movstr_i4_even			.symtab	0x410d68	48	FUNC	<unknown>	HIDDEN	2
__movstr_i4_odd			.symtab	0x410d6e	42	FUNC	<unknown>	HIDDEN	2
__nameserver			.symtab	0x42a8c0	4	OBJECT	<unknown>	HIDDEN	12
__nameservers			.symtab	0x42a8c4	4	OBJECT	<unknown>	HIDDEN	12
__nptl_deallocate_tsd			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open			.symtab	0x40a140	172	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts			.symtab	0x40ff1c	24	FUNC	<unknown>	HIDDEN	2
__open_nameservers			.symtab	0x40e324	896	FUNC	<unknown>	HIDDEN	2
__open_nocancel			.symtab	0x40a150	40	FUNC	<unknown>	DEFAULT	2
__pagesize			.symtab	0x427f68	4	OBJECT	<unknown>	DEFAULT	12
__preinit_array_end			.symtab	0x423590	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start			.symtab	0x423590	0	NOTYPE	<unknown>	HIDDEN	6
__progname			.symtab	0x4236e4	4	OBJECT	<unknown>	DEFAULT	10
__progname_full			.symtab	0x4236e8	4	OBJECT	<unknown>	DEFAULT	10
__pthread_initialize_minimal			.symtab	0x40cec0	24	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init			.symtab	0x40a61e	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock			.symtab	0x40a610	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock			.symtab	0x40a610	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock			.symtab	0x40a610	14	FUNC	<unknown>	DEFAULT	2
__pthread_return_0			.symtab	0x40a610	14	FUNC	<unknown>	DEFAULT	2
__pthread_unwind			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read			.symtab	0x40a340	172	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r			.symtab	0x40ff34	404	FUNC	<unknown>	HIDDEN	2
__read_nocancel			.symtab	0x40a350	40	FUNC	<unknown>	DEFAULT	2
__register_atfork			.symtab	0x409d7c	248	FUNC	<unknown>	DEFAULT	2
__register_frame_info			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync			.symtab	0x42a8b8	4	OBJECT	<unknown>	HIDDEN	12
__resolv_attempts			.symtab	0x4237db	1	OBJECT	<unknown>	HIDDEN	10
__resolv_lock			.symtab	0x42a4d8	24	OBJECT	<unknown>	DEFAULT	12
__resolv_timeout			.symtab	0x4237da	1	OBJECT	<unknown>	HIDDEN	10
__rtld_fini			.symtab	0x427f70	4	OBJECT	<unknown>	HIDDEN	12
__sdivsi3_i4i			.symtab	0x406be0	852	FUNC	<unknown>	HIDDEN	2
__searchdomain			.symtab	0x42a8bc	4	OBJECT	<unknown>	HIDDEN	12
__searchdomains			.symtab	0x42a8c8	4	OBJECT	<unknown>	HIDDEN	12
__sigaddset			.symtab	0x408340	40	FUNC	<unknown>	DEFAULT	2
__sigdelset			.symtab	0x408368	42	FUNC	<unknown>	DEFAULT	2
__sigismember			.symtab	0x408314	44	FUNC	<unknown>	DEFAULT	2
__sigjmp_save			.symtab	0x40c838	56	FUNC	<unknown>	HIDDEN	2
__sigsetjmp			.symtab	0x40aab0	60	FUNC	<unknown>	DEFAULT	2
__sigsetjmp_intern			.symtab	0x40aab4	0	NOTYPE	<unknown>	DEFAULT	2
__stdin			.symtab	0x4236f8	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ			.symtab	0x40d2e8	80	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE			.symtab	0x40d338	192	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position			.symtab	0x410c68	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite			.symtab	0x4101a8	264	FUNC	<unknown>	HIDDEN	2
__stdio_rfill			.symtab	0x40d3f8	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek			.symtab	0x410d2c	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o			.symtab	0x40d428	140	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o			.symtab	0x4102b0	196	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit			.symtab	0x40b9a8	52	FUNC	<unknown>	HIDDEN	2
__stdout			.symtab	0x4236fc	4	OBJECT	<unknown>	DEFAULT	10
__sys_connect			.symtab	0x407e64	64	FUNC	<unknown>	DEFAULT	2
__sys_recv			.symtab	0x407f9c	64	FUNC	<unknown>	DEFAULT	2
__sys_send			.symtab	0x40805c	64	FUNC	<unknown>	DEFAULT	2
__sys_sendto			.symtab	0x40811c	68	FUNC	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x4074c0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x407560	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x407980	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x407a60	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x40a000	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x40a100	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x40a200	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x40a300	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x40a400	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x40cc20	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x40d4c0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error			.symtab	0x410900	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_fcntl.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep			.symtab	0x40ac08	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll			.symtab	0x40ea7c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction			.symtab	0x40cfe4	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select			.symtab	0x407328	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr			.symtab	0x40cd3c	22	FUNC	<unknown>	DEFAULT	2
__uClibc_fini			.symtab	0x40a658	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init			.symtab	0x40a70c	68	FUNC	<unknown>	DEFAULT	2
__uClibc_main			.symtab	0x40a750	660	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname			.symtab	0x4236e0	4	OBJECT	<unknown>	HIDDEN	10
__udivsi3_i4i			.symtab	0x406b10	208	FUNC	<unknown>	HIDDEN	2
__waitpid			.symtab	0x40a440	172	FUNC	<unknown>	DEFAULT	2
__waitpid_nocancel			.symtab	0x40a450	40	FUNC	<unknown>	DEFAULT	2
__write			.symtab	0x40a240	172	FUNC	<unknown>	DEFAULT	2
__write_nocancel			.symtab	0x40a250	40	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r			.symtab	0x40fc2c	224	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv			.symtab	0x40d154	128	FUNC	<unknown>	HIDDEN	2
__xstat64_conv			.symtab	0x40d0c8	140	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_brk			.symtab	0x40cf54	60	FUNC	<unknown>	HIDDEN	2
_bss_custom_printf_spec			.symtab	0x42a4f4	10	OBJECT	<unknown>	DEFAULT	12
_charpad			.symtab	0x40ed70	88	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo			.symtab	0x42a8cc	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_handler			.symtab	0x42a8f4	40	OBJECT	<unknown>	HIDDEN	12
_custom_printf_spec			.symtab	0x4237dc	4	OBJECT	<unknown>	HIDDEN	10
_dl_aux_init			.symtab	0x40ced8	32	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls			.symtab	0x4237d4	4	OBJECT	<unknown>	DEFAULT	10
_dl_nothread_init_static_tls			.symtab	0x40cef8	92	FUNC	<unknown>	HIDDEN	2
_dl_phdr			.symtab	0x42a8b0	4	OBJECT	<unknown>	DEFAULT	12
_dl_phnum			.symtab	0x42a8b4	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_gaps			.symtab	0x42a8a4	1	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_slotinfo_list			.symtab	0x42a8a0	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_generation			.symtab	0x42a8a8	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_max_dtv_idx			.symtab	0x42a898	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_setup			.symtab	0x40cd00	60	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align			.symtab	0x42a894	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_nelem			.symtab	0x42a8ac	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_size			.symtab	0x42a89c	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_used			.symtab	0x42a890	4	OBJECT	<unknown>	DEFAULT	12
_edata			.symtab	0x4237fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end			.symtab	0x42a91c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit			.symtab	0x407100	104	FUNC	<unknown>	DEFAULT	2
_exit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini			.symtab	0x410e00	0	FUNC	<unknown>	HIDDEN	3
_fixed_buffers			.symtab	0x427f94	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow			.symtab	0x40edc8	124	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr			.symtab	0x41040c	1256	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init			.symtab	0x4000b4	0	FUNC	<unknown>	HIDDEN	1
_load_inttype			.symtab	0x410374	94	FUNC	<unknown>	HIDDEN	2
_load_inttype.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init			.symtab	0x40f3d0	124	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec			.symtab	0x40f698	1024	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs			.symtab	0x40f44c	72	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs			.symtab	0x40f494	456	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size			.symtab	0x40f65c	60	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore			.symtab	0x40a63c	28	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer			.symtab	0x40a62c	16	FUNC	<unknown>	DEFAULT	2
_rfill.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp			.symtab	0x40aa90	4	FUNC	<unknown>	DEFAULT	2
_sigintr			.symtab	0x42a508	8	OBJECT	<unknown>	HIDDEN	12
_start			.symtab	0x4001c0	30	FUNC	<unknown>	DEFAULT	2
_stdio.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen			.symtab	0x40b55c	732	FUNC	<unknown>	HIDDEN	2
_stdio_init			.symtab	0x40b838	116	FUNC	<unknown>	HIDDEN	2
_stdio_openlist			.symtab	0x423700	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock			.symtab	0x427f74	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use			.symtab	0x40bc6c	380	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count			.symtab	0x427f90	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_del_lock			.symtab	0x427f80	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count			.symtab	0x427f8c	4	OBJECT	<unknown>	DEFAULT	12
_stdio_streams			.symtab	0x423708	204	OBJECT	<unknown>	DEFAULT	10
_stdio_term			.symtab	0x40b8ac	252	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking			.symtab	0x423704	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l			.symtab	0x4093e8	344	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype			.symtab	0x4103d2	56	FUNC	<unknown>	HIDDEN	2
_store_inttype.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs			.symtab	0x41264c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr			.symtab	0x40b9dc	256	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal			.symtab	0x40ee44	1420	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort			.symtab	0x408e60	184	FUNC	<unknown>	DEFAULT	2
abort.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access			.symtab	0x407168	60	FUNC	<unknown>	DEFAULT	2
access.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd			.symtab	0x4043d4	364	FUNC	<unknown>	DEFAULT	2
atcp			.symtab	0x403e24	1456	FUNC	<unknown>	DEFAULT	2
atoi			.symtab	0x4093bc	24	FUNC	<unknown>	DEFAULT	2
atol			.symtab	0x4093bc	24	FUNC	<unknown>	DEFAULT	2
atol.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp			.symtab	0x4038e8	1340	FUNC	<unknown>	DEFAULT	2
bcopy			.symtab	0x407c5c	24	FUNC	<unknown>	DEFAULT	2
bcopy.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that			.symtab	0x427a10	4	OBJECT	<unknown>	DEFAULT	12
bsd_signal			.symtab	0x408274	160	FUNC	<unknown>	DEFAULT	2
buf.5426			.symtab	0x427834	16	OBJECT	<unknown>	DEFAULT	12
buf.6388			.symtab	0x427844	440	OBJECT	<unknown>	DEFAULT	12
bzero			.symtab	0x407c74	24	FUNC	<unknown>	DEFAULT	2
bzero.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c			.symtab	0x4235d4	4	OBJECT	<unknown>	DEFAULT	10
calloc			.symtab	0x40c870	228	FUNC	<unknown>	DEFAULT	2
calloc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir			.symtab	0x4071a4	60	FUNC	<unknown>	DEFAULT	2
chdir.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close			.symtab	0x40a040	164	FUNC	<unknown>	DEFAULT	2
closedir			.symtab	0x40ad28	200	FUNC	<unknown>	DEFAULT	2
closedir.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer			.symtab	0x4235b0	4	OBJECT	<unknown>	DEFAULT	10
completed.4720			.symtab	0x4237fc	1	OBJECT	<unknown>	DEFAULT	12
connect			.symtab	0x407ea4	116	FUNC	<unknown>	DEFAULT	2
connect.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout			.symtab	0x4015ec	776	FUNC	<unknown>	DEFAULT	2
crti.S			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtn.S			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum			.symtab	0x401a2c	232	FUNC	<unknown>	DEFAULT	2
currentServer			.symtab	0x4235d0	4	OBJECT	<unknown>	DEFAULT	10
data_start			.symtab	0x4235ac	0	NOTYPE	<unknown>	DEFAULT	10
decoded.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ			.symtab	0x427f64	4	OBJECT	<unknown>	DEFAULT	12
errno			.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit			.symtab	0x409540	116	FUNC	<unknown>	DEFAULT	2
exit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table			.symtab	0x4131cc	72	OBJECT	<unknown>	DEFAULT	4
fclose			.symtab	0x40b388	444	FUNC	<unknown>	DEFAULT	2
fclose.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl			.symtab	0x406fe8	280	FUNC	<unknown>	DEFAULT	2
fd_to_DIR			.symtab	0x40adf0	144	FUNC	<unknown>	DEFAULT	2
fdgets			.symtab	0x400414	200	FUNC	<unknown>	DEFAULT	2
fdopendir			.symtab	0x40af30	160	FUNC	<unknown>	DEFAULT	2
fflush_unlocked			.symtab	0x40bde8	516	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc			.symtab	0x40badc	212	FUNC	<unknown>	DEFAULT	2
fgetc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked			.symtab	0x40bfec	216	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets			.symtab	0x40bbb0	188	FUNC	<unknown>	DEFAULT	2
fgets.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked			.symtab	0x40c0c4	132	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt			.symtab	0x4131b8	20	OBJECT	<unknown>	DEFAULT	4
fopen			.symtab	0x40b544	24	FUNC	<unknown>	DEFAULT	2
fopen.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork			.symtab	0x409b10	572	FUNC	<unknown>	DEFAULT	2
fork.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool			.symtab	0x427a1c	1348	OBJECT	<unknown>	DEFAULT	12
fputs_unlocked			.symtab	0x40fa98	68	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy			.symtab	0x400160	0	FUNC	<unknown>	DEFAULT	2
free			.symtab	0x408cac	384	FUNC	<unknown>	DEFAULT	2
free.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek			.symtab	0x410b10	28	FUNC	<unknown>	DEFAULT	2
fseeko			.symtab	0x410b10	28	FUNC	<unknown>	DEFAULT	2
fseeko.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64			.symtab	0x410b2c	316	FUNC	<unknown>	DEFAULT	2
fseeko64.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat			.symtab	0x40d024	96	FUNC	<unknown>	DEFAULT	2
fstat.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp			.symtab	0x40211c	1456	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked			.symtab	0x40fadc	168	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch			.symtab	0x404540	20	FUNC	<unknown>	DEFAULT	2
getHost			.symtab	0x401194	84	FUNC	<unknown>	DEFAULT	2
getOurIP			.symtab	0x4004dc	672	FUNC	<unknown>	DEFAULT	2
getPortz			.symtab	0x404554	152	FUNC	<unknown>	DEFAULT	2
getRandomIP			.symtab	0x4003b8	92	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc			.symtab	0x40badc	212	FUNC	<unknown>	DEFAULT	2
getc_unlocked			.symtab	0x40bfec	216	FUNC	<unknown>	DEFAULT	2
getdents64.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize			.symtab	0x40aaf0	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid			.symtab	0x40ab24	18	FUNC	<unknown>	DEFAULT	2
getegid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid			.symtab	0x40ab36	18	FUNC	<unknown>	DEFAULT	2
geteuid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid			.symtab	0x40ab48	18	FUNC	<unknown>	DEFAULT	2
getgid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname			.symtab	0x407df4	20	FUNC	<unknown>	DEFAULT	2
gethostbyname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2			.symtab	0x407e08	92	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r			.symtab	0x40c590	658	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r			.symtab	0x40e754	680	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname			.symtab	0x40e9fc	128	FUNC	<unknown>	DEFAULT	2
gethostname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize			.symtab	0x40ab5c	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid			.symtab	0x409e74	52	FUNC	<unknown>	DEFAULT	2
getpid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit			.symtab	0x40ab78	64	FUNC	<unknown>	DEFAULT	2
getrlimit.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname			.symtab	0x407f18	64	FUNC	<unknown>	DEFAULT	2
getsockname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt			.symtab	0x407f58	68	FUNC	<unknown>	DEFAULT	2
getsockopt.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid			.symtab	0x40abb8	18	FUNC	<unknown>	DEFAULT	2
getuid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP			.symtab	0x42381c	4	OBJECT	<unknown>	DEFAULT	12
h_errno			.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
hoste.6387			.symtab	0x4279fc	20	OBJECT	<unknown>	DEFAULT	12
htonl			.symtab	0x407cbc	48	FUNC	<unknown>	DEFAULT	2
htons			.symtab	0x407ca4	24	FUNC	<unknown>	DEFAULT	2
i.4620			.symtab	0x4235d8	4	OBJECT	<unknown>	DEFAULT	10
index			.symtab	0x407ac0	196	FUNC	<unknown>	DEFAULT	2
inet_addr			.symtab	0x407dc8	44	FUNC	<unknown>	DEFAULT	2
inet_aton			.symtab	0x40c4c8	200	FUNC	<unknown>	DEFAULT	2
inet_aton.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa			.symtab	0x407db0	24	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r			.symtab	0x407d34	124	FUNC	<unknown>	DEFAULT	2
inet_ntop			.symtab	0x40d970	528	FUNC	<unknown>	DEFAULT	2
inet_ntop4			.symtab	0x40d840	304	FUNC	<unknown>	DEFAULT	2
inet_pton			.symtab	0x40d6a0	416	FUNC	<unknown>	DEFAULT	2
inet_pton4			.symtab	0x40d608	152	FUNC	<unknown>	DEFAULT	2
initConnection			.symtab	0x4062c4	340	FUNC	<unknown>	DEFAULT	2
init_rand			.symtab	0x4001f4	180	FUNC	<unknown>	DEFAULT	2
init_static_tls			.symtab	0x40ccc0	64	FUNC	<unknown>	DEFAULT	2
initstate			.symtab	0x408ffc	120	FUNC	<unknown>	DEFAULT	2
initstate_r			.symtab	0x40920c	204	FUNC	<unknown>	DEFAULT	2
ioctl			.symtab	0x4071e0	268	FUNC	<unknown>	DEFAULT	2
ioctl.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty			.symtab	0x40c430	36	FUNC	<unknown>	DEFAULT	2
isatty.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace			.symtab	0x407440	28	FUNC	<unknown>	DEFAULT	2
isspace.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill			.symtab	0x4072ec	60	FUNC	<unknown>	DEFAULT	2
kill.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.6445			.symtab	0x4237d8	2	OBJECT	<unknown>	DEFAULT	10
last_ns_num.6444			.symtab	0x42a4d4	4	OBJECT	<unknown>	DEFAULT	12
libc-cancellation.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork			.symtab	0x4018f4	312	FUNC	<unknown>	DEFAULT	2
llseek.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64			.symtab	0x40ebcc	108	FUNC	<unknown>	DEFAULT	2
macAddress			.symtab	0x423828	6	OBJECT	<unknown>	DEFAULT	12
main			.symtab	0x406418	1784	FUNC	<unknown>	DEFAULT	2
mainCommSock			.symtab	0x423818	4	OBJECT	<unknown>	DEFAULT	12
makeIPPacket			.symtab	0x401c24	224	FUNC	<unknown>	DEFAULT	2
makeRandomStr			.symtab	0x4011e8	156	FUNC	<unknown>	DEFAULT	2
makevsepacket			.symtab	0x40295c	248	FUNC	<unknown>	DEFAULT	2
malloc			.symtab	0x408404	1732	FUNC	<unknown>	DEFAULT	2
malloc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim			.symtab	0x408e2c	52	FUNC	<unknown>	DEFAULT	2
memchr			.symtab	0x410940	24	FUNC	<unknown>	DEFAULT	2
memcpy			.symtab	0x407620	860	FUNC	<unknown>	DEFAULT	2
memmove			.symtab	0x40c148	188	FUNC	<unknown>	DEFAULT	2
memmove.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy			.symtab	0x40d540	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr			.symtab	0x410960	200	FUNC	<unknown>	DEFAULT	2
memrchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset			.symtab	0x4079c0	150	FUNC	<unknown>	DEFAULT	2
mmap			.symtab	0x40a9e4	64	FUNC	<unknown>	DEFAULT	2
mmap.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap			.symtab	0x40d084	68	FUNC	<unknown>	DEFAULT	2
mremap.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap			.symtab	0x40abcc	60	FUNC	<unknown>	DEFAULT	2
munmap.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock			.symtab	0x423604	24	OBJECT	<unknown>	DEFAULT	10
mylock			.symtab	0x42361c	24	OBJECT	<unknown>	DEFAULT	10
nanosleep			.symtab	0x40ac48	108	FUNC	<unknown>	DEFAULT	2
nanosleep.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1251			.symtab	0x427830	4	OBJECT	<unknown>	DEFAULT	12
nprocessors_onln			.symtab	0x4095b4	264	FUNC	<unknown>	DEFAULT	2
ntohl			.symtab	0x407d04	48	FUNC	<unknown>	DEFAULT	2
ntohl.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs			.symtab	0x407cec	24	FUNC	<unknown>	DEFAULT	2
ntop.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids			.symtab	0x423820	8	OBJECT	<unknown>	DEFAULT	12
object.4732			.symtab	0x423800	24	OBJECT	<unknown>	DEFAULT	12
open			.symtab	0x40a140	172	FUNC	<unknown>	DEFAULT	2
opendir			.symtab	0x40ae80	176	FUNC	<unknown>	DEFAULT	2
opendir.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP			.symtab	0x42a500	4	OBJECT	<unknown>	DEFAULT	12
p.4718			.symtab	0x4235a8	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids			.symtab	0x42a504	4	OBJECT	<unknown>	DEFAULT	12
poll			.symtab	0x40eabc	116	FUNC	<unknown>	DEFAULT	2
poll.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.6143			.symtab	0x4125a4	12	OBJECT	<unknown>	DEFAULT	4
print			.symtab	0x400c00	1068	FUNC	<unknown>	DEFAULT	2
printchar			.symtab	0x4008b0	104	FUNC	<unknown>	DEFAULT	2
printi			.symtab	0x400a70	400	FUNC	<unknown>	DEFAULT	2
prints			.symtab	0x400918	344	FUNC	<unknown>	DEFAULT	2
processCmd			.symtab	0x4045ec	7384	FUNC	<unknown>	DEFAULT	2
program_invocation_name			.symtab	0x4236e8	4	OBJECT	<unknown>	DEFAULT	10
program_invocation_short_name			.symtab	0x4236e4	4	OBJECT	<unknown>	DEFAULT	10
qual_chars.6152			.symtab	0x4125b8	20	OBJECT	<unknown>	DEFAULT	4
raise			.symtab	0x409ea8	116	FUNC	<unknown>	DEFAULT	2
raise.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand			.symtab	0x408f18	20	FUNC	<unknown>	DEFAULT	2
rand.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc			.symtab	0x4002a8	272	FUNC	<unknown>	DEFAULT	2
random			.symtab	0x408f2c	100	FUNC	<unknown>	DEFAULT	2
random.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info			.symtab	0x412438	40	OBJECT	<unknown>	DEFAULT	4
random_r			.symtab	0x4090d4	108	FUNC	<unknown>	DEFAULT	2
random_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl			.symtab	0x423648	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr			.symtab	0x40d564	164	FUNC	<unknown>	DEFAULT	2
rawmemchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read			.symtab	0x40a340	172	FUNC	<unknown>	DEFAULT	2
read_etc_hosts_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64			.symtab	0x40afd0	152	FUNC	<unknown>	DEFAULT	2
readdir64.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc			.symtab	0x40c954	692	FUNC	<unknown>	DEFAULT	2
realloc.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv			.symtab	0x407fdc	128	FUNC	<unknown>	DEFAULT	2
recv.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine			.symtab	0x401284	872	FUNC	<unknown>	DEFAULT	2
register-atfork.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_conf_mtime.6430			.symtab	0x42a4f0	4	OBJECT	<unknown>	DEFAULT	12
rindex			.symtab	0x40c30c	80	FUNC	<unknown>	DEFAULT	2
rtcp			.symtab	0x403494	1108	FUNC	<unknown>	DEFAULT	2
sbrk			.symtab	0x40aa24	104	FUNC	<unknown>	DEFAULT	2
sbrk.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select			.symtab	0x40736c	136	FUNC	<unknown>	DEFAULT	2
select.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send			.symtab	0x40809c	128	FUNC	<unknown>	DEFAULT	2
send.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto			.symtab	0x408160	144	FUNC	<unknown>	DEFAULT	2
sendto.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setjmp			.symtab	0x40aaa0	4	FUNC	<unknown>	DEFAULT	2
setsid			.symtab	0x4073f4	60	FUNC	<unknown>	DEFAULT	2
setsid.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt			.symtab	0x4081f0	68	FUNC	<unknown>	DEFAULT	2
setsockopt.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate			.symtab	0x408f90	108	FUNC	<unknown>	DEFAULT	2
setstate_r			.symtab	0x4092d8	228	FUNC	<unknown>	DEFAULT	2
sigaction			.symtab	0x40c824	20	FUNC	<unknown>	DEFAULT	2
sigaction.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal			.symtab	0x408274	160	FUNC	<unknown>	DEFAULT	2
signal.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask			.symtab	0x40acb4	116	FUNC	<unknown>	DEFAULT	2
sigprocmask.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
skip_and_NUL_space			.symtab	0x40e2e4	64	FUNC	<unknown>	DEFAULT	2
skip_nospace			.symtab	0x40e2a4	64	FUNC	<unknown>	DEFAULT	2
sleep			.symtab	0x409f1c	224	FUNC	<unknown>	DEFAULT	2
sleep.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket			.symtab	0x408234	64	FUNC	<unknown>	DEFAULT	2
socket.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect			.symtab	0x40283c	288	FUNC	<unknown>	DEFAULT	2
sockprintf			.symtab	0x40102c	360	FUNC	<unknown>	DEFAULT	2
spec_and_mask.6151			.symtab	0x4125cc	16	OBJECT	<unknown>	DEFAULT	4
spec_base.6142			.symtab	0x4125b0	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.6148			.symtab	0x41261c	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.6147			.symtab	0x412634	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.6150			.symtab	0x4125dc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.6149			.symtab	0x4125ec	9	OBJECT	<unknown>	DEFAULT	4
sprintf			.symtab	0x40ec38	132	FUNC	<unknown>	DEFAULT	2
sprintf.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand			.symtab	0x409074	96	FUNC	<unknown>	DEFAULT	2
srandom			.symtab	0x409074	96	FUNC	<unknown>	DEFAULT	2
srandom_r			.symtab	0x409140	204	FUNC	<unknown>	DEFAULT	2
stat			.symtab	0x40eb30	96	FUNC	<unknown>	DEFAULT	2
stat.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv			.symtab	0x429f94	512	OBJECT	<unknown>	DEFAULT	12
static_map			.symtab	0x42a49c	52	OBJECT	<unknown>	DEFAULT	12
static_slotinfo			.symtab	0x42a194	776	OBJECT	<unknown>	DEFAULT	12
stderr			.symtab	0x4236f4	4	OBJECT	<unknown>	DEFAULT	10
stdhexflood			.symtab	0x403190	356	FUNC	<unknown>	DEFAULT	2
stdin			.symtab	0x4236ec	4	OBJECT	<unknown>	DEFAULT	10
stdout			.symtab	0x4236f0	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp			.symtab	0x410a28	64	FUNC	<unknown>	DEFAULT	2
strcasecmp.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr			.symtab	0x407ac0	196	FUNC	<unknown>	DEFAULT	2
strchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul			.symtab	0x40c204	192	FUNC	<unknown>	DEFAULT	2
strchrnul.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp			.symtab	0x407b84	34	FUNC	<unknown>	DEFAULT	2
strcmp.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll			.symtab	0x407b84	34	FUNC	<unknown>	DEFAULT	2
strcpy			.symtab	0x407aa0	16	FUNC	<unknown>	DEFAULT	2
strcspn			.symtab	0x40c2c4	72	FUNC	<unknown>	DEFAULT	2
strcspn.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup			.symtab	0x40fd0c	76	FUNC	<unknown>	DEFAULT	2
strdup.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r			.symtab	0x40fc2c	224	FUNC	<unknown>	DEFAULT	2
strlen			.symtab	0x407500	88	FUNC	<unknown>	DEFAULT	2
strncpy			.symtab	0x40d500	40	FUNC	<unknown>	DEFAULT	2
strnlen			.symtab	0x40fb84	136	FUNC	<unknown>	DEFAULT	2
strnlen.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk			.symtab	0x40c404	44	FUNC	<unknown>	DEFAULT	2
strpbrk.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr			.symtab	0x40c30c	80	FUNC	<unknown>	DEFAULT	2
strrchr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn			.symtab	0x40c35c	48	FUNC	<unknown>	DEFAULT	2
strspn.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr			.symtab	0x407ba6	182	FUNC	<unknown>	DEFAULT	2
strstr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok			.symtab	0x407c8c	24	FUNC	<unknown>	DEFAULT	2
strtok.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r			.symtab	0x40c38c	120	FUNC	<unknown>	DEFAULT	2
strtok_r.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol			.symtab	0x4093d4	20	FUNC	<unknown>	DEFAULT	2
strtol.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf			.symtab	0x4096bc	1032	FUNC	<unknown>	DEFAULT	2
sysconf.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr			.symtab	0x40c454	116	FUNC	<unknown>	DEFAULT	2
tcgetattr.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum			.symtab	0x401b14	272	FUNC	<unknown>	DEFAULT	2
time			.symtab	0x407430	16	FUNC	<unknown>	DEFAULT	2
time.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper			.symtab	0x40745c	40	FUNC	<unknown>	DEFAULT	2
toupper.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim			.symtab	0x40077c	308	FUNC	<unknown>	DEFAULT	2
type_codes			.symtab	0x4125f6	24	OBJECT	<unknown>	DEFAULT	4
type_sizes			.symtab	0x412610	12	OBJECT	<unknown>	DEFAULT	4
uname			.symtab	0x40eb90	60	FUNC	<unknown>	DEFAULT	2
uname.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown.1274			.symtab	0x41263c	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state			.symtab	0x423634	20	OBJECT	<unknown>	DEFAULT	10
useragents			.symtab	0x4235b4	28	OBJECT	<unknown>	DEFAULT	10
usleep			.symtab	0x409ac4	76	FUNC	<unknown>	DEFAULT	2
usleep.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack			.symtab	0x402a54	1512	FUNC	<unknown>	DEFAULT	2
vsnprintf			.symtab	0x40ecbc	180	FUNC	<unknown>	DEFAULT	2
vsnprintf.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid			.symtab	0x40a440	172	FUNC	<unknown>	DEFAULT	2
wcrtomb			.symtab	0x4100c8	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs			.symtab	0x41012c	124	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs			.symtab	0x41010c	32	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write			.symtab	0x40a240	172	FUNC	<unknown>	DEFAULT	2
xdigits.5851			.symtab	0x412518	17	OBJECT	<unknown>	DEFAULT	4
xstatconv.c			.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T06:50:54.328579+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46460	185.177.25.107	606	TCP
2024-12-12T06:50:56.451096+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46462	185.177.25.107	606	TCP
2024-12-12T06:50:58.574837+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46464	185.177.25.107	606	TCP
2024-12-12T06:51:00.684913+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46466	185.177.25.107	606	TCP
2024-12-12T06:51:02.809259+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46468	185.177.25.107	606	TCP
2024-12-12T06:51:04.965264+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46470	185.177.25.107	606	TCP
2024-12-12T06:51:07.121858+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46472	185.177.25.107	606	TCP
2024-12-12T06:51:09.247354+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46474	185.177.25.107	606	TCP
2024-12-12T06:51:11.371389+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46476	185.177.25.107	606	TCP
2024-12-12T06:51:13.498523+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46478	185.177.25.107	606	TCP
2024-12-12T06:51:15.623907+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46480	185.177.25.107	606	TCP
2024-12-12T06:51:17.762233+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46482	185.177.25.107	606	TCP
2024-12-12T06:51:19.887921+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46484	185.177.25.107	606	TCP
2024-12-12T06:51:21.998537+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46486	185.177.25.107	606	TCP
2024-12-12T06:51:24.123027+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46488	185.177.25.107	606	TCP
2024-12-12T06:51:26.247764+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46490	185.177.25.107	606	TCP
2024-12-12T06:51:28.372213+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46492	185.177.25.107	606	TCP
2024-12-12T06:51:30.498505+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46494	185.177.25.107	606	TCP
2024-12-12T06:51:32.623260+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46496	185.177.25.107	606	TCP
2024-12-12T06:51:34.750992+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46498	185.177.25.107	606	TCP
2024-12-12T06:51:36.873084+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46500	185.177.25.107	606	TCP
2024-12-12T06:51:38.998118+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46502	185.177.25.107	606	TCP
2024-12-12T06:51:41.121613+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46504	185.177.25.107	606	TCP
2024-12-12T06:51:43.246436+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46506	185.177.25.107	606	TCP
2024-12-12T06:51:45.372658+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46508	185.177.25.107	606	TCP
2024-12-12T06:51:47.480881+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46510	185.177.25.107	606	TCP
2024-12-12T06:51:49.591962+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46512	185.177.25.107	606	TCP
2024-12-12T06:51:51.716368+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46514	185.177.25.107	606	TCP
2024-12-12T06:51:53.841838+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46516	185.177.25.107	606	TCP
2024-12-12T06:51:55.968150+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46518	185.177.25.107	606	TCP
2024-12-12T06:51:58.108707+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46520	185.177.25.107	606	TCP
2024-12-12T06:52:00.248719+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46522	185.177.25.107	606	TCP
2024-12-12T06:52:02.373590+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46524	185.177.25.107	606	TCP
2024-12-12T06:52:04.482147+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46526	185.177.25.107	606	TCP
2024-12-12T06:52:06.610623+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46528	185.177.25.107	606	TCP
2024-12-12T06:52:08.748868+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46530	185.177.25.107	606	TCP
2024-12-12T06:52:10.872760+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46532	185.177.25.107	606	TCP
2024-12-12T06:52:12.998448+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46534	185.177.25.107	606	TCP
2024-12-12T06:52:15.122776+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46536	185.177.25.107	606	TCP
2024-12-12T06:52:17.247861+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46538	185.177.25.107	606	TCP
2024-12-12T06:52:19.356745+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46540	185.177.25.107	606	TCP
2024-12-12T06:52:21.484909+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46542	185.177.25.107	606	TCP
2024-12-12T06:52:23.607796+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46544	185.177.25.107	606	TCP
2024-12-12T06:52:25.733609+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46546	185.177.25.107	606	TCP
2024-12-12T06:52:27.857939+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46548	185.177.25.107	606	TCP
2024-12-12T06:52:29.983476+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46550	185.177.25.107	606	TCP
2024-12-12T06:52:32.108041+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46552	185.177.25.107	606	TCP
2024-12-12T06:52:34.216799+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46554	185.177.25.107	606	TCP
2024-12-12T06:52:36.343108+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46556	185.177.25.107	606	TCP
2024-12-12T06:52:38.465854+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46558	185.177.25.107	606	TCP
2024-12-12T06:52:40.575978+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46560	185.177.25.107	606	TCP
2024-12-12T06:52:42.702229+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46562	185.177.25.107	606	TCP
2024-12-12T06:52:44.827693+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46564	185.177.25.107	606	TCP
2024-12-12T06:52:46.953304+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46566	185.177.25.107	606	TCP
2024-12-12T06:52:49.059959+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46568	185.177.25.107	606	TCP
2024-12-12T06:52:51.186828+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46570	185.177.25.107	606	TCP
2024-12-12T06:52:53.310909+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46572	185.177.25.107	606	TCP
2024-12-12T06:52:55.437032+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46574	185.177.25.107	606	TCP
2024-12-12T06:52:57.564108+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46576	185.177.25.107	606	TCP
2024-12-12T06:52:59.703446+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46578	185.177.25.107	606	TCP
2024-12-12T06:53:01.827003+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46580	185.177.25.107	606	TCP
2024-12-12T06:53:03.952843+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46582	185.177.25.107	606	TCP
2024-12-12T06:53:06.061132+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46584	185.177.25.107	606	TCP
2024-12-12T06:53:08.170496+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46586	185.177.25.107	606	TCP
2024-12-12T06:53:10.296078+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46588	185.177.25.107	606	TCP
2024-12-12T06:53:12.421727+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46590	185.177.25.107	606	TCP
2024-12-12T06:53:14.546252+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46592	185.177.25.107	606	TCP
2024-12-12T06:53:16.671624+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46594	185.177.25.107	606	TCP
2024-12-12T06:53:18.797328+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46596	185.177.25.107	606	TCP
2024-12-12T06:53:20.921450+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46598	185.177.25.107	606	TCP
2024-12-12T06:53:23.045865+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46600	185.177.25.107	606	TCP
2024-12-12T06:53:25.154437+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46602	185.177.25.107	606	TCP
2024-12-12T06:53:27.281245+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46604	185.177.25.107	606	TCP
2024-12-12T06:53:29.407917+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46606	185.177.25.107	606	TCP
2024-12-12T06:53:31.515381+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46608	185.177.25.107	606	TCP
2024-12-12T06:53:33.644937+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46610	185.177.25.107	606	TCP
2024-12-12T06:53:35.781374+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46612	185.177.25.107	606	TCP
2024-12-12T06:53:37.906549+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46614	185.177.25.107	606	TCP
2024-12-12T06:53:40.014663+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46616	185.177.25.107	606	TCP
2024-12-12T06:53:42.141043+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46618	185.177.25.107	606	TCP
2024-12-12T06:53:44.249231+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46620	185.177.25.107	606	TCP
2024-12-12T06:53:46.373749+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46622	185.177.25.107	606	TCP
2024-12-12T06:53:48.499641+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46624	185.177.25.107	606	TCP
2024-12-12T06:53:50.624822+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46626	185.177.25.107	606	TCP
2024-12-12T06:53:52.755364+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46628	185.177.25.107	606	TCP
2024-12-12T06:53:54.937822+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46630	185.177.25.107	606	TCP
2024-12-12T06:53:57.047102+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46632	185.177.25.107	606	TCP
2024-12-12T06:53:59.205420+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46634	185.177.25.107	606	TCP
2024-12-12T06:54:01.345774+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46636	185.177.25.107	606	TCP
2024-12-12T06:54:03.469197+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46638	185.177.25.107	606	TCP
2024-12-12T06:54:05.949281+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46640	185.177.25.107	606	TCP
2024-12-12T06:54:08.079265+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46642	185.177.25.107	606	TCP
2024-12-12T06:54:10.204417+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46644	185.177.25.107	606	TCP
2024-12-12T06:54:12.345155+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46646	185.177.25.107	606	TCP
2024-12-12T06:54:14.470415+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46648	185.177.25.107	606	TCP
2024-12-12T06:54:16.595089+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46650	185.177.25.107	606	TCP
2024-12-12T06:54:18.721100+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46652	185.177.25.107	606	TCP
2024-12-12T06:54:20.861036+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46654	185.177.25.107	606	TCP
2024-12-12T06:54:22.968895+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46656	185.177.25.107	606	TCP
2024-12-12T06:54:25.094173+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46658	185.177.25.107	606	TCP
2024-12-12T06:54:27.219801+0100	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	46660	185.177.25.107	606	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 06:50:54.206971884 CET	46460	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:54.327223063 CET	606	46460	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:54.327337980 CET	46460	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:54.328578949 CET	46460	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:54.448275089 CET	606	46460	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:56.330003977 CET	606	46460	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:56.330661058 CET	46460	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:56.331175089 CET	46462	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:56.450483084 CET	606	46460	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:56.450575113 CET	606	46462	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:56.450823069 CET	46462	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:56.451096058 CET	46462	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:56.570722103 CET	606	46462	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:58.454492092 CET	606	46462	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:58.454807997 CET	46462	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:58.454807997 CET	46462	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:58.455255032 CET	46464	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:58.574537992 CET	606	46462	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:58.574629068 CET	606	46464	185.177.25.107	192.168.2.13
Dec 12, 2024 06:50:58.574759007 CET	46464	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:58.574836969 CET	46464	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:50:58.694363117 CET	606	46464	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:00.563539982 CET	606	46464	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:00.563966990 CET	46464	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:00.564415932 CET	46466	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:00.684636116 CET	606	46464	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:00.684693098 CET	606	46466	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:00.684854984 CET	46466	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:00.684912920 CET	46466	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:00.807002068 CET	606	46466	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:02.688863993 CET	606	46466	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:02.689070940 CET	46466	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:02.689620972 CET	46468	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:02.808660030 CET	606	46466	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:02.808954954 CET	606	46468	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:02.809164047 CET	46468	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:02.809258938 CET	46468	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:02.928715944 CET	606	46468	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:04.342761993 CET	48202	443	192.168.2.13	185.125.190.26
Dec 12, 2024 06:51:04.844984055 CET	606	46468	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:04.845243931 CET	46468	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:04.845673084 CET	46470	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:04.964744091 CET	606	46468	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:04.964978933 CET	606	46470	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:04.965147972 CET	46470	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:04.965264082 CET	46470	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:05.084678888 CET	606	46470	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:07.001337051 CET	606	46470	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:07.001619101 CET	46470	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:07.002325058 CET	46472	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:07.121094942 CET	606	46470	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:07.121562958 CET	606	46472	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:07.121701002 CET	46472	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:07.121857882 CET	46472	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:07.241539001 CET	606	46472	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:09.126763105 CET	606	46472	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:09.127028942 CET	46472	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:09.127486944 CET	46474	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:09.246959925 CET	606	46472	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:09.247065067 CET	606	46474	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:09.247306108 CET	46474	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:09.247354031 CET	46474	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:09.367265940 CET	606	46474	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:11.250708103 CET	606	46474	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:11.251034021 CET	46474	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:11.251594067 CET	46476	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:11.371141911 CET	606	46474	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:11.371195078 CET	606	46476	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:11.371330976 CET	46476	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:11.371388912 CET	46476	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:11.491189003 CET	606	46476	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:13.377696991 CET	606	46476	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:13.378068924 CET	46476	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:13.378756046 CET	46478	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:13.498033047 CET	606	46476	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:13.498127937 CET	606	46478	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:13.498425007 CET	46478	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:13.498522997 CET	46478	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:13.618628979 CET	606	46478	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:15.502413034 CET	606	46478	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:15.503366947 CET	46478	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:15.504026890 CET	46480	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:15.623008013 CET	606	46478	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:15.623528004 CET	606	46480	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:15.623650074 CET	46480	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:15.623907089 CET	46480	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:15.743529081 CET	606	46480	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:17.642029047 CET	606	46480	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:17.642184019 CET	46480	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:17.642575979 CET	46482	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:17.761727095 CET	606	46480	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:17.761879921 CET	606	46482	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:17.762136936 CET	46482	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:17.762233019 CET	46482	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:17.881732941 CET	606	46482	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:19.766828060 CET	606	46482	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:19.767271996 CET	46482	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:19.767585039 CET	46484	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:19.887515068 CET	606	46482	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:19.887569904 CET	606	46484	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:19.887919903 CET	46484	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:19.887921095 CET	46484	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:20.007940054 CET	606	46484	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:21.875785112 CET	606	46484	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:21.876194954 CET	46484	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:21.876950026 CET	46486	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:21.995902061 CET	606	46484	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:21.998024940 CET	606	46486	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:21.998537064 CET	46486	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:21.998537064 CET	46486	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:22.118657112 CET	606	46486	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:24.001508951 CET	606	46486	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:24.002002001 CET	46486	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:24.002844095 CET	46488	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:24.122005939 CET	606	46486	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:24.122668982 CET	606	46488	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:24.122935057 CET	46488	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:24.123027086 CET	46488	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:24.242980957 CET	606	46488	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:26.126688004 CET	606	46488	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:26.126998901 CET	46488	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:26.127758980 CET	46490	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:26.246617079 CET	606	46488	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:26.247145891 CET	606	46490	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:26.247376919 CET	46490	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:26.247764111 CET	46490	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:26.367471933 CET	606	46490	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:28.251427889 CET	606	46490	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:28.251785040 CET	46490	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:28.252599001 CET	46492	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:28.371124983 CET	606	46490	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:28.371844053 CET	606	46492	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:28.372056007 CET	46492	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:28.372212887 CET	46492	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:28.491460085 CET	606	46492	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:30.377007008 CET	606	46492	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:30.377259970 CET	46492	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:30.378598928 CET	46494	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:30.497087955 CET	606	46492	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:30.498078108 CET	606	46494	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:30.498255014 CET	46494	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:30.498505116 CET	46494	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:30.618906021 CET	606	46494	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:32.501826048 CET	606	46494	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:32.502336025 CET	46494	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:32.503599882 CET	46496	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:32.621774912 CET	606	46494	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:32.622945070 CET	606	46496	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:32.623063087 CET	46496	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:32.623260021 CET	46496	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:32.742664099 CET	606	46496	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:34.626332045 CET	606	46496	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:34.626821995 CET	46496	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:34.627501011 CET	46498	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:34.750068903 CET	606	46496	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:34.750524998 CET	606	46498	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:34.750936985 CET	46498	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:34.750992060 CET	46498	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:34.870552063 CET	606	46498	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:36.598782063 CET	48202	443	192.168.2.13	185.125.190.26
Dec 12, 2024 06:51:36.751966000 CET	606	46498	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:36.752217054 CET	46498	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:36.752883911 CET	46500	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:36.872034073 CET	606	46498	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:36.872752905 CET	606	46500	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:36.872972012 CET	46500	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:36.873084068 CET	46500	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:36.992527962 CET	606	46500	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:38.876796961 CET	606	46500	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:38.877239943 CET	46500	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:38.878411055 CET	46502	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:38.996772051 CET	606	46500	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:38.997764111 CET	606	46502	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:38.997940063 CET	46502	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:38.998117924 CET	46502	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:39.117628098 CET	606	46502	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:41.001105070 CET	606	46502	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:41.001487970 CET	46502	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:41.001954079 CET	46504	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:41.121052027 CET	606	46502	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:41.121390104 CET	606	46504	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:41.121505022 CET	46504	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:41.121613026 CET	46504	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:41.241122961 CET	606	46504	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:43.126084089 CET	606	46504	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:43.126319885 CET	46504	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:43.126869917 CET	46506	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:43.245834112 CET	606	46504	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:43.246160984 CET	606	46506	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:43.246383905 CET	46506	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:43.246436119 CET	46506	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:43.366105080 CET	606	46506	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:45.251600981 CET	606	46506	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:45.251933098 CET	46506	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:45.252573967 CET	46508	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:45.371571064 CET	606	46506	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:45.372319937 CET	606	46508	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:45.372657061 CET	46508	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:45.372658014 CET	46508	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:45.492475986 CET	606	46508	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:47.359718084 CET	606	46508	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:47.360241890 CET	46508	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:47.361040115 CET	46510	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:47.479830027 CET	606	46508	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:47.480448008 CET	606	46510	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:47.480626106 CET	46510	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:47.480880976 CET	46510	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:47.600244045 CET	606	46510	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:49.469748020 CET	606	46510	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:49.470181942 CET	46510	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:49.470907927 CET	46512	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:49.590981960 CET	606	46510	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:49.591545105 CET	606	46512	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:49.591691971 CET	46512	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:49.591962099 CET	46512	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:49.711438894 CET	606	46512	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:51.595474958 CET	606	46512	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:51.595933914 CET	46512	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:51.596659899 CET	46514	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:51.715612888 CET	606	46512	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:51.716017008 CET	606	46514	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:51.716181040 CET	46514	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:51.716367960 CET	46514	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:51.835659981 CET	606	46514	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:53.720851898 CET	606	46514	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:53.721139908 CET	46514	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:53.722008944 CET	46516	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:53.840724945 CET	606	46514	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:53.841460943 CET	606	46516	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:53.841744900 CET	46516	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:53.841837883 CET	46516	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:53.961330891 CET	606	46516	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:55.847135067 CET	606	46516	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:55.847523928 CET	46516	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:55.848261118 CET	46518	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:55.967236996 CET	606	46516	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:55.967782974 CET	606	46518	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:55.968149900 CET	46518	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:55.968149900 CET	46518	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:56.087691069 CET	606	46518	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:57.986383915 CET	606	46518	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:57.986721992 CET	46518	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:57.986721992 CET	46518	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:57.987885952 CET	46520	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:58.107973099 CET	606	46518	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:58.108347893 CET	606	46520	185.177.25.107	192.168.2.13
Dec 12, 2024 06:51:58.108706951 CET	46520	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:58.108706951 CET	46520	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:51:58.228400946 CET	606	46520	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:00.127496004 CET	606	46520	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:00.127779007 CET	46520	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:00.128755093 CET	46522	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:00.247335911 CET	606	46520	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:00.248323917 CET	606	46522	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:00.248672009 CET	46522	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:00.248718977 CET	46522	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:00.368261099 CET	606	46522	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:02.252329111 CET	606	46522	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:02.252713919 CET	46522	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:02.253494024 CET	46524	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:02.372262001 CET	606	46522	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:02.373109102 CET	606	46524	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:02.373495102 CET	46524	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:02.373589993 CET	46524	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:02.493119001 CET	606	46524	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:04.360708952 CET	606	46524	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:04.361248016 CET	46524	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:04.362332106 CET	46526	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:04.480933905 CET	606	46524	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:04.481769085 CET	606	46526	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:04.481950045 CET	46526	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:04.482146978 CET	46526	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:04.603549957 CET	606	46526	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:06.486525059 CET	606	46526	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:06.486942053 CET	46526	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:06.488195896 CET	46528	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:06.607075930 CET	606	46526	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:06.610270023 CET	606	46528	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:06.610429049 CET	46528	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:06.610622883 CET	46528	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:06.731271029 CET	606	46528	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:08.627469063 CET	606	46528	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:08.628249884 CET	46528	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:08.629169941 CET	46530	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:08.748050928 CET	606	46528	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:08.748497963 CET	606	46530	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:08.748764038 CET	46530	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:08.748867989 CET	46530	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:08.868292093 CET	606	46530	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:10.751581907 CET	606	46530	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:10.751867056 CET	46530	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:10.753076077 CET	46532	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:10.871484041 CET	606	46530	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:10.872471094 CET	606	46532	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:10.872608900 CET	46532	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:10.872760057 CET	46532	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:10.992131948 CET	606	46532	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:12.877269983 CET	606	46532	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:12.877564907 CET	46532	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:12.878664970 CET	46534	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:12.997014999 CET	606	46532	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:12.997919083 CET	606	46534	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:12.998354912 CET	46534	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:12.998447895 CET	46534	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:13.117928982 CET	606	46534	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:15.001912117 CET	606	46534	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:15.002156019 CET	46534	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:15.002957106 CET	46536	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:15.121715069 CET	606	46534	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:15.122509956 CET	606	46536	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:15.122776031 CET	46536	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:15.122776031 CET	46536	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:15.242572069 CET	606	46536	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:17.126899958 CET	606	46536	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:17.127423048 CET	46536	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:17.128179073 CET	46538	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:17.247000933 CET	606	46536	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:17.247510910 CET	606	46538	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:17.247750998 CET	46538	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:17.247860909 CET	46538	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:17.367501020 CET	606	46538	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:19.235246897 CET	606	46538	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:19.235830069 CET	46538	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:19.237014055 CET	46540	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:19.355478048 CET	606	46538	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:19.356486082 CET	606	46540	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:19.356744051 CET	46540	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:19.356745005 CET	46540	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:19.476334095 CET	606	46540	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:21.362092018 CET	606	46540	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:21.362560034 CET	46540	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:21.363686085 CET	46542	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:21.483542919 CET	606	46540	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:21.484549046 CET	606	46542	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:21.484806061 CET	46542	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:21.484909058 CET	46542	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:21.604415894 CET	606	46542	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:23.487000942 CET	606	46542	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:23.487452984 CET	46542	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:23.488208055 CET	46544	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:23.607037067 CET	606	46542	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:23.607568979 CET	606	46544	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:23.607676983 CET	46544	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:23.607795954 CET	46544	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:23.727526903 CET	606	46544	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:25.612410069 CET	606	46544	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:25.612750053 CET	46544	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:25.613429070 CET	46546	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:25.732568979 CET	606	46544	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:25.733194113 CET	606	46546	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:25.733608961 CET	46546	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:25.733608961 CET	46546	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:25.854506016 CET	606	46546	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:27.737003088 CET	606	46546	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:27.737253904 CET	46546	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:27.738116980 CET	46548	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:27.856829882 CET	606	46546	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:27.857650042 CET	606	46548	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:27.857939005 CET	46548	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:27.857939005 CET	46548	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:27.977360964 CET	606	46548	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:29.862065077 CET	606	46548	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:29.862582922 CET	46548	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:29.863704920 CET	46550	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:29.982058048 CET	606	46548	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:29.983020067 CET	606	46550	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:29.983382940 CET	46550	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:29.983475924 CET	46550	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:30.103744030 CET	606	46550	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:31.987045050 CET	606	46550	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:31.987396955 CET	46550	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:31.988464117 CET	46552	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:32.107294083 CET	606	46550	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:32.107876062 CET	606	46552	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:32.108041048 CET	46552	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:32.108041048 CET	46552	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:32.227688074 CET	606	46552	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:34.095814943 CET	606	46552	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:34.096147060 CET	46552	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:34.097208977 CET	46554	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:34.215704918 CET	606	46552	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:34.216561079 CET	606	46554	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:34.216737032 CET	46554	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:34.216799021 CET	46554	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:34.336555958 CET	606	46554	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:36.223145008 CET	606	46554	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:36.223474026 CET	46554	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:36.223733902 CET	46556	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:36.342951059 CET	606	46554	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:36.343012094 CET	606	46556	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:36.343064070 CET	46556	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:36.343107939 CET	46556	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:36.462445974 CET	606	46556	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:38.344886065 CET	606	46556	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:38.345266104 CET	46556	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:38.346199989 CET	46558	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:38.464731932 CET	606	46556	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:38.465584993 CET	606	46558	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:38.465679884 CET	46558	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:38.465853930 CET	46558	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:38.585201025 CET	606	46558	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:40.455133915 CET	606	46558	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:40.455544949 CET	46558	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:40.456286907 CET	46560	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:40.575139046 CET	606	46558	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:40.575711966 CET	606	46560	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:40.575829029 CET	46560	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:40.575978041 CET	46560	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:40.695343018 CET	606	46560	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:42.580709934 CET	606	46560	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:42.581191063 CET	46560	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:42.582382917 CET	46562	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:42.700643063 CET	606	46560	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:42.701704025 CET	606	46562	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:42.702030897 CET	46562	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:42.702229023 CET	46562	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:42.821475983 CET	606	46562	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:44.706335068 CET	606	46562	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:44.706708908 CET	46562	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:44.707763910 CET	46564	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:44.826397896 CET	606	46562	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:44.827338934 CET	606	46564	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:44.827692986 CET	46564	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:44.827692986 CET	46564	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:44.947216988 CET	606	46564	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:46.831043959 CET	606	46564	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:46.831527948 CET	46564	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:46.832585096 CET	46566	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:46.951596022 CET	606	46564	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:46.952925920 CET	606	46566	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:46.953113079 CET	46566	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:46.953304052 CET	46566	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:47.072616100 CET	606	46566	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:48.938873053 CET	606	46566	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:48.939372063 CET	46566	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:48.940351009 CET	46568	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:49.058877945 CET	606	46566	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:49.059710026 CET	606	46568	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:49.059813976 CET	46568	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:49.059958935 CET	46568	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:49.179300070 CET	606	46568	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:51.065632105 CET	606	46568	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:51.066037893 CET	46568	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:51.067218065 CET	46570	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:51.185962915 CET	606	46568	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:51.186563969 CET	606	46570	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:51.186702967 CET	46570	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:51.186827898 CET	46570	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:51.306339025 CET	606	46570	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:53.189727068 CET	606	46570	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:53.190195084 CET	46570	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:53.191289902 CET	46572	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:53.309627056 CET	606	46570	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:53.310597897 CET	606	46572	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:53.310909033 CET	46572	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:53.310909033 CET	46572	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:53.431545019 CET	606	46572	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:55.315526009 CET	606	46572	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:55.316072941 CET	46572	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:55.317064047 CET	46574	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:55.435467005 CET	606	46572	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:55.436516047 CET	606	46574	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:55.436892033 CET	46574	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:55.437031984 CET	46574	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:55.556523085 CET	606	46574	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:57.440742970 CET	606	46574	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:57.441411018 CET	46574	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:57.442480087 CET	46576	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:57.563374996 CET	606	46574	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:57.563687086 CET	606	46576	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:57.564017057 CET	46576	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:57.564107895 CET	46576	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:57.683466911 CET	606	46576	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:59.582207918 CET	606	46576	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:59.582861900 CET	46576	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:59.583729029 CET	46578	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:59.702461004 CET	606	46576	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:59.703157902 CET	606	46578	185.177.25.107	192.168.2.13
Dec 12, 2024 06:52:59.703356981 CET	46578	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:59.703445911 CET	46578	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:52:59.823285103 CET	606	46578	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:01.706470013 CET	606	46578	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:01.706880093 CET	46578	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:01.707367897 CET	46580	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:01.826431036 CET	606	46578	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:01.826684952 CET	606	46580	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:01.826843977 CET	46580	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:01.827003002 CET	46580	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:01.946435928 CET	606	46580	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:03.831309080 CET	606	46580	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:03.831814051 CET	46580	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:03.833060026 CET	46582	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:03.951390028 CET	606	46580	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:03.952482939 CET	606	46582	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:03.952708006 CET	46582	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:03.952842951 CET	46582	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:04.072576046 CET	606	46582	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:05.939585924 CET	606	46582	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:05.939975023 CET	46582	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:05.941229105 CET	46584	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:06.059552908 CET	606	46582	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:06.060692072 CET	606	46584	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:06.060930014 CET	46584	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:06.061131954 CET	46584	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:06.180497885 CET	606	46584	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:08.049582958 CET	606	46584	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:08.049961090 CET	46584	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:08.050674915 CET	46586	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:08.169787884 CET	606	46584	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:08.170156956 CET	606	46586	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:08.170408964 CET	46586	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:08.170495987 CET	46586	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:08.290230989 CET	606	46586	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:10.175004005 CET	606	46586	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:10.175367117 CET	46586	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:10.176369905 CET	46588	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:10.294977903 CET	606	46586	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:10.295749903 CET	606	46588	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:10.296077967 CET	46588	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:10.296077967 CET	46588	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:10.416235924 CET	606	46588	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:12.300658941 CET	606	46588	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:12.301079035 CET	46588	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:12.301886082 CET	46590	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:12.420588017 CET	606	46588	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:12.421324968 CET	606	46590	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:12.421613932 CET	46590	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:12.421726942 CET	46590	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:12.541131020 CET	606	46590	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:14.424909115 CET	606	46590	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:14.425335884 CET	46590	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:14.426568985 CET	46592	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:14.544948101 CET	606	46590	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:14.545978069 CET	606	46592	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:14.546185970 CET	46592	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:14.546252012 CET	46592	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:14.665646076 CET	606	46592	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:16.550092936 CET	606	46592	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:16.550621986 CET	46592	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:16.550621986 CET	46592	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:16.551924944 CET	46594	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:16.670242071 CET	606	46592	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:16.671298981 CET	606	46594	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:16.671623945 CET	46594	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:16.671623945 CET	46594	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:16.791757107 CET	606	46594	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:18.675888062 CET	606	46594	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:18.676264048 CET	46594	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:18.677417040 CET	46596	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:18.795847893 CET	606	46594	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:18.796823025 CET	606	46596	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:18.797233105 CET	46596	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:18.797327995 CET	46596	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:18.916917086 CET	606	46596	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:20.799734116 CET	606	46596	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:20.800153017 CET	46596	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:20.801621914 CET	46598	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:20.919868946 CET	606	46596	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:20.921010971 CET	606	46598	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:20.921351910 CET	46598	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:20.921449900 CET	46598	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:21.041096926 CET	606	46598	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:22.925088882 CET	606	46598	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:22.925343037 CET	46598	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:22.925748110 CET	46600	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:23.045363903 CET	606	46598	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:23.045412064 CET	606	46600	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:23.045650005 CET	46600	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:23.045865059 CET	46600	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:23.165661097 CET	606	46600	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:25.033288956 CET	606	46600	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:25.033687115 CET	46600	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:25.034687042 CET	46602	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:25.153466940 CET	606	46600	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:25.154052973 CET	606	46602	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:25.154268026 CET	46602	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:25.154437065 CET	46602	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:25.274054050 CET	606	46602	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:27.159542084 CET	606	46602	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:27.160092115 CET	46602	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:27.161312103 CET	46604	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:27.279587984 CET	606	46602	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:27.280766010 CET	606	46604	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:27.280986071 CET	46604	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:27.281244993 CET	46604	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:27.400569916 CET	606	46604	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:29.286324978 CET	606	46604	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:29.286896944 CET	46604	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:29.288146019 CET	46606	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:29.407038927 CET	606	46604	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:29.407397985 CET	606	46606	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:29.407819033 CET	46606	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:29.407917023 CET	46606	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:29.527412891 CET	606	46606	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:31.393615007 CET	606	46606	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:31.394010067 CET	46606	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:31.395370960 CET	46608	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:31.513696909 CET	606	46606	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:31.515005112 CET	606	46608	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:31.515381098 CET	46608	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:31.515381098 CET	46608	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:31.635046005 CET	606	46608	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:33.523272991 CET	606	46608	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:33.523770094 CET	46608	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:33.524976015 CET	46610	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:33.643415928 CET	606	46608	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:33.644392014 CET	606	46610	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:33.644845963 CET	46610	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:33.644937038 CET	46610	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:33.764518023 CET	606	46610	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:35.660221100 CET	606	46610	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:35.660515070 CET	46610	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:35.661479950 CET	46612	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:35.780147076 CET	606	46610	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:35.780910969 CET	606	46612	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:35.781373978 CET	46612	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:35.781373978 CET	46612	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:35.900890112 CET	606	46612	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:37.785202026 CET	606	46612	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:37.785736084 CET	46612	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:37.786885023 CET	46614	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:37.905188084 CET	606	46612	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:37.906272888 CET	606	46614	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:37.906413078 CET	46614	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:37.906548977 CET	46614	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:38.025896072 CET	606	46614	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:39.894397974 CET	606	46614	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:39.894506931 CET	46614	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:39.894596100 CET	46614	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:39.895123005 CET	46616	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:40.013945103 CET	606	46614	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:40.014432907 CET	606	46616	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:40.014575005 CET	46616	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:40.014662981 CET	46616	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:40.133980989 CET	606	46616	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:42.019731045 CET	606	46616	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:42.020302057 CET	46616	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:42.021017075 CET	46618	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:42.140350103 CET	606	46616	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:42.140820026 CET	606	46618	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:42.141042948 CET	46618	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:42.141042948 CET	46618	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:42.260514975 CET	606	46618	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:44.128190994 CET	606	46618	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:44.128669977 CET	46618	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:44.129566908 CET	46620	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:44.248250008 CET	606	46618	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:44.248859882 CET	606	46620	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:44.249154091 CET	46620	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:44.249231100 CET	46620	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:44.368596077 CET	606	46620	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:46.252952099 CET	606	46620	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:46.253531933 CET	46620	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:46.254060030 CET	46622	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:46.373034954 CET	606	46620	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:46.373373985 CET	606	46622	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:46.373568058 CET	46622	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:46.373749018 CET	46622	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:46.495114088 CET	606	46622	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:48.378326893 CET	606	46622	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:48.378683090 CET	46622	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:48.379219055 CET	46624	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:48.498222113 CET	606	46622	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:48.499453068 CET	606	46624	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:48.499553919 CET	46624	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:48.499640942 CET	46624	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:48.619153023 CET	606	46624	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:50.503940105 CET	606	46624	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:50.504522085 CET	46624	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:50.505017042 CET	46626	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:50.624150991 CET	606	46624	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:50.624386072 CET	606	46626	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:50.624702930 CET	46626	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:50.624821901 CET	46626	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:50.744952917 CET	606	46626	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:52.630109072 CET	606	46626	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:52.630748034 CET	46626	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:52.630748034 CET	46626	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:52.631995916 CET	46628	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:52.755090952 CET	606	46626	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:52.755151987 CET	606	46628	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:52.755362988 CET	46628	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:52.755363941 CET	46628	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:52.874814987 CET	606	46628	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:54.816715956 CET	606	46628	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:54.817045927 CET	46628	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:54.818099976 CET	46630	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:54.936695099 CET	606	46628	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:54.937535048 CET	606	46630	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:54.937741041 CET	46630	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:54.937822104 CET	46630	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:55.057296038 CET	606	46630	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:56.925779104 CET	606	46630	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:56.926320076 CET	46630	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:56.927169085 CET	46632	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:57.046569109 CET	606	46630	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:57.046623945 CET	606	46632	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:57.047101974 CET	46632	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:57.047101974 CET	46632	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:57.167414904 CET	606	46632	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:59.082762003 CET	606	46632	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:59.083554983 CET	46632	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:59.085405111 CET	46634	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:59.203450918 CET	606	46632	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:59.204757929 CET	606	46634	185.177.25.107	192.168.2.13
Dec 12, 2024 06:53:59.205166101 CET	46634	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:59.205420017 CET	46634	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:53:59.324919939 CET	606	46634	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:01.224193096 CET	606	46634	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:01.224951982 CET	46634	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:01.225917101 CET	46636	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:01.344465971 CET	606	46634	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:01.345259905 CET	606	46636	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:01.345773935 CET	46636	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:01.345773935 CET	46636	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:01.465220928 CET	606	46636	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:03.348143101 CET	606	46636	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:03.348675966 CET	46636	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:03.349348068 CET	46638	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:03.468321085 CET	606	46636	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:03.468728065 CET	606	46638	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:03.469105005 CET	46638	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:03.469197035 CET	46638	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:03.588802099 CET	606	46638	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:05.472115993 CET	606	46638	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:05.472485065 CET	46638	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:05.473618031 CET	46640	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:05.846860886 CET	46638	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:05.948421001 CET	606	46638	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:05.948467970 CET	606	46638	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:05.948508978 CET	606	46640	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:05.949177027 CET	46640	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:05.949196100 CET	46638	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:05.949280977 CET	46640	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:05.966437101 CET	606	46638	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:05.966953993 CET	46638	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:06.068747044 CET	606	46640	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:07.957571983 CET	606	46640	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:07.958187103 CET	46640	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:07.959292889 CET	46642	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:08.077953100 CET	606	46640	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:08.078665972 CET	606	46642	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:08.079035044 CET	46642	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:08.079265118 CET	46642	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:08.198889017 CET	606	46642	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:10.083029032 CET	606	46642	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:10.083595991 CET	46642	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:10.084608078 CET	46644	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:10.203221083 CET	606	46642	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:10.203974962 CET	606	46644	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:10.204327106 CET	46644	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:10.204416990 CET	46644	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:10.323970079 CET	606	46644	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:12.222956896 CET	606	46644	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:12.223573923 CET	46644	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:12.224723101 CET	46646	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:12.343239069 CET	606	46644	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:12.344530106 CET	606	46646	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:12.344854116 CET	46646	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:12.345155001 CET	46646	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:12.464512110 CET	606	46646	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:14.348414898 CET	606	46646	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:14.349055052 CET	46646	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:14.350399017 CET	46648	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:14.469005108 CET	606	46646	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:14.469901085 CET	606	46648	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:14.470415115 CET	46648	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:14.470415115 CET	46648	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:14.590244055 CET	606	46648	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:16.473504066 CET	606	46648	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:16.473923922 CET	46648	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:16.474972963 CET	46650	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:16.593645096 CET	606	46648	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:16.594685078 CET	606	46650	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:16.594808102 CET	46650	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:16.595088959 CET	46650	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:16.714489937 CET	606	46650	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:18.599709034 CET	606	46650	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:18.600281000 CET	46650	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:18.601414919 CET	46652	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:18.719796896 CET	606	46650	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:18.720791101 CET	606	46652	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:18.721100092 CET	46652	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:18.721100092 CET	46652	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:18.840650082 CET	606	46652	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:20.739371061 CET	606	46652	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:20.739964008 CET	46652	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:20.741213083 CET	46654	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:20.859836102 CET	606	46652	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:20.860619068 CET	606	46654	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:20.860783100 CET	46654	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:20.861036062 CET	46654	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:20.981194019 CET	606	46654	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:22.847672939 CET	606	46654	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:22.848036051 CET	46654	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:22.849123955 CET	46656	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:22.967612982 CET	606	46654	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:22.968619108 CET	606	46656	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:22.968790054 CET	46656	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:22.968894958 CET	46656	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:23.088393927 CET	606	46656	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:24.973484039 CET	606	46656	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:24.973741055 CET	46656	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:24.974493027 CET	46658	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:25.093355894 CET	606	46656	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:25.093863964 CET	606	46658	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:25.093996048 CET	46658	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:25.094172955 CET	46658	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:25.213557005 CET	606	46658	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:27.098031998 CET	606	46658	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:27.098582983 CET	46658	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:27.099558115 CET	46660	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:27.219013929 CET	606	46658	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:27.219388008 CET	606	46660	185.177.25.107	192.168.2.13
Dec 12, 2024 06:54:27.219566107 CET	46660	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:27.219800949 CET	46660	606	192.168.2.13	185.177.25.107
Dec 12, 2024 06:54:27.339171886 CET	606	46660	185.177.25.107	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 06:53:39.219552994 CET	48887	53	192.168.2.13	8.8.8.8
Dec 12, 2024 06:53:39.219553947 CET	51828	53	192.168.2.13	8.8.8.8
Dec 12, 2024 06:53:39.342199087 CET	53	51828	8.8.8.8	192.168.2.13
Dec 12, 2024 06:53:39.353282928 CET	53	48887	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 06:53:39.219552994 CET	192.168.2.13	8.8.8.8	0x41e6	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 06:53:39.219553947 CET	192.168.2.13	8.8.8.8	0xbd5a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 06:53:39.353282928 CET	8.8.8.8	192.168.2.13	0x41e6	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 12, 2024 06:53:39.353282928 CET	8.8.8.8	192.168.2.13	0x41e6	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: sh4.xxx.elf PID: 5478, Parent PID: 5396

General

Start time (UTC):	05:50:53
Start date (UTC):	12/12/2024
Path:	/tmp/sh4.xxx.elf
Arguments:	/tmp/sh4.xxx.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: sh4.xxx.elf PID: 5480, Parent PID: 5478

General

Start time (UTC):	05:50:53
Start date (UTC):	12/12/2024
Path:	/tmp/sh4.xxx.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: sh4.xxx.elf PID: 5482, Parent PID: 5480

General

Start time (UTC):	05:50:53
Start date (UTC):	12/12/2024
Path:	/tmp/sh4.xxx.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities